From 6f14b9bd95ba8f8de9c38434fb9fcba26c6840ad Mon Sep 17 00:00:00 2001 From: Codefly Automation <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:44:15 -0400 Subject: [PATCH 1/3] fix(accounts): read back a viewer's capability without spending it; the review's minors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Host read-backs consumed a single-use capability (#1093 review, M1). The consumer flow is verify, consume through ConsumeSingleUse, then ask the host what the capability may read — and CheckWorkContextRecordAccess, ListReadableSourceCollections and the module-parent reads (GetCurrentInstallation, the executable-artifact reads) verified with core's full Verifier, which spends the nonce in the same store. So a consumer that had verified first could not ask, a second question was refused, and a paginated listing died on page two. They now read back through core's issuer-side check (Authority.ReadBack, codefly-dev/core#788): every check a verifier makes, against live state, without touching the replay store. A question is not a use. Exchanges and derivations still verify and consume (verifyIssued). AUTHZ.md's "read-only" is now true of the capability too, and WORK_CONTEXTS.md separates the two cases. Tests, each failing with the sites back on verifyIssued: TestR1093_AConsumedSingleUseViewerCapabilityCanStillBeAskedAbout, TestR1093_TwoQuestionsAboutOneSingleUseCapability (asked twice, then consumed exactly once), TestR1093_EveryPageOfASourceListingReadsTheSameSingleUseCapability, TestR1093_AModuleAsksAboutASingleUseParentMoreThanOnce; and TestReadBackStillRefusesAStaleCapability holds it to full strength. The review's minors: - A pre-cutover (JSON) capability refused at a read-back is now logged with its cause, never its token (TestR1093_PreCutoverJSONCapabilityIsRefusedAndLogged). - The unused second SealSource (work_context_seal_source.go, with a principal- UUID build key and bindings core would refuse) is deleted with its test. - StartTaskWorkContextRequest.session_id is removed from the contract and reserved, like the other two mints' (no shim): the issuer always signed the caller's verified session or a fresh one. In-repo senders are moved; a JSON caller still sending it is refused as an unknown field. Regenerated with the pinned codefly 0.1.185 (no-change control first) and go generate ./pkg/cataloggen; the SDK rides the unreleased 0.3.28. - TestDerivedSessionsAreAssignedByTheIssuer no longer claims StartInstallationTask; TestStartInstallationTaskAssignsAFreshSessionEachTime covers it. - accounts/AGENTS.md: delegated capabilities carry the person's ordinary revision, so any organization-wide bump revokes them in flight; auth-gateway/AGENTS.md: the owner comparison is gone on purpose (the session names the owner) and the test that pins it; the key-service refusal no longer names sdk-go's signer. Co-Authored-By: Claude Opus 5.5 (1M context) --- AUTHZ.md | 5 +- module/WORK_CONTEXTS.md | 14 +- module/configurations/local/key-service.env | 5 +- .../api/accounts/authority/contract.binpb | Bin 1152397 -> 1152790 bytes .../saas/accounts/v1/work_contexts.proto | 9 +- .../api/accounts/connect/contract.binpb | Bin 1152397 -> 1152790 bytes .../saas/accounts/v1/work_contexts.proto | 9 +- module/contracts/api/catalog.codefly.json | 4 +- module/module.package.codefly.yaml | 4 +- module/services/accounts/AGENTS.md | 10 +- .../pkg/adapters/delegated_read_audience.go | 2 +- .../pkg/adapters/delegated_record_access.go | 4 +- .../code/pkg/adapters/module_parent.go | 4 +- .../code/pkg/adapters/readable_sources.go | 4 +- .../code/pkg/adapters/work_context_core.go | 38 ++- .../adapters/work_context_mcp_mint_test.go | 49 +++- .../adapters/work_context_pre_cutover_test.go | 73 ++++++ .../adapters/work_context_read_back_test.go | 142 ++++++++++++ .../work_context_reserved_audience_test.go | 1 - .../code/pkg/adapters/work_context_rpcs.go | 34 +-- .../pkg/adapters/work_context_rpcs_test.go | 1 - .../pkg/adapters/work_context_seal_source.go | 167 -------------- .../adapters/work_context_seal_source_test.go | 218 ------------------ .../work_context_solution_boundary_test.go | 5 +- .../code/pkg/business/story_host_test.go | 7 +- .../gen/saas/accounts/v1/work_contexts.pb.go | 25 +- .../accounts/code/pkg/keyservice/load.go | 19 +- .../generated/openapi-raw/api.swagger.json | 7 +- .../accounts/openapi/api.swagger.json | 5 +- .../saas/accounts/v1/work_contexts.proto | 9 +- module/services/auth-gateway/AGENTS.md | 6 +- .../code/gateway_ceiling_headers_test.go | 7 +- .../generated/contract/catalog.codefly.json | 2 +- .../generated/contract/contract.binpb | Bin 1152397 -> 1152790 bytes .../saas-sdk/generated/library.codefly.yaml | 2 +- .../gen/saas/accounts/v1/work_contexts_pb.ts | 14 +- .../gen/saas/accounts/v1/work_contexts_pb.ts | 14 +- .../module-authority/module_read_flow_test.go | 7 +- 38 files changed, 426 insertions(+), 500 deletions(-) create mode 100644 module/services/accounts/code/pkg/adapters/work_context_pre_cutover_test.go create mode 100644 module/services/accounts/code/pkg/adapters/work_context_read_back_test.go delete mode 100644 module/services/accounts/code/pkg/adapters/work_context_seal_source.go delete mode 100644 module/services/accounts/code/pkg/adapters/work_context_seal_source_test.go diff --git a/AUTHZ.md b/AUTHZ.md index 777dec73d..e8de0de6b 100644 --- a/AUTHZ.md +++ b/AUTHZ.md @@ -1005,7 +1005,10 @@ runs. It carries no repository, revision, or Argo resource. `ModuleCapabilitiesService.CheckWorkContextRecordAccess` is the internal, read-only exact-record companion to the subject-taking administrative oracle. -It verifies one signed viewer Work Context, derives tenant/owner/all actors, +It reads back one signed viewer Work Context at full strength WITHOUT CONSUMING +it (core's `Authority.ReadBack`), so it is read-only for the capability too: the +consumer that verified and consumed a single-use capability can still ask about +it, record after record. It derives tenant/owner/all actors, checks the audience's declared resource type and the SDK's attenuated kind/action/record scope, and rechecks current authorization revision and every actor-chain hop's revocation. Delegated calls require the durable chain journal. diff --git a/module/WORK_CONTEXTS.md b/module/WORK_CONTEXTS.md index b58d26f03..91f7dff0e 100644 --- a/module/WORK_CONTEXTS.md +++ b/module/WORK_CONTEXTS.md @@ -297,10 +297,16 @@ live state. The seal is re-resolved too, never copied from the parent: a person's capability is sealed to the organization's installation of the audience it now addresses (an exchange into an audience the organization never installed is refused), and a module or installation principal's to its own -installation. When this host reads back a capability it issued (a parent to derive -from, a viewer's capability presented with a question), it verifies it at full -strength for the audience the capability names; a single-use capability is -consumed by that read, as it is by whichever consumer verifies it first. +installation. A parent this host derives from is verified at full strength for +the audience it names, and a single-use parent is consumed by the derivation, as +by any consumer. A capability presented with a QUESTION — a viewer's capability +asked what it may read (`CheckWorkContextRecordAccess`, +`ListReadableSourceCollections`), a module's parent asked about its installation +or artifacts — is read back instead (core's `Authority.ReadBack`): every check a +verifier makes, against live state, but the replay store is never touched. A +question is not a use, so the consumer that verified and consumed a single-use +capability can still ask about it, on every page of a listing, and asking leaves +an unconsumed one for its consumer. ## The reserved module audience diff --git a/module/configurations/local/key-service.env b/module/configurations/local/key-service.env index dab838149..b75efdf25 100644 --- a/module/configurations/local/key-service.env +++ b/module/configurations/local/key-service.env @@ -47,10 +47,11 @@ # kms the key never leaves Cloud KMS and every signature is a request. # REFUSED BY NAME today: three consumers are HANDED the signing key # rather than being given a signer to call — the Work Context -# signer (github.com/codefly-dev/sdk-go/workcontext), the +# authority (core's workcontext.Authority, which accepts an +# injected crypto.Signer that this host does not wire yet), the # delegation minter (github.com/codefly-dev/core # policy.MintEd25519) and the OAuth state signer's seed — so each -# has to accept an injected crypto.Signer first. +# has to be given a signer first. # # A hosted cell that wants no Vault at all runs KEY_SERVICE_BACKEND=kms with # KEY_SERVICE_SIGNING_BACKEND=kms-wrapped today, and moves to `kms` once those diff --git a/module/contracts/api/accounts/authority/contract.binpb b/module/contracts/api/accounts/authority/contract.binpb index 65d02a0376f369f425c53a09877081251a51b027..5e7e7ab9083d2bf4a5442c1ee3603e3028e711c7 100644 GIT binary patch delta 10670 zcmZ8md6-qjmG3%L@4ol$yDVN=nil1O3sGDE^Eo=1ppJloqESg4GRe%>I_=2BL8Ti+ z61hOPHfRKa#s`8VMwV_sKtx-{ae=S|P(Z~cD!2qUqNthAeVgAoRdsL2Kl=OncdF`~ zQ|J87sjB<#ST+2vHN&SisU~XDO{OW=6g1_V3QfhPu&J~mx^NQB-q}8CQZ!Ae*2@KFP35bv8((g?rVgTOudN$@YIy`^U2Z)H%VXL-OL;Mi*jT&6+;-SW1e56MOpl&}7 zyM{%hsH)Ih?A!yA?*HV*74!~)-ZeRPl#qlWbZ+~kyP`Gp%OSWi8ny1 zfLYzo)lR8$O3yX}!Y*M!CNvk1iuF0>47Z+OWhksnRbmBO9$I;MVKgOyK|Qp1l%EDO zLyzg>kT$U%Mj;S;reiaVE--#9z*xzz)6g=k_sMcxN@7jWK<= zISuY792613rSr`|r@_G85pdU9HnAB&7kSIzsUA^0!q0@Q5#72wTL!j9^ti~|G8`Bv z9*Mx%_=^NfE;Ofzf<#dcI~hg2Tw-B(6#0$hU}{uNe`hL(b)!xi;81{>7gHXHgA>H& zV!G737+~GS1n`rm)43SH#fz&ibuRuR1@KWr*Cplz=c7ol<|pO{&Q>0Y7>z_M zu-VJUW;9(<>9RO#N%B}ay5ysghvCujF@718jPBdd8P3D-=wq+&vB|sG{4|Y?NU-E* zE;fn^usa5JN5~$rehmG>)cmM?$@LBBE49~_udnpGC;Epg3vgmg>O=ufjEQ?YCkoIw zrcYnzM1hs``-OL+;GFn*>V!zJ$_5!*R#kuRNZf}3|p6Gm&Twgd&iknc}H@M;^ zF76v#aRb152ZZc1;^HP0_jp&_#Kk?{6*oz7*Sq2digmp!ZUE@3ceR}W!nb-?+(0Pq zdRN?xY;o7S;wIwaZb0R;Km08y%V|*aeB$=ozUaQZk!8#qAPe_Y9`W6meW8e zlVqZ+ctDt$=qervW+u9d2SSo34!X%EnW3%t8>Qll@WU7UBvyrf}i3F9w^pRT)_jt)D&0n zKv*`#6+96NKG6v(z7wheFwP}3U3n+DpQcds+~kQ+^rlfE8=b{oJ`Nhut!{-yHx3Pr3RUMIPL4)}+IJAj8WoDa zi&a*@a&_#jsSmFFO_M^TtPigK%`FO{vRcppOmpT#0xf{Ir9PnWF`oK>$_GU0yVdZa zS)ul=52$^t?sr@2gR6csBlE$PznRHCL@0k92Y0Bddz3-Og71=epgpKn^2wr{Ap;Vc8so(y&IsM>8+m5efQd zH^`?oMvHzAT%z-oJ6bfCH(>R-ZcDDdA?kIGQ^2fi$+m>x0#(u-adcZ0O3nI$ss==< zasD)_HsSd_D(RNEj&Z)4`Pr64gmrg$5@|9x92Y1QoJ|ra1$45r!MDx@3MFSvBHw_h zISX^}ccDVf*%TzXH~?InI*fY7ILgjV$LfU~59@FaDOjkg7pMN_T;bjA3r~}Xuxt?* z-Ub5WOdQ;&svcIVW*L=-O}gru+HwC`XYaw4HA&R1{nxEgNhSAr78+sUQlB%x*Z^4; z0>Q`W7@H>*E=jTw zmn0zEl4POqe3R#Sj(HAbc@D&!*yM>03`aM4q632Hn>^7OTB2|AM9&G)H+#+j#sSb) z7d~Kkz1i~|5b8I3o&zF$n-kT4tBW5?EYbhyIp;)Jx5X1ZCq&tv+v`v*q2$`U%(46qo4zj)%xGBu&?Viy&W;D>wbW6{ecVQ#xRT#8J%N_m|a;|(cOS{r#>*Jclk=j zY#80;D;W?*cc~t`Q={&FWuD5S>MmI3Y4jvpj5)qynLWOY00r4H0)ojszU2eLziU0?%ZTULGJ2L<{$8#k z7w`?m zJNPXL90!2!C{uH@d)8Ij9*m|X2mP%MQ{cxz71s!<0ip1qI{FylB_RAbsQSE<`r(`X zTbUoe*}v_ZeIU*L5c@I5`hnU2d>?*HRdA%zwjr949P-71`EcTp@AiOj;*jt5fN)ku{eJ{;{%K2wEWl7PIB z@^ep0z}NuUD-aM|`CJt{`?+xCb9F@QAYUfF$d+O*ko~HZ7ruSr`3#7qUwA$zd1;kj zW^2(Zfyz!XbL30kDlr#pzx1s#PkinCDqD&{Ap6Y*gIM~N!i$yLDxi$IPhELwUtcRq z>=hq4Hh|S`GNvm)_%=_x2kfO{0(!A53@XXAt3v_0utz+E`ZSVjf#);OQGo- zb%MQ?<|)9<(|nul0PPLPtKy#Ytt$Gp+>^e|*5V6|`7T?Ek2gTaIXn1Z16Z{ECQo@R z{Z94snhLNpl?Y$i64?P-3ZT6l=ZRliQ>pg}P8B}10G?=%k31Ez`Dv7H9v1>2Z?*`Z zrct{2A~a1S_jbfmXqrZSy%!-gT{JyYg)0J(efH!jgsSP8st~HClY0VU6so2Zo`B1k z(

ys`_nZ$Hr)B(o6-bqaci)fleZc0*npNP}vs{G|r%+r3)Z5&Y)^r41kEq45~R# zPGN?&&CZ~s?4zkb3hvKj@A(Y@7zaSN)4$sbGz19pOmg>1K$x3Jy}fH(1vAOL>M)8e z%%uLelYPsxz}_KmBitdk@g|FLFo&xCP`U8YXlpWu3Ma}win7VMev^Q)0kUTa5UkE6 z_f`dj)w$%}s({$!Tyk$!hIW&4$-NSaa+b`?ltUZP$S~nTz^Gt%kpYDEdE_oKfY3gV z+(m|=)jp5hJ*Ft7-;!xZ=>v^$`{L4XAxB}%h4L116i$Gly@iguKoZ2TxfmcLEp+_( zP66MN=KBN{`IZES-ZP9sc4e&*BZ3tWEAW{G@# zGIx=?_d5|bQQ@4~2;tRdmaq?>5?E41n+X8#ZGY;qXoC8$C7$0HfcYg9+oA)6`6XO* z{NeqUT2;K_E7#Exz8+4gk`@cT$c_pW5PICK~)cus(Gby^Ny%zW%Cp0_$vq> zJK4KXsMG4>4;ULDOC2D1)at1N2-U5gI)Dg&tEUb_o7`4UolvOLmMMoepbIT^Fe8e+bij$OPxMu(kjoSkeLLu#xV&P=2m6q_~2PZvF#)n zg|$`G`)EmJNC{JE6&^FKEF|>)^=xJ0E8a>9!-{1=!a2x|YPr4nlz*fxTeuqwkWl#7hm-zFm*}^B|`_>wGwWTs; zYjpVBE&fErB&^xuPeefMVG9ko6raBfaFF@aizO%jBzzHJ3##H^CsnPi+`lb)q32F2 z)P!$Bc~FHw1-pq}CSCJP<&sCE-j#>9N1Kw}6i6BH1eo7VedWYq2)ny!)RoL6hTy;+ zGJmEZjKhKm9+?Gh?xE73DaUN~GNfQH1${e;p!pdJj_)YK)}O_Vqz|-(eq|o>o}aT8<_{-#{uenCKm%kMB)IQ_b)CIIEsVU$h?d3kq{Y2;xAbwM21Kl%r+zdxXp93`-FO)@XhwP%IM z5R1>UScnLkKhI(zBE;g04zUm!$KuN@79v9|zRI>FBE;hBEEXa{EWXKNAtJ=$+wUzz zEWYDexLG0DpmbxRX|dLB$J}5Wbs!($c^uv}>aKEqWr%n*>NC!F@j&kmnzX5;@z6FN zO}bP`;~_F=y+sG|%L%LDY0!MD2CusvFC`(e9Lly?2e<3Io z_)@NeGdsj!fi{Z}gCnIYXtQqT|MrW61-i5dL9hjHg*avw>fpG)li_V~H^=)a%S}Xd zxu%D-u6fjyE6>~!b#FgzZ#0mS$G6`09vlk8|@t8kKrq{*^nm1*rcq` zr44CPM24ia>a=x<2%6h;+PXx9=&#g4<+*30Ba$^bZC5geP_NBGEh2<^9jDc{ND(2_ z4`e|U5kkE_3$=(4>IZq2B_^Kh?V9$cyyUlDd!o}q&B4=lofaxT-`n-jpSl>}6&XCD z&8{>CIU9pVbZJ)_1Cc@P#*COEg697bVhS%s#Jqe|2gwsDF-45fJgI{|NPG#b7ExZ| zh~BIVXSyU?Ayob`W2wjxx~*C0M1;_7%UCKRgl@YIPI1x1Z>iuPV)v&kb|OOTc4QG2 z5m>r2V<`vZDQ)(oEX_HVKBY^0QkGgFSo$=(VVP@XVCilhbnOx@wucG6zU|ZWLFJ=; z(V}EumX-iJ-It|>pVj-awBQjDJg?2WX<7oCmgjZp-83yCLt0+Q(jp>gelbgnh&U}T z=_GhHO^b+;mi<{;L?mf>O&88^yRt&4d_7Bx$dHydv$Ti^Y57Z*77-yW2h+49Br>Gs ztt>4fLR#L=(jp?H<((`o9FX_4c|T1{;L`G*F1??o#R`#@Lpm6gZh*TC((+gAzl$px ze1G~-(+uOAIe)46PzUmD1q9`0`Jt}2G zIp1W-5fPG;e4AxQWXR5UX?F0Nyseq3CT;B^LUN{=^Z*bMk~7_;ot*>HWK1&xVmo`@ zC8x=hnh_COA9-^sX9C%|#h_5V&}HXVgXApIa@OM3e5awd_6J{z?pDd2ChcVfZ1qml zQ=Z326Mq!C)0{QZn}&$l0^o;McEz52oq+pNl#aiAqPuLdb)}TIryDPPgfBk1;6KT z*i%46sE>QI6o?2Z_(PV0!q0eP$iaPC4tVp+jA>1CP;fa|W=gGT4y+IAGd({{so<2n+xK delta 10515 zcmZ9SX_!{kk;nTi?|oN9uYfJ0EG~#E=nPR3QBXl~m>7(i%skJ0n8iFAS)7$R&A@b)gNeFFj-%>xpVB~#x$kYH=nz@@uOzv zHH|^dw~}tXIxqM|W4)^FM4Yu#%V?1<#B)SPCAhV>dV!*cJnfRS+s?}t^R zzZyfsdL81%{#I#?`@>pC1VcI)8g}SeVX;B)8R(s=Tv%9qM)TtNjcYQ4)-$Sy#c48d zMBjj{P0es!14$@tYKQ9)HjX8X)#EzyVTSiPA&#MC_{oDq5G+9$K4e4;g2lI#>1W!L z@ivoaI}v+5%MK12O1L``cfI9OYDemGqvaBdM^+DtGqE+YN6%oZgsqXi&W*N85(gBY zO~8F(orERl*b|+COzDK3jM9e&!Z;8&l3;37?}5Qo!n#q%9Uo8`7f0(dNP<&N?PxtF zx>#o2=t@jgnRTN{mFGkm7e}{_2`&!PWqg$EoM(>-J~|0&&bP+~TNM&9mPFj*vxkPU z`oiYS1&w)Gg{5QbF&Y&Nk4=w=%TO}5|A1h)BFm1vFvg}5V)OTTY@CE8-wm-*x{BR# z*gfCvv6|X(`eNJr+x@;v7v)Yk2}{0@6Pqhkx=u@%wX`YKdrhTZmp1XkMUA6vc3I^p*8+4k zH9ywfTn=@WqW^Kd;p_wOrVD}%f~0TgT52xWt$tCBMVHroJ!#iO#)mQlrDl9+A^`M_ z4^1Qk;_LX(ML?9{_|QcJ`7Sa(bP=tki%iJ%qG^I2?ful!#U@l+BSP(j!+Z=`hS~{- zk8=DFNDdIdMAedq_wn-iS#Gwl_2y^>^VH>ja_46uQS59 zA^(#?1CXV5lKzS3IEYHgCWQ_F#LT470YI3U6gmKiq)!_16Q6W}z5`t0IzSaaoCL4` zBQyZ5EgQNrGyqU)uhc(}mZjNT=^8*Lo3PlrGIRhCwyx~;^Jq(2i*$gW27<{1BrN$^ zV7b;Mc5+o{03ZRr0RS*{RcHVpmR%JZfYwPV&CKM`0f4EUtbZAOl+H0ZbO6R!I5~6x z5H3z`{bh79!69h?SBC~56Ogdv7oh=YT_zDz@+f`r+(4paO6vX6qMX`!EK-9J?iZwu@(XOagG0dp=(n~~?tDix++8Lr; zHgB{_6VR-%d2ojQ8LH|#EExSW)X~Sd-2&O|3^j08*sTa$yzTXIw?V|RnTlfYMq!|x zUF=9ZG%^liakkkXK(EG99CH;VCWobwat56c2QfKU zQDk8*OXn)8%tLMh_D0Uvkb+X0fNl!@{V2(^-9^#KSwxeSrC`H${iFoc|Jn z-zuuj2g!+8HcwG*4`_}Ynu0A}^l$OoxkncwU7+^8cQbXZmxbt0B6 zk94q_W5wPPdkQd3KzHRvIawIyWO4h3V{H5m)yI>G=_tEH4IbiB48(^!)G2r6K7`}N z-YL736w4e=9Nb!=IADAev?}*s zD7i9Hl3^CFjFbf8?@HCWD)%>1@}5XZnd1%sdoPsiR=e52NsM%=mTjHQdmA^YtW#Bv zckQsmrR*Wa%||M$#LWl9^+xsx!jZ0!2skKxv{Xy&8pZ9$E#&qC;`-wjI-Wlqd0rBp zgFMec!ik3?(ZTHR;Yf5KM1MFEU7#oW!;$DENA$IkbHFqKJsQFX#_P3_=Rnl2jXVbu zzO|Ve_-KfqNIcOWiJS`})~$;~FFB&GFSbM|Kx4vw@d3yy$Zua*zFzSR3XmPGSN+a+ zWI|J=J#z=ede#5DFhv->Au_roj0SDYwCOsJmW#QvON+Wh%4J8;epU&dnCL-Px$ST@QEY*j+hx>nt)!3ogD%CcSObm z(Z3@y9>`92sDZD9or=H{{-v0jAY$3ek?@JTH18BjcF3a3Gl6?PyaeLMPSy8~+>hAoUn~5G&HnY+>=W1QcZ(l$y&u#D z@NN8Bkk#)-QUY=AUDf(Q?p$o`??q0^ z9M8%39VZo>ET>87L)EfhHP>}Ep3Oc~l|x+u%8ryDMN$G&3-UJ|5UzZrst3fmxbl%Y zC=F096CW2#nG5otrOJ+PA4fg|S^9D0b5?e(@{?jMT?W)IC>D-<5?dv6S^G(Bm1Qkg zt51ui41)Z}83tMUsp2UrZ58N7!?&`sYhRx!o%xSG;M4+J!(>U@XYt<4AZtI9zGNVO?=bsCv6NRD=%`?aXBn{S`%PKiWxxSZQw2L;D$VD#%u|3GVs5(b6J3)kn6AU)jZwBRT@P&2{;4Vge}}wQbBBCVHd#%RnYv}ZR=qn_zq2pB znUf=kc`cYGd0%8F3O`ZBu1Y*9aDMfj10x{pz$KM*v zi@+b%x9ISFBZye`JIy8P1L09EO&05xdzynEYrLN=)_l?wr)rKdOJdl8sRen)fN*3< zWDF3EOCn={M14tQj6k2$C6O^T$C#ysaH(ebkTQs^Wjgh{&cGO3rU&|-3&hwmJ!o7o z=582#rCFwr`(Dr|1X>;mR1*S$?hFJ1V{Un2PEMiaI`wUZQLHW3eGYdStm#Y`v|Jx? zXGkFvLJDt>DGVak-61LTxe@}cD13lFpq04~ayMU5_#iA=p~F`)7=W%765j5$5t4YJ z(F)yvW$r_y(OrcP@iKn5_^?N4R8N!pb<3m8A8cy;Z+5>9pUCQtMyq3{fvE*~8iDX+ zb)*pxPgX}70g3(UNF#wh(W@hk>W)Sait=4@y91{Qa82{^CmL^D@}LeMs*t1jK^?x! z0NLS#x^+$1p$L4TbjBS95z8KmQLej>tm`z#LOPHIvz z17r{D^zq;0BX`BY_UfS`IpMbGe7d!5wMTEz(-ngb=b==$$QdzxEGU$oWY$};nw(FeFMrcuT&x9Q|>x-R7=@T^Y$-z-k_ z=X7#v*ID({KL3q{jnuv%v*hO{^pjJ&L+jm5{dA+5?a+yPC(8hS?9hEqlSm6B5k^Q;#?B)k z2fG$w?0ru?G9XRnn)*B<;;Y{aIcjb+$x*d*VA#LRA<$mHcKr_dsE_VE|WJhCnD^37Xfu5!oIQyyAu)i zdt{cUERXs7GNZTVl$EF8eI_sA65iZr@)DNE{e9+~i$gqkV>yCq$%L{GnB<|HvQA2v))bU=B1hS^rgBLM(7?b zLgz$;Zhb-7k`0vIV3HF9KixE9_gE1-Cn9!_7ZG+MD7&$stOVolUb@m zY5jIM1mv^EduG%>gqq=J>*Rf7_vgte`{cZD>ihHLI2l?$D3VhiBJ)uF$09p!nq=os zCiyT=j+2s{kD4Q1ZuH1LF_qK9Zrq5t_i2$1CnFtui*z^<>G-@zhZB*GFYnw9Qkh0N_7&-n5PWUyR2v(6Ii%xjQ=clo!Z_-AA?f&w*z78!Nd78C zGT*pkmwWT|Rxj=R&MS>uRd&72n^%RMUT+U^?_%;I--xcar;iDV;8*-)rnL+3!rw|O zJ`po*eF0ARTd9+gh*>soUQUGO*;bmDbJd9?4;?m3=Gu7PIx&g3(dOr^6S*pxXZg9x z@5&2Nd6Ui0TPGteO`D&$PDEO6vH5xHM5N_+HukQJ|4#6Exz*<9trL-#`8Ge5ortvD zX7lq_0I_=2BL8Ti+ z61hOPHfRKa#s`8VMwV_sKtx-{ae=S|P(Z~cD!2qUqNthAeVgAoRdsL2Kl=OncdF`~ zQ|J87sjB<#ST+2vHN&SisU~XDO{OW=6g1_V3QfhPu&J~mx^NQB-q}8CQZ!Ae*2@KFP35bv8((g?rVgTOudN$@YIy`^U2Z)H%VXL-OL;Mi*jT&6+;-SW1e56MOpl&}7 zyM{%hsH)Ih?A!yA?*HV*74!~)-ZeRPl#qlWbZ+~kyP`Gp%OSWi8ny1 zfLYzo)lR8$O3yX}!Y*M!CNvk1iuF0>47Z+OWhksnRbmBO9$I;MVKgOyK|Qp1l%EDO zLyzg>kT$U%Mj;S;reiaVE--#9z*xzz)6g=k_sMcxN@7jWK<= zISuY792613rSr`|r@_G85pdU9HnAB&7kSIzsUA^0!q0@Q5#72wTL!j9^ti~|G8`Bv z9*Mx%_=^NfE;Ofzf<#dcI~hg2Tw-B(6#0$hU}{uNe`hL(b)!xi;81{>7gHXHgA>H& zV!G737+~GS1n`rm)43SH#fz&ibuRuR1@KWr*Cplz=c7ol<|pO{&Q>0Y7>z_M zu-VJUW;9(<>9RO#N%B}ay5ysghvCujF@718jPBdd8P3D-=wq+&vB|sG{4|Y?NU-E* zE;fn^usa5JN5~$rehmG>)cmM?$@LBBE49~_udnpGC;Epg3vgmg>O=ufjEQ?YCkoIw zrcYnzM1hs``-OL+;GFn*>V!zJ$_5!*R#kuRNZf}3|p6Gm&Twgd&iknc}H@M;^ zF76v#aRb152ZZc1;^HP0_jp&_#Kk?{6*oz7*Sq2digmp!ZUE@3ceR}W!nb-?+(0Pq zdRN?xY;o7S;wIwaZb0R;Km08y%V|*aeB$=ozUaQZk!8#qAPe_Y9`W6meW8e zlVqZ+ctDt$=qervW+u9d2SSo34!X%EnW3%t8>Qll@WU7UBvyrf}i3F9w^pRT)_jt)D&0n zKv*`#6+96NKG6v(z7wheFwP}3U3n+DpQcds+~kQ+^rlfE8=b{oJ`Nhut!{-yHx3Pr3RUMIPL4)}+IJAj8WoDa zi&a*@a&_#jsSmFFO_M^TtPigK%`FO{vRcppOmpT#0xf{Ir9PnWF`oK>$_GU0yVdZa zS)ul=52$^t?sr@2gR6csBlE$PznRHCL@0k92Y0Bddz3-Og71=epgpKn^2wr{Ap;Vc8so(y&IsM>8+m5efQd zH^`?oMvHzAT%z-oJ6bfCH(>R-ZcDDdA?kIGQ^2fi$+m>x0#(u-adcZ0O3nI$ss==< zasD)_HsSd_D(RNEj&Z)4`Pr64gmrg$5@|9x92Y1QoJ|ra1$45r!MDx@3MFSvBHw_h zISX^}ccDVf*%TzXH~?InI*fY7ILgjV$LfU~59@FaDOjkg7pMN_T;bjA3r~}Xuxt?* z-Ub5WOdQ;&svcIVW*L=-O}gru+HwC`XYaw4HA&R1{nxEgNhSAr78+sUQlB%x*Z^4; z0>Q`W7@H>*E=jTw zmn0zEl4POqe3R#Sj(HAbc@D&!*yM>03`aM4q632Hn>^7OTB2|AM9&G)H+#+j#sSb) z7d~Kkz1i~|5b8I3o&zF$n-kT4tBW5?EYbhyIp;)Jx5X1ZCq&tv+v`v*q2$`U%(46qo4zj)%xGBu&?Viy&W;D>wbW6{ecVQ#xRT#8J%N_m|a;|(cOS{r#>*Jclk=j zY#80;D;W?*cc~t`Q={&FWuD5S>MmI3Y4jvpj5)qynLWOY00r4H0)ojszU2eLziU0?%ZTULGJ2L<{$8#k z7w`?m zJNPXL90!2!C{uH@d)8Ij9*m|X2mP%MQ{cxz71s!<0ip1qI{FylB_RAbsQSE<`r(`X zTbUoe*}v_ZeIU*L5c@I5`hnU2d>?*HRdA%zwjr949P-71`EcTp@AiOj;*jt5fN)ku{eJ{;{%K2wEWl7PIB z@^ep0z}NuUD-aM|`CJt{`?+xCb9F@QAYUfF$d+O*ko~HZ7ruSr`3#7qUwA$zd1;kj zW^2(Zfyz!XbL30kDlr#pzx1s#PkinCDqD&{Ap6Y*gIM~N!i$yLDxi$IPhELwUtcRq z>=hq4Hh|S`GNvm)_%=_x2kfO{0(!A53@XXAt3v_0utz+E`ZSVjf#);OQGo- zb%MQ?<|)9<(|nul0PPLPtKy#Ytt$Gp+>^e|*5V6|`7T?Ek2gTaIXn1Z16Z{ECQo@R z{Z94snhLNpl?Y$i64?P-3ZT6l=ZRliQ>pg}P8B}10G?=%k31Ez`Dv7H9v1>2Z?*`Z zrct{2A~a1S_jbfmXqrZSy%!-gT{JyYg)0J(efH!jgsSP8st~HClY0VU6so2Zo`B1k z(

ys`_nZ$Hr)B(o6-bqaci)fleZc0*npNP}vs{G|r%+r3)Z5&Y)^r41kEq45~R# zPGN?&&CZ~s?4zkb3hvKj@A(Y@7zaSN)4$sbGz19pOmg>1K$x3Jy}fH(1vAOL>M)8e z%%uLelYPsxz}_KmBitdk@g|FLFo&xCP`U8YXlpWu3Ma}win7VMev^Q)0kUTa5UkE6 z_f`dj)w$%}s({$!Tyk$!hIW&4$-NSaa+b`?ltUZP$S~nTz^Gt%kpYDEdE_oKfY3gV z+(m|=)jp5hJ*Ft7-;!xZ=>v^$`{L4XAxB}%h4L116i$Gly@iguKoZ2TxfmcLEp+_( zP66MN=KBN{`IZES-ZP9sc4e&*BZ3tWEAW{G@# zGIx=?_d5|bQQ@4~2;tRdmaq?>5?E41n+X8#ZGY;qXoC8$C7$0HfcYg9+oA)6`6XO* z{NeqUT2;K_E7#Exz8+4gk`@cT$c_pW5PICK~)cus(Gby^Ny%zW%Cp0_$vq> zJK4KXsMG4>4;ULDOC2D1)at1N2-U5gI)Dg&tEUb_o7`4UolvOLmMMoepbIT^Fe8e+bij$OPxMu(kjoSkeLLu#xV&P=2m6q_~2PZvF#)n zg|$`G`)EmJNC{JE6&^FKEF|>)^=xJ0E8a>9!-{1=!a2x|YPr4nlz*fxTeuqwkWl#7hm-zFm*}^B|`_>wGwWTs; zYjpVBE&fErB&^xuPeefMVG9ko6raBfaFF@aizO%jBzzHJ3##H^CsnPi+`lb)q32F2 z)P!$Bc~FHw1-pq}CSCJP<&sCE-j#>9N1Kw}6i6BH1eo7VedWYq2)ny!)RoL6hTy;+ zGJmEZjKhKm9+?Gh?xE73DaUN~GNfQH1${e;p!pdJj_)YK)}O_Vqz|-(eq|o>o}aT8<_{-#{uenCKm%kMB)IQ_b)CIIEsVU$h?d3kq{Y2;xAbwM21Kl%r+zdxXp93`-FO)@XhwP%IM z5R1>UScnLkKhI(zBE;g04zUm!$KuN@79v9|zRI>FBE;hBEEXa{EWXKNAtJ=$+wUzz zEWYDexLG0DpmbxRX|dLB$J}5Wbs!($c^uv}>aKEqWr%n*>NC!F@j&kmnzX5;@z6FN zO}bP`;~_F=y+sG|%L%LDY0!MD2CusvFC`(e9Lly?2e<3Io z_)@NeGdsj!fi{Z}gCnIYXtQqT|MrW61-i5dL9hjHg*avw>fpG)li_V~H^=)a%S}Xd zxu%D-u6fjyE6>~!b#FgzZ#0mS$G6`09vlk8|@t8kKrq{*^nm1*rcq` zr44CPM24ia>a=x<2%6h;+PXx9=&#g4<+*30Ba$^bZC5geP_NBGEh2<^9jDc{ND(2_ z4`e|U5kkE_3$=(4>IZq2B_^Kh?V9$cyyUlDd!o}q&B4=lofaxT-`n-jpSl>}6&XCD z&8{>CIU9pVbZJ)_1Cc@P#*COEg697bVhS%s#Jqe|2gwsDF-45fJgI{|NPG#b7ExZ| zh~BIVXSyU?Ayob`W2wjxx~*C0M1;_7%UCKRgl@YIPI1x1Z>iuPV)v&kb|OOTc4QG2 z5m>r2V<`vZDQ)(oEX_HVKBY^0QkGgFSo$=(VVP@XVCilhbnOx@wucG6zU|ZWLFJ=; z(V}EumX-iJ-It|>pVj-awBQjDJg?2WX<7oCmgjZp-83yCLt0+Q(jp>gelbgnh&U}T z=_GhHO^b+;mi<{;L?mf>O&88^yRt&4d_7Bx$dHydv$Ti^Y57Z*77-yW2h+49Br>Gs ztt>4fLR#L=(jp?H<((`o9FX_4c|T1{;L`G*F1??o#R`#@Lpm6gZh*TC((+gAzl$px ze1G~-(+uOAIe)46PzUmD1q9`0`Jt}2G zIp1W-5fPG;e4AxQWXR5UX?F0Nyseq3CT;B^LUN{=^Z*bMk~7_;ot*>HWK1&xVmo`@ zC8x=hnh_COA9-^sX9C%|#h_5V&}HXVgXApIa@OM3e5awd_6J{z?pDd2ChcVfZ1qml zQ=Z326Mq!C)0{QZn}&$l0^o;McEz52oq+pNl#aiAqPuLdb)}TIryDPPgfBk1;6KT z*i%46sE>QI6o?2Z_(PV0!q0eP$iaPC4tVp+jA>1CP;fa|W=gGT4y+IAGd({{so<2n+xK delta 10515 zcmZ9SX_!{kk;nTi?|oN9uYfJ0EG~#E=nPR3QBXl~m>7(i%skJ0n8iFAS)7$R&A@b)gNeFFj-%>xpVB~#x$kYH=nz@@uOzv zHH|^dw~}tXIxqM|W4)^FM4Yu#%V?1<#B)SPCAhV>dV!*cJnfRS+s?}t^R zzZyfsdL81%{#I#?`@>pC1VcI)8g}SeVX;B)8R(s=Tv%9qM)TtNjcYQ4)-$Sy#c48d zMBjj{P0es!14$@tYKQ9)HjX8X)#EzyVTSiPA&#MC_{oDq5G+9$K4e4;g2lI#>1W!L z@ivoaI}v+5%MK12O1L``cfI9OYDemGqvaBdM^+DtGqE+YN6%oZgsqXi&W*N85(gBY zO~8F(orERl*b|+COzDK3jM9e&!Z;8&l3;37?}5Qo!n#q%9Uo8`7f0(dNP<&N?PxtF zx>#o2=t@jgnRTN{mFGkm7e}{_2`&!PWqg$EoM(>-J~|0&&bP+~TNM&9mPFj*vxkPU z`oiYS1&w)Gg{5QbF&Y&Nk4=w=%TO}5|A1h)BFm1vFvg}5V)OTTY@CE8-wm-*x{BR# z*gfCvv6|X(`eNJr+x@;v7v)Yk2}{0@6Pqhkx=u@%wX`YKdrhTZmp1XkMUA6vc3I^p*8+4k zH9ywfTn=@WqW^Kd;p_wOrVD}%f~0TgT52xWt$tCBMVHroJ!#iO#)mQlrDl9+A^`M_ z4^1Qk;_LX(ML?9{_|QcJ`7Sa(bP=tki%iJ%qG^I2?ful!#U@l+BSP(j!+Z=`hS~{- zk8=DFNDdIdMAedq_wn-iS#Gwl_2y^>^VH>ja_46uQS59 zA^(#?1CXV5lKzS3IEYHgCWQ_F#LT470YI3U6gmKiq)!_16Q6W}z5`t0IzSaaoCL4` zBQyZ5EgQNrGyqU)uhc(}mZjNT=^8*Lo3PlrGIRhCwyx~;^Jq(2i*$gW27<{1BrN$^ zV7b;Mc5+o{03ZRr0RS*{RcHVpmR%JZfYwPV&CKM`0f4EUtbZAOl+H0ZbO6R!I5~6x z5H3z`{bh79!69h?SBC~56Ogdv7oh=YT_zDz@+f`r+(4paO6vX6qMX`!EK-9J?iZwu@(XOagG0dp=(n~~?tDix++8Lr; zHgB{_6VR-%d2ojQ8LH|#EExSW)X~Sd-2&O|3^j08*sTa$yzTXIw?V|RnTlfYMq!|x zUF=9ZG%^liakkkXK(EG99CH;VCWobwat56c2QfKU zQDk8*OXn)8%tLMh_D0Uvkb+X0fNl!@{V2(^-9^#KSwxeSrC`H${iFoc|Jn z-zuuj2g!+8HcwG*4`_}Ynu0A}^l$OoxkncwU7+^8cQbXZmxbt0B6 zk94q_W5wPPdkQd3KzHRvIawIyWO4h3V{H5m)yI>G=_tEH4IbiB48(^!)G2r6K7`}N z-YL736w4e=9Nb!=IADAev?}*s zD7i9Hl3^CFjFbf8?@HCWD)%>1@}5XZnd1%sdoPsiR=e52NsM%=mTjHQdmA^YtW#Bv zckQsmrR*Wa%||M$#LWl9^+xsx!jZ0!2skKxv{Xy&8pZ9$E#&qC;`-wjI-Wlqd0rBp zgFMec!ik3?(ZTHR;Yf5KM1MFEU7#oW!;$DENA$IkbHFqKJsQFX#_P3_=Rnl2jXVbu zzO|Ve_-KfqNIcOWiJS`})~$;~FFB&GFSbM|Kx4vw@d3yy$Zua*zFzSR3XmPGSN+a+ zWI|J=J#z=ede#5DFhv->Au_roj0SDYwCOsJmW#QvON+Wh%4J8;epU&dnCL-Px$ST@QEY*j+hx>nt)!3ogD%CcSObm z(Z3@y9>`92sDZD9or=H{{-v0jAY$3ek?@JTH18BjcF3a3Gl6?PyaeLMPSy8~+>hAoUn~5G&HnY+>=W1QcZ(l$y&u#D z@NN8Bkk#)-QUY=AUDf(Q?p$o`??q0^ z9M8%39VZo>ET>87L)EfhHP>}Ep3Oc~l|x+u%8ryDMN$G&3-UJ|5UzZrst3fmxbl%Y zC=F096CW2#nG5otrOJ+PA4fg|S^9D0b5?e(@{?jMT?W)IC>D-<5?dv6S^G(Bm1Qkg zt51ui41)Z}83tMUsp2UrZ58N7!?&`sYhRx!o%xSG;M4+J!(>U@XYt<4AZtI9zGNVO?=bsCv6NRD=%`?aXBn{S`%PKiWxxSZQw2L;D$VD#%u|3GVs5(b6J3)kn6AU)jZwBRT@P&2{;4Vge}}wQbBBCVHd#%RnYv}ZR=qn_zq2pB znUf=kc`cYGd0%8F3O`ZBu1Y*9aDMfj10x{pz$KM*v zi@+b%x9ISFBZye`JIy8P1L09EO&05xdzynEYrLN=)_l?wr)rKdOJdl8sRen)fN*3< zWDF3EOCn={M14tQj6k2$C6O^T$C#ysaH(ebkTQs^Wjgh{&cGO3rU&|-3&hwmJ!o7o z=582#rCFwr`(Dr|1X>;mR1*S$?hFJ1V{Un2PEMiaI`wUZQLHW3eGYdStm#Y`v|Jx? zXGkFvLJDt>DGVak-61LTxe@}cD13lFpq04~ayMU5_#iA=p~F`)7=W%765j5$5t4YJ z(F)yvW$r_y(OrcP@iKn5_^?N4R8N!pb<3m8A8cy;Z+5>9pUCQtMyq3{fvE*~8iDX+ zb)*pxPgX}70g3(UNF#wh(W@hk>W)Sait=4@y91{Qa82{^CmL^D@}LeMs*t1jK^?x! z0NLS#x^+$1p$L4TbjBS95z8KmQLej>tm`z#LOPHIvz z17r{D^zq;0BX`BY_UfS`IpMbGe7d!5wMTEz(-ngb=b==$$QdzxEGU$oWY$};nw(FeFMrcuT&x9Q|>x-R7=@T^Y$-z-k_ z=X7#v*ID({KL3q{jnuv%v*hO{^pjJ&L+jm5{dA+5?a+yPC(8hS?9hEqlSm6B5k^Q;#?B)k z2fG$w?0ru?G9XRnn)*B<;;Y{aIcjb+$x*d*VA#LRA<$mHcKr_dsE_VE|WJhCnD^37Xfu5!oIQyyAu)i zdt{cUERXs7GNZTVl$EF8eI_sA65iZr@)DNE{e9+~i$gqkV>yCq$%L{GnB<|HvQA2v))bU=B1hS^rgBLM(7?b zLgz$;Zhb-7k`0vIV3HF9KixE9_gE1-Cn9!_7ZG+MD7&$stOVolUb@m zY5jIM1mv^EduG%>gqq=J>*Rf7_vgte`{cZD>ihHLI2l?$D3VhiBJ)uF$09p!nq=os zCiyT=j+2s{kD4Q1ZuH1LF_qK9Zrq5t_i2$1CnFtui*z^<>G-@zhZB*GFYnw9Qkh0N_7&-n5PWUyR2v(6Ii%xjQ=clo!Z_-AA?f&w*z78!Nd78C zGT*pkmwWT|Rxj=R&MS>uRd&72n^%RMUT+U^?_%;I--xcar;iDV;8*-)rnL+3!rw|O zJ`po*eF0ARTd9+gh*>soUQUGO*;bmDbJd9?4;?m3=Gu7PIx&g3(dOr^6S*pxXZg9x z@5&2Nd6Ui0TPGteO`D&$PDEO6vH5xHM5N_+HukQJ|4#6Exz*<9trL-#`8Ge5ortvD zX7lq_0I_=2BL8Ti+ z61hOPHfRKa#s`8VMwV_sKtx-{ae=S|P(Z~cD!2qUqNthAeVgAoRdsL2Kl=OncdF`~ zQ|J87sjB<#ST+2vHN&SisU~XDO{OW=6g1_V3QfhPu&J~mx^NQB-q}8CQZ!Ae*2@KFP35bv8((g?rVgTOudN$@YIy`^U2Z)H%VXL-OL;Mi*jT&6+;-SW1e56MOpl&}7 zyM{%hsH)Ih?A!yA?*HV*74!~)-ZeRPl#qlWbZ+~kyP`Gp%OSWi8ny1 zfLYzo)lR8$O3yX}!Y*M!CNvk1iuF0>47Z+OWhksnRbmBO9$I;MVKgOyK|Qp1l%EDO zLyzg>kT$U%Mj;S;reiaVE--#9z*xzz)6g=k_sMcxN@7jWK<= zISuY792613rSr`|r@_G85pdU9HnAB&7kSIzsUA^0!q0@Q5#72wTL!j9^ti~|G8`Bv z9*Mx%_=^NfE;Ofzf<#dcI~hg2Tw-B(6#0$hU}{uNe`hL(b)!xi;81{>7gHXHgA>H& zV!G737+~GS1n`rm)43SH#fz&ibuRuR1@KWr*Cplz=c7ol<|pO{&Q>0Y7>z_M zu-VJUW;9(<>9RO#N%B}ay5ysghvCujF@718jPBdd8P3D-=wq+&vB|sG{4|Y?NU-E* zE;fn^usa5JN5~$rehmG>)cmM?$@LBBE49~_udnpGC;Epg3vgmg>O=ufjEQ?YCkoIw zrcYnzM1hs``-OL+;GFn*>V!zJ$_5!*R#kuRNZf}3|p6Gm&Twgd&iknc}H@M;^ zF76v#aRb152ZZc1;^HP0_jp&_#Kk?{6*oz7*Sq2digmp!ZUE@3ceR}W!nb-?+(0Pq zdRN?xY;o7S;wIwaZb0R;Km08y%V|*aeB$=ozUaQZk!8#qAPe_Y9`W6meW8e zlVqZ+ctDt$=qervW+u9d2SSo34!X%EnW3%t8>Qll@WU7UBvyrf}i3F9w^pRT)_jt)D&0n zKv*`#6+96NKG6v(z7wheFwP}3U3n+DpQcds+~kQ+^rlfE8=b{oJ`Nhut!{-yHx3Pr3RUMIPL4)}+IJAj8WoDa zi&a*@a&_#jsSmFFO_M^TtPigK%`FO{vRcppOmpT#0xf{Ir9PnWF`oK>$_GU0yVdZa zS)ul=52$^t?sr@2gR6csBlE$PznRHCL@0k92Y0Bddz3-Og71=epgpKn^2wr{Ap;Vc8so(y&IsM>8+m5efQd zH^`?oMvHzAT%z-oJ6bfCH(>R-ZcDDdA?kIGQ^2fi$+m>x0#(u-adcZ0O3nI$ss==< zasD)_HsSd_D(RNEj&Z)4`Pr64gmrg$5@|9x92Y1QoJ|ra1$45r!MDx@3MFSvBHw_h zISX^}ccDVf*%TzXH~?InI*fY7ILgjV$LfU~59@FaDOjkg7pMN_T;bjA3r~}Xuxt?* z-Ub5WOdQ;&svcIVW*L=-O}gru+HwC`XYaw4HA&R1{nxEgNhSAr78+sUQlB%x*Z^4; z0>Q`W7@H>*E=jTw zmn0zEl4POqe3R#Sj(HAbc@D&!*yM>03`aM4q632Hn>^7OTB2|AM9&G)H+#+j#sSb) z7d~Kkz1i~|5b8I3o&zF$n-kT4tBW5?EYbhyIp;)Jx5X1ZCq&tv+v`v*q2$`U%(46qo4zj)%xGBu&?Viy&W;D>wbW6{ecVQ#xRT#8J%N_m|a;|(cOS{r#>*Jclk=j zY#80;D;W?*cc~t`Q={&FWuD5S>MmI3Y4jvpj5)qynLWOY00r4H0)ojszU2eLziU0?%ZTULGJ2L<{$8#k z7w`?m zJNPXL90!2!C{uH@d)8Ij9*m|X2mP%MQ{cxz71s!<0ip1qI{FylB_RAbsQSE<`r(`X zTbUoe*}v_ZeIU*L5c@I5`hnU2d>?*HRdA%zwjr949P-71`EcTp@AiOj;*jt5fN)ku{eJ{;{%K2wEWl7PIB z@^ep0z}NuUD-aM|`CJt{`?+xCb9F@QAYUfF$d+O*ko~HZ7ruSr`3#7qUwA$zd1;kj zW^2(Zfyz!XbL30kDlr#pzx1s#PkinCDqD&{Ap6Y*gIM~N!i$yLDxi$IPhELwUtcRq z>=hq4Hh|S`GNvm)_%=_x2kfO{0(!A53@XXAt3v_0utz+E`ZSVjf#);OQGo- zb%MQ?<|)9<(|nul0PPLPtKy#Ytt$Gp+>^e|*5V6|`7T?Ek2gTaIXn1Z16Z{ECQo@R z{Z94snhLNpl?Y$i64?P-3ZT6l=ZRliQ>pg}P8B}10G?=%k31Ez`Dv7H9v1>2Z?*`Z zrct{2A~a1S_jbfmXqrZSy%!-gT{JyYg)0J(efH!jgsSP8st~HClY0VU6so2Zo`B1k z(

ys`_nZ$Hr)B(o6-bqaci)fleZc0*npNP}vs{G|r%+r3)Z5&Y)^r41kEq45~R# zPGN?&&CZ~s?4zkb3hvKj@A(Y@7zaSN)4$sbGz19pOmg>1K$x3Jy}fH(1vAOL>M)8e z%%uLelYPsxz}_KmBitdk@g|FLFo&xCP`U8YXlpWu3Ma}win7VMev^Q)0kUTa5UkE6 z_f`dj)w$%}s({$!Tyk$!hIW&4$-NSaa+b`?ltUZP$S~nTz^Gt%kpYDEdE_oKfY3gV z+(m|=)jp5hJ*Ft7-;!xZ=>v^$`{L4XAxB}%h4L116i$Gly@iguKoZ2TxfmcLEp+_( zP66MN=KBN{`IZES-ZP9sc4e&*BZ3tWEAW{G@# zGIx=?_d5|bQQ@4~2;tRdmaq?>5?E41n+X8#ZGY;qXoC8$C7$0HfcYg9+oA)6`6XO* z{NeqUT2;K_E7#Exz8+4gk`@cT$c_pW5PICK~)cus(Gby^Ny%zW%Cp0_$vq> zJK4KXsMG4>4;ULDOC2D1)at1N2-U5gI)Dg&tEUb_o7`4UolvOLmMMoepbIT^Fe8e+bij$OPxMu(kjoSkeLLu#xV&P=2m6q_~2PZvF#)n zg|$`G`)EmJNC{JE6&^FKEF|>)^=xJ0E8a>9!-{1=!a2x|YPr4nlz*fxTeuqwkWl#7hm-zFm*}^B|`_>wGwWTs; zYjpVBE&fErB&^xuPeefMVG9ko6raBfaFF@aizO%jBzzHJ3##H^CsnPi+`lb)q32F2 z)P!$Bc~FHw1-pq}CSCJP<&sCE-j#>9N1Kw}6i6BH1eo7VedWYq2)ny!)RoL6hTy;+ zGJmEZjKhKm9+?Gh?xE73DaUN~GNfQH1${e;p!pdJj_)YK)}O_Vqz|-(eq|o>o}aT8<_{-#{uenCKm%kMB)IQ_b)CIIEsVU$h?d3kq{Y2;xAbwM21Kl%r+zdxXp93`-FO)@XhwP%IM z5R1>UScnLkKhI(zBE;g04zUm!$KuN@79v9|zRI>FBE;hBEEXa{EWXKNAtJ=$+wUzz zEWYDexLG0DpmbxRX|dLB$J}5Wbs!($c^uv}>aKEqWr%n*>NC!F@j&kmnzX5;@z6FN zO}bP`;~_F=y+sG|%L%LDY0!MD2CusvFC`(e9Lly?2e<3Io z_)@NeGdsj!fi{Z}gCnIYXtQqT|MrW61-i5dL9hjHg*avw>fpG)li_V~H^=)a%S}Xd zxu%D-u6fjyE6>~!b#FgzZ#0mS$G6`09vlk8|@t8kKrq{*^nm1*rcq` zr44CPM24ia>a=x<2%6h;+PXx9=&#g4<+*30Ba$^bZC5geP_NBGEh2<^9jDc{ND(2_ z4`e|U5kkE_3$=(4>IZq2B_^Kh?V9$cyyUlDd!o}q&B4=lofaxT-`n-jpSl>}6&XCD z&8{>CIU9pVbZJ)_1Cc@P#*COEg697bVhS%s#Jqe|2gwsDF-45fJgI{|NPG#b7ExZ| zh~BIVXSyU?Ayob`W2wjxx~*C0M1;_7%UCKRgl@YIPI1x1Z>iuPV)v&kb|OOTc4QG2 z5m>r2V<`vZDQ)(oEX_HVKBY^0QkGgFSo$=(VVP@XVCilhbnOx@wucG6zU|ZWLFJ=; z(V}EumX-iJ-It|>pVj-awBQjDJg?2WX<7oCmgjZp-83yCLt0+Q(jp>gelbgnh&U}T z=_GhHO^b+;mi<{;L?mf>O&88^yRt&4d_7Bx$dHydv$Ti^Y57Z*77-yW2h+49Br>Gs ztt>4fLR#L=(jp?H<((`o9FX_4c|T1{;L`G*F1??o#R`#@Lpm6gZh*TC((+gAzl$px ze1G~-(+uOAIe)46PzUmD1q9`0`Jt}2G zIp1W-5fPG;e4AxQWXR5UX?F0Nyseq3CT;B^LUN{=^Z*bMk~7_;ot*>HWK1&xVmo`@ zC8x=hnh_COA9-^sX9C%|#h_5V&}HXVgXApIa@OM3e5awd_6J{z?pDd2ChcVfZ1qml zQ=Z326Mq!C)0{QZn}&$l0^o;McEz52oq+pNl#aiAqPuLdb)}TIryDPPgfBk1;6KT z*i%46sE>QI6o?2Z_(PV0!q0eP$iaPC4tVp+jA>1CP;fa|W=gGT4y+IAGd({{so<2n+xK delta 10515 zcmZ9SX_!{kk;nTi?|oN9uYfJ0EG~#E=nPR3QBXl~m>7(i%skJ0n8iFAS)7$R&A@b)gNeFFj-%>xpVB~#x$kYH=nz@@uOzv zHH|^dw~}tXIxqM|W4)^FM4Yu#%V?1<#B)SPCAhV>dV!*cJnfRS+s?}t^R zzZyfsdL81%{#I#?`@>pC1VcI)8g}SeVX;B)8R(s=Tv%9qM)TtNjcYQ4)-$Sy#c48d zMBjj{P0es!14$@tYKQ9)HjX8X)#EzyVTSiPA&#MC_{oDq5G+9$K4e4;g2lI#>1W!L z@ivoaI}v+5%MK12O1L``cfI9OYDemGqvaBdM^+DtGqE+YN6%oZgsqXi&W*N85(gBY zO~8F(orERl*b|+COzDK3jM9e&!Z;8&l3;37?}5Qo!n#q%9Uo8`7f0(dNP<&N?PxtF zx>#o2=t@jgnRTN{mFGkm7e}{_2`&!PWqg$EoM(>-J~|0&&bP+~TNM&9mPFj*vxkPU z`oiYS1&w)Gg{5QbF&Y&Nk4=w=%TO}5|A1h)BFm1vFvg}5V)OTTY@CE8-wm-*x{BR# z*gfCvv6|X(`eNJr+x@;v7v)Yk2}{0@6Pqhkx=u@%wX`YKdrhTZmp1XkMUA6vc3I^p*8+4k zH9ywfTn=@WqW^Kd;p_wOrVD}%f~0TgT52xWt$tCBMVHroJ!#iO#)mQlrDl9+A^`M_ z4^1Qk;_LX(ML?9{_|QcJ`7Sa(bP=tki%iJ%qG^I2?ful!#U@l+BSP(j!+Z=`hS~{- zk8=DFNDdIdMAedq_wn-iS#Gwl_2y^>^VH>ja_46uQS59 zA^(#?1CXV5lKzS3IEYHgCWQ_F#LT470YI3U6gmKiq)!_16Q6W}z5`t0IzSaaoCL4` zBQyZ5EgQNrGyqU)uhc(}mZjNT=^8*Lo3PlrGIRhCwyx~;^Jq(2i*$gW27<{1BrN$^ zV7b;Mc5+o{03ZRr0RS*{RcHVpmR%JZfYwPV&CKM`0f4EUtbZAOl+H0ZbO6R!I5~6x z5H3z`{bh79!69h?SBC~56Ogdv7oh=YT_zDz@+f`r+(4paO6vX6qMX`!EK-9J?iZwu@(XOagG0dp=(n~~?tDix++8Lr; zHgB{_6VR-%d2ojQ8LH|#EExSW)X~Sd-2&O|3^j08*sTa$yzTXIw?V|RnTlfYMq!|x zUF=9ZG%^liakkkXK(EG99CH;VCWobwat56c2QfKU zQDk8*OXn)8%tLMh_D0Uvkb+X0fNl!@{V2(^-9^#KSwxeSrC`H${iFoc|Jn z-zuuj2g!+8HcwG*4`_}Ynu0A}^l$OoxkncwU7+^8cQbXZmxbt0B6 zk94q_W5wPPdkQd3KzHRvIawIyWO4h3V{H5m)yI>G=_tEH4IbiB48(^!)G2r6K7`}N z-YL736w4e=9Nb!=IADAev?}*s zD7i9Hl3^CFjFbf8?@HCWD)%>1@}5XZnd1%sdoPsiR=e52NsM%=mTjHQdmA^YtW#Bv zckQsmrR*Wa%||M$#LWl9^+xsx!jZ0!2skKxv{Xy&8pZ9$E#&qC;`-wjI-Wlqd0rBp zgFMec!ik3?(ZTHR;Yf5KM1MFEU7#oW!;$DENA$IkbHFqKJsQFX#_P3_=Rnl2jXVbu zzO|Ve_-KfqNIcOWiJS`})~$;~FFB&GFSbM|Kx4vw@d3yy$Zua*zFzSR3XmPGSN+a+ zWI|J=J#z=ede#5DFhv->Au_roj0SDYwCOsJmW#QvON+Wh%4J8;epU&dnCL-Px$ST@QEY*j+hx>nt)!3ogD%CcSObm z(Z3@y9>`92sDZD9or=H{{-v0jAY$3ek?@JTH18BjcF3a3Gl6?PyaeLMPSy8~+>hAoUn~5G&HnY+>=W1QcZ(l$y&u#D z@NN8Bkk#)-QUY=AUDf(Q?p$o`??q0^ z9M8%39VZo>ET>87L)EfhHP>}Ep3Oc~l|x+u%8ryDMN$G&3-UJ|5UzZrst3fmxbl%Y zC=F096CW2#nG5otrOJ+PA4fg|S^9D0b5?e(@{?jMT?W)IC>D-<5?dv6S^G(Bm1Qkg zt51ui41)Z}83tMUsp2UrZ58N7!?&`sYhRx!o%xSG;M4+J!(>U@XYt<4AZtI9zGNVO?=bsCv6NRD=%`?aXBn{S`%PKiWxxSZQw2L;D$VD#%u|3GVs5(b6J3)kn6AU)jZwBRT@P&2{;4Vge}}wQbBBCVHd#%RnYv}ZR=qn_zq2pB znUf=kc`cYGd0%8F3O`ZBu1Y*9aDMfj10x{pz$KM*v zi@+b%x9ISFBZye`JIy8P1L09EO&05xdzynEYrLN=)_l?wr)rKdOJdl8sRen)fN*3< zWDF3EOCn={M14tQj6k2$C6O^T$C#ysaH(ebkTQs^Wjgh{&cGO3rU&|-3&hwmJ!o7o z=582#rCFwr`(Dr|1X>;mR1*S$?hFJ1V{Un2PEMiaI`wUZQLHW3eGYdStm#Y`v|Jx? zXGkFvLJDt>DGVak-61LTxe@}cD13lFpq04~ayMU5_#iA=p~F`)7=W%765j5$5t4YJ z(F)yvW$r_y(OrcP@iKn5_^?N4R8N!pb<3m8A8cy;Z+5>9pUCQtMyq3{fvE*~8iDX+ zb)*pxPgX}70g3(UNF#wh(W@hk>W)Sait=4@y91{Qa82{^CmL^D@}LeMs*t1jK^?x! z0NLS#x^+$1p$L4TbjBS95z8KmQLej>tm`z#LOPHIvz z17r{D^zq;0BX`BY_UfS`IpMbGe7d!5wMTEz(-ngb=b==$$QdzxEGU$oWY$};nw(FeFMrcuT&x9Q|>x-R7=@T^Y$-z-k_ z=X7#v*ID({KL3q{jnuv%v*hO{^pjJ&L+jm5{dA+5?a+yPC(8hS?9hEqlSm6B5k^Q;#?B)k z2fG$w?0ru?G9XRnn)*B<;;Y{aIcjb+$x*d*VA#LRA<$mHcKr_dsE_VE|WJhCnD^37Xfu5!oIQyyAu)i zdt{cUERXs7GNZTVl$EF8eI_sA65iZr@)DNE{e9+~i$gqkV>yCq$%L{GnB<|HvQA2v))bU=B1hS^rgBLM(7?b zLgz$;Zhb-7k`0vIV3HF9KixE9_gE1-Cn9!_7ZG+MD7&$stOVolUb@m zY5jIM1mv^EduG%>gqq=J>*Rf7_vgte`{cZD>ihHLI2l?$D3VhiBJ)uF$09p!nq=os zCiyT=j+2s{kD4Q1ZuH1LF_qK9Zrq5t_i2$1CnFtui*z^<>G-@zhZB*GFYnw9Qkh0N_7&-n5PWUyR2v(6Ii%xjQ=clo!Z_-AA?f&w*z78!Nd78C zGT*pkmwWT|Rxj=R&MS>uRd&72n^%RMUT+U^?_%;I--xcar;iDV;8*-)rnL+3!rw|O zJ`po*eF0ARTd9+gh*>soUQUGO*;bmDbJd9?4;?m3=Gu7PIx&g3(dOr^6S*pxXZg9x z@5&2Nd6Ui0TPGteO`D&$PDEO6vH5xHM5N_+HukQJ|4#6Exz*<9trL-#`8Ge5ortvD zX7lq_0 = /*@__PURE__* messageDesc(file_saas_accounts_v1_work_contexts, 0); /** + * StartTaskWorkContextRequest mints a Task capability for the caller. Its Session + * is the one the caller authenticated with — or a fresh one when it has none — + * assigned by the issuer and returned in IssuedWorkContext, never named by the + * caller: a session a caller could name is one it could name after another + * credential's, and a confined credential is paired with a capability on the + * session alone. + * * @generated from message saas.accounts.v1.StartTaskWorkContextRequest */ export type StartTaskWorkContextRequest = Message<"saas.accounts.v1.StartTaskWorkContextRequest"> & { @@ -74,11 +81,6 @@ export type StartTaskWorkContextRequest = Message<"saas.accounts.v1.StartTaskWor */ taskId: string; - /** - * @generated from field: string session_id = 3; - */ - sessionId: string; - /** * Empty means a direct human-owned Task. Otherwise this must name an active, * registered agent Principal in org_id. diff --git a/module/services/frontend/code/src/gen/saas/accounts/v1/work_contexts_pb.ts b/module/services/frontend/code/src/gen/saas/accounts/v1/work_contexts_pb.ts index 41160f518..1d8ab0837 100644 --- a/module/services/frontend/code/src/gen/saas/accounts/v1/work_contexts_pb.ts +++ b/module/services/frontend/code/src/gen/saas/accounts/v1/work_contexts_pb.ts @@ -15,7 +15,7 @@ import type { Message } from "@bufbuild/protobuf"; * Describes the file saas/accounts/v1/work_contexts.proto. */ export const file_saas_accounts_v1_work_contexts: GenFile = /*@__PURE__*/ - fileDesc("CiRzYWFzL2FjY291bnRzL3YxL3dvcmtfY29udGV4dHMucHJvdG8SEHNhYXMuYWNjb3VudHMudjEiiQEKEFdvcmtDb250ZXh0U2NvcGUSIQoNcmVzb3VyY2Vfa2luZBgBIAEoCUIKukgHcgUQARiAARImCgdhY3Rpb25zGAIgAygJQhW6SBKSAQ8IARBAGAEiB3IFEAEYgAESKgoMcmVzb3VyY2VfaWRzGAMgAygJQhS6SBGSAQ4QgAIYASIHcgUQARiABCLGAwobU3RhcnRUYXNrV29ya0NvbnRleHRSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESHAoHdGFza19pZBgCIAEoCUILukgI2AEBcgOwAQESHAoKc2Vzc2lvbl9pZBgDIAEoCUIIukgFcgOwAQESGgoSYWN0b3JfcHJpbmNpcGFsX2lkGAQgASgJEkgKEGF1dGhvcml0eV9zY29wZXMYBSADKAsyIi5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0U2NvcGVCCrpIB5IBBAgBEEASHAoIYXVkaWVuY2UYBiABKAlCCrpIB3IFEAEYgAQSQAoNcmVwbGF5X3BvbGljeRgHIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYCCABKAVCCrpIBxoFGIQHKAASJQoMd29ya3NwYWNlX2lkGAkgASgJQgq6SAdyBRABGIAESACIAQESIwoKcHJvamVjdF9pZBgKIAEoCUIKukgHcgUQARiABEgBiAEBQg8KDV93b3Jrc3BhY2VfaWRCDQoLX3Byb2plY3RfaWQivwMKHFN0YXJ0SW5zdGFsbGF0aW9uVGFza1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIhCg9pbnN0YWxsYXRpb25faWQYAiABKAlCCLpIBXIDsAEBEhkKB3Rhc2tfaWQYAyABKAlCCLpIBXIDsAEBEkgKEGF1dGhvcml0eV9zY29wZXMYBSADKAsyIi5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0U2NvcGVCCrpIB5IBBAgBEEASHAoIYXVkaWVuY2UYBiABKAlCCrpIB3IFEAEYgAQSQAoNcmVwbGF5X3BvbGljeRgHIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYCCABKAVCCrpIBxoFGIQHKAASJQoMd29ya3NwYWNlX2lkGAkgASgJQgq6SAdyBRABGIAESACIAQESIwoKcHJvamVjdF9pZBgKIAEoCUIKukgHcgUQARiABEgBiAEBQg8KDV93b3Jrc3BhY2VfaWRCDQoLX3Byb2plY3RfaWRKBAgEEAVSCnNlc3Npb25faWQijQIKIlN0YXJ0Um9vdFNlc3Npb25Xb3JrQ29udGV4dFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIuChlwYXJlbnRfd29ya19jb250ZXh0X3Rva2VuGAIgASgJQgu6SAhyBhABGICAAhIcCgpzZXNzaW9uX2lkGAMgASgJQgi6SAVyA7ABARIcCghhdWRpZW5jZRgEIAEoCUIKukgHcgUQARiABBJACg1yZXBsYXlfcG9saWN5GAUgASgOMikuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFJlcGxheVBvbGljeRIfCgt0dGxfc2Vjb25kcxgGIAEoBUIKukgHGgUYhAcoACK6AgoiRXhjaGFuZ2VXb3JrQ29udGV4dEF1ZGllbmNlUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEi4KGXBhcmVudF93b3JrX2NvbnRleHRfdG9rZW4YAiABKAlCC7pICHIGEAEYgIACEhwKCGF1ZGllbmNlGAMgASgJQgq6SAdyBRABGIAEEkkKEWF0dGVudWF0ZWRfc2NvcGVzGAQgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFNjb3BlQgq6SAeSAQQIARBAEkAKDXJlcGxheV9wb2xpY3kYBSABKA4yKS5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0UmVwbGF5UG9saWN5Eh8KC3R0bF9zZWNvbmRzGAYgASgFQgq6SAcaBRiEBygAIvACCiNTdGFydENoaWxkU2Vzc2lvbldvcmtDb250ZXh0UmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEi4KGXBhcmVudF93b3JrX2NvbnRleHRfdG9rZW4YAiABKAlCC7pICHIGEAEYgIACEiQKEmFjdG9yX3ByaW5jaXBhbF9pZBgEIAEoCUIIukgFcgOwAQESRgoOZ3JhbnRlZF9zY29wZXMYBSADKAsyIi5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0U2NvcGVCCrpIB5IBBAgBEEASHAoIYXVkaWVuY2UYBiABKAlCCrpIB3IFEAEYgAQSQAoNcmVwbGF5X3BvbGljeRgHIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYCCABKAVCCrpIBxoFGIQHKABKBAgDEARSCnNlc3Npb25faWQivwIKF1JlbmV3V29ya0NvbnRleHRSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESLgoZcGFyZW50X3dvcmtfY29udGV4dF90b2tlbhgCIAEoCUILukgIcgYQARiAgAISIQoIYXVkaWVuY2UYAyABKAlCCrpIB3IFEAEYgARIAIgBARJHChFhdHRlbnVhdGVkX3Njb3BlcxgEIAMoCzIiLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRTY29wZUIIukgFkgECEEASQAoNcmVwbGF5X3BvbGljeRgFIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYBiABKAVCCrpIBxoFGIQHKABCCwoJX2F1ZGllbmNlIvECChFJc3N1ZWRXb3JrQ29udGV4dBINCgV0b2tlbhgBIAEoCRIOCgZvcmdfaWQYAiABKAkSGgoSb3duZXJfcHJpbmNpcGFsX2lkGAMgASgJEg8KB3Rhc2tfaWQYBCABKAkSEgoKc2Vzc2lvbl9pZBgFIAEoCRIeChFwYXJlbnRfc2Vzc2lvbl9pZBgGIAEoCUgAiAEBEiIKGmN1cnJlbnRfYWN0b3JfcHJpbmNpcGFsX2lkGAcgASgJEh4KFmF1dGhvcml6YXRpb25fcmV2aXNpb24YCCABKAQSLgoKZXhwaXJlc19hdBgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGQoMd29ya3NwYWNlX2lkGAogASgJSAGIAQESFwoKcHJvamVjdF9pZBgLIAEoCUgCiAEBQhQKEl9wYXJlbnRfc2Vzc2lvbl9pZEIPCg1fd29ya3NwYWNlX2lkQg0KC19wcm9qZWN0X2lkInoKGldvcmtDb250ZXh0UmV2aXNpb25TdWJqZWN0Eh4KDHByaW5jaXBhbF9pZBgBIAEoCUIIukgFcgOwAQESPAoGc2NvcGVzGAIgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFNjb3BlQgi6SAWSAQIQQCKgAgohQ2hlY2tBdXRob3JpemF0aW9uUmV2aXNpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESJAoSb3duZXJfcHJpbmNpcGFsX2lkGAIgASgJQgi6SAVyA7ABARInChZhdXRob3JpemF0aW9uX3JldmlzaW9uGAMgASgEQge6SAQyAiAAEkoKCHN1YmplY3RzGAQgAygLMiwuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFJldmlzaW9uU3ViamVjdEIKukgHkgEECAEQERItChRvcGVyYXRpb25fYmluZGluZ19pZBgFIAEoCUIKukgHcgUQARiABEgAiAEBQhcKFV9vcGVyYXRpb25fYmluZGluZ19pZCKDAgocQXV0aG9yaXplRXZpZGVuY2VSZWFkUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEiUKE2NhbGxlcl9wcmluY2lwYWxfaWQYAiABKAlCCLpIBXIDsAEBEikKEm93bmVyX3ByaW5jaXBhbF9pZBgDIAEoCUIIukgFcgOwAQFIAIgBARIgCgd0YXNrX2lkGAQgASgJQgq6SAdyBRABGIAESAGIAQESIwoKc2Vzc2lvbl9pZBgFIAEoCUIKukgHcgUQARiABEgCiAEBQhUKE19vd25lcl9wcmluY2lwYWxfaWRCCgoIX3Rhc2tfaWRCDQoLX3Nlc3Npb25faWQilgEKIkNvbnN1bWVTaW5nbGVVc2VXb3JrQ29udGV4dFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIeCgpjb250ZXh0X2lkGAIgASgJQgq6SAdyBRABGIAEEjYKCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQga6SAPIAQEqmwEKF1dvcmtDb250ZXh0UmVwbGF5UG9saWN5EioKJldPUktfQ09OVEVYVF9SRVBMQVlfUE9MSUNZX1VOU1BFQ0lGSUVEEAASKQolV09SS19DT05URVhUX1JFUExBWV9QT0xJQ1lfSURFTVBPVEVOVBABEikKJVdPUktfQ09OVEVYVF9SRVBMQVlfUE9MSUNZX1NJTkdMRV9VU0UQAjL7DAoSV29ya0NvbnRleHRTZXJ2aWNlEoMBChpDaGVja0F1dGhvcml6YXRpb25SZXZpc2lvbhIzLnNhYXMuYWNjb3VudHMudjEuQ2hlY2tBdXRob3JpemF0aW9uUmV2aXNpb25SZXF1ZXN0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IhjC8xgUCAMQATABOgIQAUABSAdQA1gDYAESeQoVQXV0aG9yaXplRXZpZGVuY2VSZWFkEi4uc2Fhcy5hY2NvdW50cy52MS5BdXRob3JpemVFdmlkZW5jZVJlYWRSZXF1ZXN0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IhjC8xgUCAMQATABOgIQAUABSAdQA1gDYAESegoQQ29uc3VtZVNpbmdsZVVzZRI0LnNhYXMuYWNjb3VudHMudjEuQ29uc3VtZVNpbmdsZVVzZVdvcmtDb250ZXh0UmVxdWVzdBoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSIYwvMYFAgDEAEwAToCEAFAAUgHUANYA2ABEsoBCglTdGFydFRhc2sSLS5zYWFzLmFjY291bnRzLnYxLlN0YXJ0VGFza1dvcmtDb250ZXh0UmVxdWVzdBojLnNhYXMuYWNjb3VudHMudjEuSXNzdWVkV29ya0NvbnRleHQiacLzGEQIAhADKgwKBm9yZ19pZBACGAEwAToiCh5zYWFzLndvcmtfY29udGV4dC50YXNrX3N0YXJ0ZWQQAkABSAVQA1gEYAF4AoLT5JMCGzoBKiIWL3YxL3dvcmstY29udGV4dHM6dGFzaxKGAQoVU3RhcnRJbnN0YWxsYXRpb25UYXNrEi4uc2Fhcy5hY2NvdW50cy52MS5TdGFydEluc3RhbGxhdGlvblRhc2tSZXF1ZXN0GiMuc2Fhcy5hY2NvdW50cy52MS5Jc3N1ZWRXb3JrQ29udGV4dCIYwvMYFAgDEAEwAToCEAFAAUgHUANYBGABEugBChBTdGFydFJvb3RTZXNzaW9uEjQuc2Fhcy5hY2NvdW50cy52MS5TdGFydFJvb3RTZXNzaW9uV29ya0NvbnRleHRSZXF1ZXN0GiMuc2Fhcy5hY2NvdW50cy52MS5Jc3N1ZWRXb3JrQ29udGV4dCJ5wvMYTAgCEAMqDAoGb3JnX2lkEAIYATABOioKJnNhYXMud29ya19jb250ZXh0LnJvb3Rfc2Vzc2lvbl9zdGFydGVkEAJAAUgFUARYBGABeAKC0+STAiM6ASoiHi92MS93b3JrLWNvbnRleHRzOnJvb3Qtc2Vzc2lvbhLrAQoQRXhjaGFuZ2VBdWRpZW5jZRI0LnNhYXMuYWNjb3VudHMudjEuRXhjaGFuZ2VXb3JrQ29udGV4dEF1ZGllbmNlUmVxdWVzdBojLnNhYXMuYWNjb3VudHMudjEuSXNzdWVkV29ya0NvbnRleHQifMLzGEoIAhADKgwKBm9yZ19pZBACGAEwATooCiRzYWFzLndvcmtfY29udGV4dC5hdWRpZW5jZV9leGNoYW5nZWQQAkABSAVQBFgEYAF4AoLT5JMCKDoBKiIjL3YxL3dvcmstY29udGV4dHM6ZXhjaGFuZ2UtYXVkaWVuY2US7AEKEVN0YXJ0Q2hpbGRTZXNzaW9uEjUuc2Fhcy5hY2NvdW50cy52MS5TdGFydENoaWxkU2Vzc2lvbldvcmtDb250ZXh0UmVxdWVzdBojLnNhYXMuYWNjb3VudHMudjEuSXNzdWVkV29ya0NvbnRleHQie8LzGE0IAhADKgwKBm9yZ19pZBACGAEwATorCidzYWFzLndvcmtfY29udGV4dC5jaGlsZF9zZXNzaW9uX3N0YXJ0ZWQQAkABSAVQBFgEYAF4AoLT5JMCJDoBKiIfL3YxL3dvcmstY29udGV4dHM6Y2hpbGQtc2Vzc2lvbhLJAQoQUmVuZXdXb3JrQ29udGV4dBIpLnNhYXMuYWNjb3VudHMudjEuUmVuZXdXb3JrQ29udGV4dFJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLklzc3VlZFdvcmtDb250ZXh0ImXC8xg/CAIQAyoMCgZvcmdfaWQQAhgBMAE6HQoZc2Fhcy53b3JrX2NvbnRleHQucmVuZXdlZBACQAFIBVAEWARgAXgCgtPkkwIcOgEqIhcvdjEvd29yay1jb250ZXh0czpyZW5ld0K5AQoUY29tLnNhYXMuYWNjb3VudHMudjFCEVdvcmtDb250ZXh0c1Byb3RvUAFaLGFjY291bnRzL3BrZy9nZW4vc2Fhcy9hY2NvdW50cy92MTthY2NvdW50c3YxogIDU0FYqgIQU2Fhcy5BY2NvdW50cy5WMcoCEFNhYXNcQWNjb3VudHNcVjHiAhxTYWFzXEFjY291bnRzXFYxXEdQQk1ldGFkYXRh6gISU2Fhczo6QWNjb3VudHM6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_google_api_annotations, file_google_protobuf_empty, file_google_protobuf_timestamp, file_saas_policy_v1_options]); + fileDesc("CiRzYWFzL2FjY291bnRzL3YxL3dvcmtfY29udGV4dHMucHJvdG8SEHNhYXMuYWNjb3VudHMudjEiiQEKEFdvcmtDb250ZXh0U2NvcGUSIQoNcmVzb3VyY2Vfa2luZBgBIAEoCUIKukgHcgUQARiAARImCgdhY3Rpb25zGAIgAygJQhW6SBKSAQ8IARBAGAEiB3IFEAEYgAESKgoMcmVzb3VyY2VfaWRzGAMgAygJQhS6SBGSAQ4QgAIYASIHcgUQARiABCK6AwobU3RhcnRUYXNrV29ya0NvbnRleHRSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESHAoHdGFza19pZBgCIAEoCUILukgI2AEBcgOwAQESGgoSYWN0b3JfcHJpbmNpcGFsX2lkGAQgASgJEkgKEGF1dGhvcml0eV9zY29wZXMYBSADKAsyIi5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0U2NvcGVCCrpIB5IBBAgBEEASHAoIYXVkaWVuY2UYBiABKAlCCrpIB3IFEAEYgAQSQAoNcmVwbGF5X3BvbGljeRgHIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYCCABKAVCCrpIBxoFGIQHKAASJQoMd29ya3NwYWNlX2lkGAkgASgJQgq6SAdyBRABGIAESACIAQESIwoKcHJvamVjdF9pZBgKIAEoCUIKukgHcgUQARiABEgBiAEBQg8KDV93b3Jrc3BhY2VfaWRCDQoLX3Byb2plY3RfaWRKBAgDEARSCnNlc3Npb25faWQivwMKHFN0YXJ0SW5zdGFsbGF0aW9uVGFza1JlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIhCg9pbnN0YWxsYXRpb25faWQYAiABKAlCCLpIBXIDsAEBEhkKB3Rhc2tfaWQYAyABKAlCCLpIBXIDsAEBEkgKEGF1dGhvcml0eV9zY29wZXMYBSADKAsyIi5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0U2NvcGVCCrpIB5IBBAgBEEASHAoIYXVkaWVuY2UYBiABKAlCCrpIB3IFEAEYgAQSQAoNcmVwbGF5X3BvbGljeRgHIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYCCABKAVCCrpIBxoFGIQHKAASJQoMd29ya3NwYWNlX2lkGAkgASgJQgq6SAdyBRABGIAESACIAQESIwoKcHJvamVjdF9pZBgKIAEoCUIKukgHcgUQARiABEgBiAEBQg8KDV93b3Jrc3BhY2VfaWRCDQoLX3Byb2plY3RfaWRKBAgEEAVSCnNlc3Npb25faWQijQIKIlN0YXJ0Um9vdFNlc3Npb25Xb3JrQ29udGV4dFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIuChlwYXJlbnRfd29ya19jb250ZXh0X3Rva2VuGAIgASgJQgu6SAhyBhABGICAAhIcCgpzZXNzaW9uX2lkGAMgASgJQgi6SAVyA7ABARIcCghhdWRpZW5jZRgEIAEoCUIKukgHcgUQARiABBJACg1yZXBsYXlfcG9saWN5GAUgASgOMikuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFJlcGxheVBvbGljeRIfCgt0dGxfc2Vjb25kcxgGIAEoBUIKukgHGgUYhAcoACK6AgoiRXhjaGFuZ2VXb3JrQ29udGV4dEF1ZGllbmNlUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEi4KGXBhcmVudF93b3JrX2NvbnRleHRfdG9rZW4YAiABKAlCC7pICHIGEAEYgIACEhwKCGF1ZGllbmNlGAMgASgJQgq6SAdyBRABGIAEEkkKEWF0dGVudWF0ZWRfc2NvcGVzGAQgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFNjb3BlQgq6SAeSAQQIARBAEkAKDXJlcGxheV9wb2xpY3kYBSABKA4yKS5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0UmVwbGF5UG9saWN5Eh8KC3R0bF9zZWNvbmRzGAYgASgFQgq6SAcaBRiEBygAIvACCiNTdGFydENoaWxkU2Vzc2lvbldvcmtDb250ZXh0UmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEi4KGXBhcmVudF93b3JrX2NvbnRleHRfdG9rZW4YAiABKAlCC7pICHIGEAEYgIACEiQKEmFjdG9yX3ByaW5jaXBhbF9pZBgEIAEoCUIIukgFcgOwAQESRgoOZ3JhbnRlZF9zY29wZXMYBSADKAsyIi5zYWFzLmFjY291bnRzLnYxLldvcmtDb250ZXh0U2NvcGVCCrpIB5IBBAgBEEASHAoIYXVkaWVuY2UYBiABKAlCCrpIB3IFEAEYgAQSQAoNcmVwbGF5X3BvbGljeRgHIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYCCABKAVCCrpIBxoFGIQHKABKBAgDEARSCnNlc3Npb25faWQivwIKF1JlbmV3V29ya0NvbnRleHRSZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESLgoZcGFyZW50X3dvcmtfY29udGV4dF90b2tlbhgCIAEoCUILukgIcgYQARiAgAISIQoIYXVkaWVuY2UYAyABKAlCCrpIB3IFEAEYgARIAIgBARJHChFhdHRlbnVhdGVkX3Njb3BlcxgEIAMoCzIiLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRTY29wZUIIukgFkgECEEASQAoNcmVwbGF5X3BvbGljeRgFIAEoDjIpLnNhYXMuYWNjb3VudHMudjEuV29ya0NvbnRleHRSZXBsYXlQb2xpY3kSHwoLdHRsX3NlY29uZHMYBiABKAVCCrpIBxoFGIQHKABCCwoJX2F1ZGllbmNlIvECChFJc3N1ZWRXb3JrQ29udGV4dBINCgV0b2tlbhgBIAEoCRIOCgZvcmdfaWQYAiABKAkSGgoSb3duZXJfcHJpbmNpcGFsX2lkGAMgASgJEg8KB3Rhc2tfaWQYBCABKAkSEgoKc2Vzc2lvbl9pZBgFIAEoCRIeChFwYXJlbnRfc2Vzc2lvbl9pZBgGIAEoCUgAiAEBEiIKGmN1cnJlbnRfYWN0b3JfcHJpbmNpcGFsX2lkGAcgASgJEh4KFmF1dGhvcml6YXRpb25fcmV2aXNpb24YCCABKAQSLgoKZXhwaXJlc19hdBgJIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASGQoMd29ya3NwYWNlX2lkGAogASgJSAGIAQESFwoKcHJvamVjdF9pZBgLIAEoCUgCiAEBQhQKEl9wYXJlbnRfc2Vzc2lvbl9pZEIPCg1fd29ya3NwYWNlX2lkQg0KC19wcm9qZWN0X2lkInoKGldvcmtDb250ZXh0UmV2aXNpb25TdWJqZWN0Eh4KDHByaW5jaXBhbF9pZBgBIAEoCUIIukgFcgOwAQESPAoGc2NvcGVzGAIgAygLMiIuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFNjb3BlQgi6SAWSAQIQQCKgAgohQ2hlY2tBdXRob3JpemF0aW9uUmV2aXNpb25SZXF1ZXN0EhgKBm9yZ19pZBgBIAEoCUIIukgFcgOwAQESJAoSb3duZXJfcHJpbmNpcGFsX2lkGAIgASgJQgi6SAVyA7ABARInChZhdXRob3JpemF0aW9uX3JldmlzaW9uGAMgASgEQge6SAQyAiAAEkoKCHN1YmplY3RzGAQgAygLMiwuc2Fhcy5hY2NvdW50cy52MS5Xb3JrQ29udGV4dFJldmlzaW9uU3ViamVjdEIKukgHkgEECAEQERItChRvcGVyYXRpb25fYmluZGluZ19pZBgFIAEoCUIKukgHcgUQARiABEgAiAEBQhcKFV9vcGVyYXRpb25fYmluZGluZ19pZCKDAgocQXV0aG9yaXplRXZpZGVuY2VSZWFkUmVxdWVzdBIYCgZvcmdfaWQYASABKAlCCLpIBXIDsAEBEiUKE2NhbGxlcl9wcmluY2lwYWxfaWQYAiABKAlCCLpIBXIDsAEBEikKEm93bmVyX3ByaW5jaXBhbF9pZBgDIAEoCUIIukgFcgOwAQFIAIgBARIgCgd0YXNrX2lkGAQgASgJQgq6SAdyBRABGIAESAGIAQESIwoKc2Vzc2lvbl9pZBgFIAEoCUIKukgHcgUQARiABEgCiAEBQhUKE19vd25lcl9wcmluY2lwYWxfaWRCCgoIX3Rhc2tfaWRCDQoLX3Nlc3Npb25faWQilgEKIkNvbnN1bWVTaW5nbGVVc2VXb3JrQ29udGV4dFJlcXVlc3QSGAoGb3JnX2lkGAEgASgJQgi6SAVyA7ABARIeCgpjb250ZXh0X2lkGAIgASgJQgq6SAdyBRABGIAEEjYKCmV4cGlyZXNfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wQga6SAPIAQEqmwEKF1dvcmtDb250ZXh0UmVwbGF5UG9saWN5EioKJldPUktfQ09OVEVYVF9SRVBMQVlfUE9MSUNZX1VOU1BFQ0lGSUVEEAASKQolV09SS19DT05URVhUX1JFUExBWV9QT0xJQ1lfSURFTVBPVEVOVBABEikKJVdPUktfQ09OVEVYVF9SRVBMQVlfUE9MSUNZX1NJTkdMRV9VU0UQAjL7DAoSV29ya0NvbnRleHRTZXJ2aWNlEoMBChpDaGVja0F1dGhvcml6YXRpb25SZXZpc2lvbhIzLnNhYXMuYWNjb3VudHMudjEuQ2hlY2tBdXRob3JpemF0aW9uUmV2aXNpb25SZXF1ZXN0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IhjC8xgUCAMQATABOgIQAUABSAdQA1gDYAESeQoVQXV0aG9yaXplRXZpZGVuY2VSZWFkEi4uc2Fhcy5hY2NvdW50cy52MS5BdXRob3JpemVFdmlkZW5jZVJlYWRSZXF1ZXN0GhYuZ29vZ2xlLnByb3RvYnVmLkVtcHR5IhjC8xgUCAMQATABOgIQAUABSAdQA1gDYAESegoQQ29uc3VtZVNpbmdsZVVzZRI0LnNhYXMuYWNjb3VudHMudjEuQ29uc3VtZVNpbmdsZVVzZVdvcmtDb250ZXh0UmVxdWVzdBoWLmdvb2dsZS5wcm90b2J1Zi5FbXB0eSIYwvMYFAgDEAEwAToCEAFAAUgHUANYA2ABEsoBCglTdGFydFRhc2sSLS5zYWFzLmFjY291bnRzLnYxLlN0YXJ0VGFza1dvcmtDb250ZXh0UmVxdWVzdBojLnNhYXMuYWNjb3VudHMudjEuSXNzdWVkV29ya0NvbnRleHQiacLzGEQIAhADKgwKBm9yZ19pZBACGAEwAToiCh5zYWFzLndvcmtfY29udGV4dC50YXNrX3N0YXJ0ZWQQAkABSAVQA1gEYAF4AoLT5JMCGzoBKiIWL3YxL3dvcmstY29udGV4dHM6dGFzaxKGAQoVU3RhcnRJbnN0YWxsYXRpb25UYXNrEi4uc2Fhcy5hY2NvdW50cy52MS5TdGFydEluc3RhbGxhdGlvblRhc2tSZXF1ZXN0GiMuc2Fhcy5hY2NvdW50cy52MS5Jc3N1ZWRXb3JrQ29udGV4dCIYwvMYFAgDEAEwAToCEAFAAUgHUANYBGABEugBChBTdGFydFJvb3RTZXNzaW9uEjQuc2Fhcy5hY2NvdW50cy52MS5TdGFydFJvb3RTZXNzaW9uV29ya0NvbnRleHRSZXF1ZXN0GiMuc2Fhcy5hY2NvdW50cy52MS5Jc3N1ZWRXb3JrQ29udGV4dCJ5wvMYTAgCEAMqDAoGb3JnX2lkEAIYATABOioKJnNhYXMud29ya19jb250ZXh0LnJvb3Rfc2Vzc2lvbl9zdGFydGVkEAJAAUgFUARYBGABeAKC0+STAiM6ASoiHi92MS93b3JrLWNvbnRleHRzOnJvb3Qtc2Vzc2lvbhLrAQoQRXhjaGFuZ2VBdWRpZW5jZRI0LnNhYXMuYWNjb3VudHMudjEuRXhjaGFuZ2VXb3JrQ29udGV4dEF1ZGllbmNlUmVxdWVzdBojLnNhYXMuYWNjb3VudHMudjEuSXNzdWVkV29ya0NvbnRleHQifMLzGEoIAhADKgwKBm9yZ19pZBACGAEwATooCiRzYWFzLndvcmtfY29udGV4dC5hdWRpZW5jZV9leGNoYW5nZWQQAkABSAVQBFgEYAF4AoLT5JMCKDoBKiIjL3YxL3dvcmstY29udGV4dHM6ZXhjaGFuZ2UtYXVkaWVuY2US7AEKEVN0YXJ0Q2hpbGRTZXNzaW9uEjUuc2Fhcy5hY2NvdW50cy52MS5TdGFydENoaWxkU2Vzc2lvbldvcmtDb250ZXh0UmVxdWVzdBojLnNhYXMuYWNjb3VudHMudjEuSXNzdWVkV29ya0NvbnRleHQie8LzGE0IAhADKgwKBm9yZ19pZBACGAEwATorCidzYWFzLndvcmtfY29udGV4dC5jaGlsZF9zZXNzaW9uX3N0YXJ0ZWQQAkABSAVQBFgEYAF4AoLT5JMCJDoBKiIfL3YxL3dvcmstY29udGV4dHM6Y2hpbGQtc2Vzc2lvbhLJAQoQUmVuZXdXb3JrQ29udGV4dBIpLnNhYXMuYWNjb3VudHMudjEuUmVuZXdXb3JrQ29udGV4dFJlcXVlc3QaIy5zYWFzLmFjY291bnRzLnYxLklzc3VlZFdvcmtDb250ZXh0ImXC8xg/CAIQAyoMCgZvcmdfaWQQAhgBMAE6HQoZc2Fhcy53b3JrX2NvbnRleHQucmVuZXdlZBACQAFIBVAEWARgAXgCgtPkkwIcOgEqIhcvdjEvd29yay1jb250ZXh0czpyZW5ld0K5AQoUY29tLnNhYXMuYWNjb3VudHMudjFCEVdvcmtDb250ZXh0c1Byb3RvUAFaLGFjY291bnRzL3BrZy9nZW4vc2Fhcy9hY2NvdW50cy92MTthY2NvdW50c3YxogIDU0FYqgIQU2Fhcy5BY2NvdW50cy5WMcoCEFNhYXNcQWNjb3VudHNcVjHiAhxTYWFzXEFjY291bnRzXFYxXEdQQk1ldGFkYXRh6gISU2Fhczo6QWNjb3VudHM6OlYxYgZwcm90bzM", [file_buf_validate_validate, file_google_api_annotations, file_google_protobuf_empty, file_google_protobuf_timestamp, file_saas_policy_v1_options]); /** * WorkContextScope is one product-neutral authority slice. Product plugins @@ -49,6 +49,13 @@ export const WorkContextScopeSchema: GenMessage = /*@__PURE__* messageDesc(file_saas_accounts_v1_work_contexts, 0); /** + * StartTaskWorkContextRequest mints a Task capability for the caller. Its Session + * is the one the caller authenticated with — or a fresh one when it has none — + * assigned by the issuer and returned in IssuedWorkContext, never named by the + * caller: a session a caller could name is one it could name after another + * credential's, and a confined credential is paired with a capability on the + * session alone. + * * @generated from message saas.accounts.v1.StartTaskWorkContextRequest */ export type StartTaskWorkContextRequest = Message<"saas.accounts.v1.StartTaskWorkContextRequest"> & { @@ -74,11 +81,6 @@ export type StartTaskWorkContextRequest = Message<"saas.accounts.v1.StartTaskWor */ taskId: string; - /** - * @generated from field: string session_id = 3; - */ - sessionId: string; - /** * Empty means a direct human-owned Task. Otherwise this must name an active, * registered agent Principal in org_id. diff --git a/qualification/module-authority/module_read_flow_test.go b/qualification/module-authority/module_read_flow_test.go index 510958ede..7d6a3082a 100644 --- a/qualification/module-authority/module_read_flow_test.go +++ b/qualification/module-authority/module_read_flow_test.go @@ -39,11 +39,10 @@ func TestTheModuleReadThroughTheRealGatewayIsMintedByTheRealStartTask(t *testing } // 2. The mint, with the same credential, through the gateway to StartTask. - // The request names a session of its own; what is signed is the one the - // credential authenticated, which is the one the gateway pairs on. + // The request names no session: what is signed is the one the credential + // authenticated, which is the one the gateway pairs on. mint := gatewayCall(t, h, http.MethodPost, "/saas.accounts.v1.WorkContextService/StartTask", map[string]any{ "orgId": flow.Org, - "sessionId": "019f6bf7-0000-7000-8000-000000000000", "taskId": "019f6bf7-1111-7111-8111-1111111111aa", "audience": flow.Module, "ttlSeconds": 300, @@ -95,7 +94,7 @@ func TestTheModuleReadThroughTheRealGatewayIsMintedByTheRealStartTask(t *testing "outside the declared binding": {flow.Module, flow.Module, []string{"read", "write"}, "outside what the consumer this credential was delivered to declares"}, } { refused := gatewayCall(t, h, http.MethodPost, "/saas.accounts.v1.WorkContextService/StartTask", map[string]any{ - "orgId": flow.Org, "sessionId": "019f6bf7-0000-7000-8000-000000000000", + "orgId": flow.Org, "taskId": "019f6bf7-1111-7111-8111-1111111111ab", "audience": ask.audience, "ttlSeconds": 300, "authorityScopes": []map[string]any{{"resourceKind": ask.kind, "actions": ask.actions}}, }, nil) From e409975c69b58029d924ee0e4862e24ffbddc0cd Mon Sep 17 00:00:00 2001 From: Codefly Automation <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Mon, 12 Oct 2026 20:56:46 -0400 Subject: [PATCH 2/3] build(accounts): pin core main's merge commit of core#788; document the read-back MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit accounts pins github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542, core main's merge commit of codefly-dev/core#788 (Authority.ReadBack), until core v0.19.3 is released; then all five host services move to that tag. The other services stay on released v0.19.2 meanwhile. accounts/AGENTS.md gains "Reading back a capability this host issued": which paths read back and which verify and consume, and that a read-back trusts only the authority's CURRENT key id — during a Work Context key rotation, a capability signed under the previous key is refused by every read-back (fail closed) while a consumer whose JWKS still lists that key accepts it, until its holder mints a new one. KEY_ROTATION.md and WORK_CONTEXTS.md say the same. module/AGENTS.md states each module's core pin instead of "v0.18.0 everywhere". Co-Authored-By: Claude Opus 5.5 (1M context) --- module/AGENTS.md | 11 ++++++++--- module/KEY_ROTATION.md | 9 +++++++++ module/WORK_CONTEXTS.md | 5 ++++- module/services/accounts/AGENTS.md | 23 +++++++++++++++++++++++ module/services/accounts/code/go.mod | 2 +- module/services/accounts/code/go.sum | 4 ++-- 6 files changed, 47 insertions(+), 7 deletions(-) diff --git a/module/AGENTS.md b/module/AGENTS.md index b5abbc2ee..ae7707949 100644 --- a/module/AGENTS.md +++ b/module/AGENTS.md @@ -82,9 +82,14 @@ each invocation fresh database state. Do not opt into `WithSharedControlChannel` which is only for older CLIs and reuses fixed local database directories across otherwise independent runs and migration revisions. -Core dependencies are pinned to released v0.18.0 in every owning Go module, -including the module-authority qualification module. Run qualification with -`GOWORK=off` so a developer workspace cannot mask the released dependency. +Core is pinned per Go module. The host's services run core v0.19.x: +auth-gateway, policy-log, store and telemetry pin released v0.19.2, and accounts +pins core main's merge commit of codefly-dev/core#788 (the issuer-side +`Authority.ReadBack`) by pseudo-version until v0.19.3 is released, when all five +move to that tag. The module agent (the root module), `module/tools` and the +module-authority qualification module stay on released v0.18.0. Never ship a +host release on an untagged pseudo-version. Run qualification with `GOWORK=off` +so a developer workspace cannot mask the pinned dependency. Accounts requires Go 1.27.2. All go-grpc services pin released agent 0.1.54, whose builder uses Go 1.27.2 under `GOTOOLCHAIN=local`; CI uses the same patch. Go 1.27.0 is affected by [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613). diff --git a/module/KEY_ROTATION.md b/module/KEY_ROTATION.md index c7adf526e..e4647a200 100644 --- a/module/KEY_ROTATION.md +++ b/module/KEY_ROTATION.md @@ -374,6 +374,15 @@ The Work Context path deliberately does not take the grace: a presented capability is an optional attenuation the caller can retry, so it fails closed the moment its key set expires. +Accounts' own read-backs are narrower still. A capability presented with a +question (`CheckWorkContextRecordAccess`, `ListReadableSourceCollections`, the +module-parent reads) is read back through core's `Authority.ReadBack`, which +trusts only the authority's CURRENT key id. From the moment the Work Context key +rotates, a capability signed under the previous key is refused by those +read-backs — while a consumer whose JWKS still lists the old key accepts it — +until its holder mints a new one; the capability's own lifetime +bounds the window. See `services/accounts/AGENTS.md`. + ## Observability Two counters, both with a fixed label set and no credential-derived values: diff --git a/module/WORK_CONTEXTS.md b/module/WORK_CONTEXTS.md index 91f7dff0e..914fda185 100644 --- a/module/WORK_CONTEXTS.md +++ b/module/WORK_CONTEXTS.md @@ -306,7 +306,10 @@ or artifacts — is read back instead (core's `Authority.ReadBack`): every check verifier makes, against live state, but the replay store is never touched. A question is not a use, so the consumer that verified and consumed a single-use capability can still ask about it, on every page of a listing, and asking leaves -an unconsumed one for its consumer. +an unconsumed one for its consumer. A read-back trusts only the issuer's CURRENT +signing key: during a key rotation, a capability signed under the previous key +is refused by every read-back (fail closed) even while a consumer still accepts +it, until its holder mints a new one. ## The reserved module audience diff --git a/module/services/accounts/AGENTS.md b/module/services/accounts/AGENTS.md index 34be5b15a..3cc90ba2d 100644 --- a/module/services/accounts/AGENTS.md +++ b/module/services/accounts/AGENTS.md @@ -405,6 +405,29 @@ with: the `Mint*` exchanges' refusals carry theirs under [Source delegations](#source-delegations-a-sync-runs-with-the-connecting-persons-authority)), so matching on a bare reason across the whole service is wrong. +## Reading back a capability this host issued + +A capability presented with a QUESTION is read back, never verified: +`CheckWorkContextRecordAccess`, `ListReadableSourceCollections` and the +module-parent reads (`GetCurrentInstallation`, the executable-artifact reads) go +through `WorkContextAuthorityServer.readBack`, which is core's +`Authority.ReadBack`. It makes every check a verifier makes against live state — +signature, issuer, audience, window, revision, seal, epochs, binding — and never +touches the replay store, so the consumer that verified and consumed a +single-use capability can still ask about it, on every page of a listing. A path +that ACTS on a capability or derives from it (an exchange, a renewal, a child) +verifies and consumes with `verifyIssued`; do not move one onto `readBack`, and +do not answer a question through `verifyIssued`. + +**A read-back trusts only the current signing key.** `Authority.ReadBack` checks +the signature under the authority's own key id and nothing else, where a +verifier holds a key map that can also carry a previous key. So during a key +rotation, a capability signed under the PREVIOUS key is refused by every +read-back — fail closed, as an invalid capability — while a consumer whose JWKS +still lists that key accepts it. The capability's lifetime bounds the window: +its holder mints a new one under the current key. Rotating the Work Context key +therefore briefly refuses questions about capabilities already in flight. + ## Minting a module Work Context The identity itself is a **Work Context**. The auth-gateway brokers the exchange diff --git a/module/services/accounts/code/go.mod b/module/services/accounts/code/go.mod index f3dccd2c1..37bdabbe4 100644 --- a/module/services/accounts/code/go.mod +++ b/module/services/accounts/code/go.mod @@ -8,7 +8,7 @@ require ( connectrpc.com/connect v1.21.0 connectrpc.com/otelconnect v0.9.0 github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc - github.com/codefly-dev/core v0.19.2 + github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542 github.com/codefly-dev/interface-cache/go/cache v0.2.2-0.20260926205419-327a6e1d9aba github.com/codefly-dev/sdk-go v0.4.0 github.com/codefly-dev/sdk-go/workcontext v0.1.0 diff --git a/module/services/accounts/code/go.sum b/module/services/accounts/code/go.sum index bb62324d2..76438ef31 100644 --- a/module/services/accounts/code/go.sum +++ b/module/services/accounts/code/go.sum @@ -60,8 +60,8 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc h1:olDnVJ1A1Retn0z9A59YMwDRmDLgkV2y1lbl+HzNrj8= github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc/go.mod h1:VWPYY3FH4te7SzdN2xl9odNpWidJ1Grl/Hjs1SNoEF8= -github.com/codefly-dev/core v0.19.2 h1:eoto82yKQPxLvtn5ie0hk7MYtTGTvikjkQjcaUuQtso= -github.com/codefly-dev/core v0.19.2/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= +github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542 h1:GnCDKLm7mBfRT2nPRJXGIG+ai6P350NbjqNkFNN7GyM= +github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/interface-cache/go/cache v0.2.2-0.20260926205419-327a6e1d9aba h1:6nFaDYsLyA5x3WiGAk6pMI3c0naqxiPeaTHMqRPvbVs= From 1a28fb694bec55741b350b9615b58aed85b4d3b6 Mon Sep 17 00:00:00 2001 From: Codefly Automation <312536060+antoinetoussaint-byte@users.noreply.github.com> Date: Mon, 12 Oct 2026 21:16:29 -0400 Subject: [PATCH 3/3] build(deps): every host service on core v0.19.3 core v0.19.3 (500a143c, on core main) is the merge commit of codefly-dev/core#788 plus its release commit; nothing in workcontext changed between them. accounts moves off the pseudo-version it was pinned to while the tag was pending, and auth-gateway, policy-log, store and telemetry move from v0.19.2, so the host runs one core release. No other dependency moved. module/AGENTS.md says so. Co-Authored-By: Claude Opus 5.5 (1M context) --- module/AGENTS.md | 15 +++++++-------- module/services/accounts/code/go.mod | 2 +- module/services/accounts/code/go.sum | 4 ++-- module/services/auth-gateway/code/go.mod | 2 +- module/services/auth-gateway/code/go.sum | 4 ++-- module/services/policy-log/code/go.mod | 2 +- module/services/policy-log/code/go.sum | 4 ++-- module/services/store/code/go.mod | 2 +- module/services/store/code/go.sum | 4 ++-- module/services/telemetry/code/go.mod | 2 +- module/services/telemetry/code/go.sum | 4 ++-- 11 files changed, 22 insertions(+), 23 deletions(-) diff --git a/module/AGENTS.md b/module/AGENTS.md index ae7707949..5593f2527 100644 --- a/module/AGENTS.md +++ b/module/AGENTS.md @@ -82,14 +82,13 @@ each invocation fresh database state. Do not opt into `WithSharedControlChannel` which is only for older CLIs and reuses fixed local database directories across otherwise independent runs and migration revisions. -Core is pinned per Go module. The host's services run core v0.19.x: -auth-gateway, policy-log, store and telemetry pin released v0.19.2, and accounts -pins core main's merge commit of codefly-dev/core#788 (the issuer-side -`Authority.ReadBack`) by pseudo-version until v0.19.3 is released, when all five -move to that tag. The module agent (the root module), `module/tools` and the -module-authority qualification module stay on released v0.18.0. Never ship a -host release on an untagged pseudo-version. Run qualification with `GOWORK=off` -so a developer workspace cannot mask the pinned dependency. +Core is pinned per Go module. The host's five services (accounts, auth-gateway, +policy-log, store, telemetry) run one core release, v0.19.3, which carries the +issuer-side `Authority.ReadBack`. The module agent (the root module), +`module/tools` and the module-authority qualification module stay on released +v0.18.0. Never ship a host release on an untagged pseudo-version. Run +qualification with `GOWORK=off` so a developer workspace cannot mask the pinned +dependency. Accounts requires Go 1.27.2. All go-grpc services pin released agent 0.1.54, whose builder uses Go 1.27.2 under `GOTOOLCHAIN=local`; CI uses the same patch. Go 1.27.0 is affected by [GO-2026-6613](https://pkg.go.dev/vuln/GO-2026-6613). diff --git a/module/services/accounts/code/go.mod b/module/services/accounts/code/go.mod index 37bdabbe4..3b26d40b8 100644 --- a/module/services/accounts/code/go.mod +++ b/module/services/accounts/code/go.mod @@ -8,7 +8,7 @@ require ( connectrpc.com/connect v1.21.0 connectrpc.com/otelconnect v0.9.0 github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc - github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542 + github.com/codefly-dev/core v0.19.3 github.com/codefly-dev/interface-cache/go/cache v0.2.2-0.20260926205419-327a6e1d9aba github.com/codefly-dev/sdk-go v0.4.0 github.com/codefly-dev/sdk-go/workcontext v0.1.0 diff --git a/module/services/accounts/code/go.sum b/module/services/accounts/code/go.sum index 76438ef31..f1d2bc8f7 100644 --- a/module/services/accounts/code/go.sum +++ b/module/services/accounts/code/go.sum @@ -60,8 +60,8 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc h1:olDnVJ1A1Retn0z9A59YMwDRmDLgkV2y1lbl+HzNrj8= github.com/codefly-dev/cli/contracts/deployment v0.0.0-20261006151622-5824cf5342fc/go.mod h1:VWPYY3FH4te7SzdN2xl9odNpWidJ1Grl/Hjs1SNoEF8= -github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542 h1:GnCDKLm7mBfRT2nPRJXGIG+ai6P350NbjqNkFNN7GyM= -github.com/codefly-dev/core v0.19.3-0.20261013003915-936785420542/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= +github.com/codefly-dev/core v0.19.3 h1:nWCK+wBtwYO91oyZ4G+jNgoVGcgVCr73wz2taLLiFgM= +github.com/codefly-dev/core v0.19.3/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/interface-cache/go/cache v0.2.2-0.20260926205419-327a6e1d9aba h1:6nFaDYsLyA5x3WiGAk6pMI3c0naqxiPeaTHMqRPvbVs= diff --git a/module/services/auth-gateway/code/go.mod b/module/services/auth-gateway/code/go.mod index 87245d0c6..44b056be7 100644 --- a/module/services/auth-gateway/code/go.mod +++ b/module/services/auth-gateway/code/go.mod @@ -4,7 +4,7 @@ go 1.27.0 require ( buf.build/gen/go/bufbuild/protovalidate/protocolbuffers/go v1.36.12-20260825204119-511051f7f437.2 - github.com/codefly-dev/core v0.19.2 + github.com/codefly-dev/core v0.19.3 github.com/codefly-dev/sdk-go v0.4.0 github.com/codefly-dev/sdk-go/workcontext v0.1.0 github.com/envoyproxy/go-control-plane/envoy v1.39.0 diff --git a/module/services/auth-gateway/code/go.sum b/module/services/auth-gateway/code/go.sum index 6d5c0797a..6fc6eeb1a 100644 --- a/module/services/auth-gateway/code/go.sum +++ b/module/services/auth-gateway/code/go.sum @@ -44,8 +44,8 @@ github.com/cloudflare/circl v1.6.3 h1:9GPOhQGF9MCYUeXyMYlqTR6a5gTrgR/fBLXvUgtVcg github.com/cloudflare/circl v1.6.3/go.mod h1:2eXP6Qfat4O/Yhh8BznvKnJ+uzEoTQ6jVKJRn81BiS4= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= -github.com/codefly-dev/core v0.19.2 h1:eoto82yKQPxLvtn5ie0hk7MYtTGTvikjkQjcaUuQtso= -github.com/codefly-dev/core v0.19.2/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= +github.com/codefly-dev/core v0.19.3 h1:nWCK+wBtwYO91oyZ4G+jNgoVGcgVCr73wz2taLLiFgM= +github.com/codefly-dev/core v0.19.3/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/sdk-go v0.4.0 h1:3Jm0bP+UsLI4iZYp3wqVa42bcXBumMIIF/aeweKOAhY= diff --git a/module/services/policy-log/code/go.mod b/module/services/policy-log/code/go.mod index 933078ac3..3d616a56a 100644 --- a/module/services/policy-log/code/go.mod +++ b/module/services/policy-log/code/go.mod @@ -31,7 +31,7 @@ require ( github.com/antlr4-go/antlr/v4 v4.13.1 // indirect github.com/cespare/xxhash/v2 v2.3.0 // indirect github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 // indirect - github.com/codefly-dev/core v0.19.2 // indirect + github.com/codefly-dev/core v0.19.3 // indirect github.com/envoyproxy/go-control-plane/envoy v1.37.0 // indirect github.com/envoyproxy/protoc-gen-validate v1.3.3 // indirect github.com/felixge/httpsnoop v1.1.0 // indirect diff --git a/module/services/policy-log/code/go.sum b/module/services/policy-log/code/go.sum index 8e77fcad5..2661f1bc2 100644 --- a/module/services/policy-log/code/go.sum +++ b/module/services/policy-log/code/go.sum @@ -58,8 +58,8 @@ github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJ github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik= github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4= -github.com/codefly-dev/core v0.19.2 h1:eoto82yKQPxLvtn5ie0hk7MYtTGTvikjkQjcaUuQtso= -github.com/codefly-dev/core v0.19.2/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= +github.com/codefly-dev/core v0.19.3 h1:nWCK+wBtwYO91oyZ4G+jNgoVGcgVCr73wz2taLLiFgM= +github.com/codefly-dev/core v0.19.3/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/sdk-go v0.4.0 h1:3Jm0bP+UsLI4iZYp3wqVa42bcXBumMIIF/aeweKOAhY= diff --git a/module/services/store/code/go.mod b/module/services/store/code/go.mod index 99a470226..19fcd29c1 100644 --- a/module/services/store/code/go.mod +++ b/module/services/store/code/go.mod @@ -16,7 +16,7 @@ require ( github.com/Masterminds/semver v1.5.0 // indirect github.com/Masterminds/semver/v3 v3.5.0 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect - github.com/codefly-dev/core v0.19.2 // indirect + github.com/codefly-dev/core v0.19.3 // indirect github.com/go-openapi/analysis v1.0.0 // indirect github.com/go-openapi/errors v0.22.9 // indirect github.com/go-openapi/jsonpointer v1.0.1 // indirect diff --git a/module/services/store/code/go.sum b/module/services/store/code/go.sum index 3de832dd7..a462d9c1a 100644 --- a/module/services/store/code/go.sum +++ b/module/services/store/code/go.sum @@ -30,8 +30,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I= github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= -github.com/codefly-dev/core v0.19.2 h1:eoto82yKQPxLvtn5ie0hk7MYtTGTvikjkQjcaUuQtso= -github.com/codefly-dev/core v0.19.2/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= +github.com/codefly-dev/core v0.19.3 h1:nWCK+wBtwYO91oyZ4G+jNgoVGcgVCr73wz2taLLiFgM= +github.com/codefly-dev/core v0.19.3/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/sdk-go v0.4.0 h1:3Jm0bP+UsLI4iZYp3wqVa42bcXBumMIIF/aeweKOAhY= diff --git a/module/services/telemetry/code/go.mod b/module/services/telemetry/code/go.mod index d07625205..116b07795 100644 --- a/module/services/telemetry/code/go.mod +++ b/module/services/telemetry/code/go.mod @@ -18,7 +18,7 @@ require ( github.com/Masterminds/semver v1.5.0 // indirect github.com/Masterminds/semver/v3 v3.5.0 // indirect github.com/antlr4-go/antlr/v4 v4.13.1 // indirect - github.com/codefly-dev/core v0.19.2 // indirect + github.com/codefly-dev/core v0.19.3 // indirect github.com/go-openapi/analysis v1.0.0 // indirect github.com/go-openapi/errors v0.22.9 // indirect github.com/go-openapi/jsonpointer v1.0.1 // indirect diff --git a/module/services/telemetry/code/go.sum b/module/services/telemetry/code/go.sum index e36cb360b..e6b4f3ca9 100644 --- a/module/services/telemetry/code/go.sum +++ b/module/services/telemetry/code/go.sum @@ -28,8 +28,8 @@ github.com/cheggaaa/pb/v3 v3.2.1 h1:aprZbFRG+B7+ug76S8QZ6Y1PW168UHzOmbC3wa+aU6I= github.com/cheggaaa/pb/v3 v3.2.1/go.mod h1:U9hSVxoKqJrZIE3PkFG1xXXNaK/Ilzg+EF/scpXzEdw= github.com/clipperhouse/uax29/v2 v2.7.0 h1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk= github.com/clipperhouse/uax29/v2 v2.7.0/go.mod h1:EFJ2TJMRUaplDxHKj1qAEhCtQPW2tJSwu5BF98AuoVM= -github.com/codefly-dev/core v0.19.2 h1:eoto82yKQPxLvtn5ie0hk7MYtTGTvikjkQjcaUuQtso= -github.com/codefly-dev/core v0.19.2/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= +github.com/codefly-dev/core v0.19.3 h1:nWCK+wBtwYO91oyZ4G+jNgoVGcgVCr73wz2taLLiFgM= +github.com/codefly-dev/core v0.19.3/go.mod h1:4ovwm7kaHFtY9+TT8yfjA4D/BiAhIFZez7lcil8muVo= github.com/codefly-dev/gortk v0.2.0 h1:7bOlS5valYz2zil+fZctQNcPCYBcPj86abcw9N8h1hQ= github.com/codefly-dev/gortk v0.2.0/go.mod h1:dDWUMFgAP063OCGhTEpV7FFUj9+zTcxxO/nV80VKEwg= github.com/codefly-dev/sdk-go v0.4.0 h1:3Jm0bP+UsLI4iZYp3wqVa42bcXBumMIIF/aeweKOAhY=