@foss.global/forgefixtures 0.2.0

package/dist_ts/classes.containerlifecycle.js

@@ -0,0 +1,383 @@
+import * as plugins from './plugins.js';
+import { defaultMaxLifetimeMs, defaultPullTimeoutMs } from './constants.js';
+import { ForgeFixtureCertificateAuthority } from './classes.certificateauthority.js';
+import { ForgeFixtureHttpClient } from './classes.httpclient.js';
+import { createForgeFixtureDockerHost, reapStaleForgeFixtures } from './classes.reaper.js';
+import { ForgeFixtureTlsTerminator } from './classes.tlsterminator.js';
+import { createForgeFixtureOwner, forgeFixtureOwnerLabels } from './ownership.js';
+const maxPortAttempts = 5;
+/** Asks the kernel for a currently free loopback port. The caller must tolerate losing a race for it. */
+const reserveLoopbackPort = async () => {
+    const server = plugins.net.createServer();
+    await new Promise((resolveArg, rejectArg) => {
+        server.once('error', rejectArg);
+        server.listen({ host: '127.0.0.1', port: 0, exclusive: true }, () => resolveArg());
+    });
+    const address = server.address();
+    await new Promise((resolveArg) => server.close(() => resolveArg()));
+    if (address === null || typeof address === 'string')
+        throw new Error('The loopback port probe has no TCP address.');
+    return address.port;
+};
+const isPortConflict = (errorArg) => errorArg instanceof Error && /address already in use|port is already allocated/.test(errorArg.message);
+/** Raised by lifecycle steps that observe a stop request. */
+export class ForgeFixtureStoppedError extends Error {
+    constructor(kindArg, optionsArg) {
+        super(`The ${kindArg} fixture was stopped.`, optionsArg);
+        this.name = 'ForgeFixtureStoppedError';
+    }
+}
+/**
+ * Owns one fixture's Docker resources, local CA, TLS terminator and scoped
+ * HTTPS client. Every resource carries ownership labels, so resources left by a
+ * crashed process are removed by the next lifecycle's reaper run.
+ */
+export class ForgeFixtureContainerLifecycle {
+    #kind;
+    #options;
+    #state = 'idle';
+    #dockerHost;
+    #owner;
+    #terminator;
+    #http;
+    #endpoint;
+    #container;
+    #network;
+    #volumes = [];
+    #lastReapReport;
+    #stopController = new AbortController();
+    /** The prepare or container start currently running; `stop()` waits for it before cleaning up. */
+    #inflight;
+    /** Serialises cleanup runs so concurrent stops never remove the same resource twice. */
+    #cleanupQueue = Promise.resolve();
+    constructor(kindArg, optionsArg, startupTimeoutMsArg) {
+        this.#kind = kindArg;
+        this.#options = {
+            ...(optionsArg.dockerSocketPath === undefined ? {} : { dockerSocketPath: optionsArg.dockerSocketPath }),
+            maxLifetimeMs: optionsArg.maxLifetimeMs ?? defaultMaxLifetimeMs,
+            pullTimeoutMs: optionsArg.pullTimeoutMs ?? defaultPullTimeoutMs,
+            startupTimeoutMs: optionsArg.startupTimeoutMs ?? startupTimeoutMsArg,
+        };
+        for (const [name, value] of Object.entries(this.#options)) {
+            if (name !== 'dockerSocketPath' && (!Number.isSafeInteger(value) || value < 1)) {
+                throw new TypeError(`${name} must be a positive integer.`);
+            }
+        }
+    }
+    get state() {
+        return this.#state;
+    }
+    get startupTimeoutMs() {
+        return this.#options.startupTimeoutMs;
+    }
+    get lifecycleId() {
+        return this.#require(this.#owner, 'lifecycle owner').lifecycleId;
+    }
+    get endpoint() {
+        return this.#require(this.#endpoint, 'endpoint');
+    }
+    get http() {
+        return this.#require(this.#http, 'HTTPS client');
+    }
+    get dockerHost() {
+        return this.#require(this.#dockerHost, 'Docker host');
+    }
+    /** Aborted once `stop()` or `requestStop()` was called. */
+    get stopSignal() {
+        return this.#stopController.signal;
+    }
+    /** Throws {@link ForgeFixtureStoppedError} once a stop was requested. */
+    assertNotStopping() {
+        if (this.#stopController.signal.aborted)
+            throw new ForgeFixtureStoppedError(this.#kind);
+    }
+    /**
+     * Once a stop was requested, any failure it provoked (an aborted pull, a
+     * refused request) is reported as {@link ForgeFixtureStoppedError} with the
+     * original failure as its cause.
+     */
+    stopAwareError(errorArg) {
+        if (!this.#stopController.signal.aborted || errorArg instanceof ForgeFixtureStoppedError)
+            return errorArg;
+        return new ForgeFixtureStoppedError(this.#kind, { cause: errorArg });
+    }
+    /**
+     * Marks the lifecycle as stopping without waiting. Running steps observe it
+     * at their next checkpoint, an image pull is cancelled, and the lifecycle can
+     * no longer be prepared or started.
+     */
+    requestStop() {
+        if (!this.#stopController.signal.aborted)
+            this.#stopController.abort(new ForgeFixtureStoppedError(this.#kind));
+    }
+    /** Report of the reaper run that preceded this lifecycle. */
+    get lastReapReport() {
+        return this.#lastReapReport;
+    }
+    /**
+     * Reaps stale fixtures, creates ownership, CA and TLS terminator. The
+     * returned endpoint is final: its port is bound before the forge starts.
+     */
+    async prepare() {
+        this.assertNotStopping();
+        if (this.#state !== 'idle')
+            throw new Error(`Cannot prepare a ${this.#state} lifecycle.`);
+        this.#state = 'preparing';
+        return this.#track(this.#prepare());
+    }
+    async #prepare() {
+        try {
+            this.#dockerHost = createForgeFixtureDockerHost(this.#options.dockerSocketPath);
+            this.#lastReapReport = await reapStaleForgeFixtures(this.#dockerHost);
+            this.assertNotStopping();
+            this.#owner = await createForgeFixtureOwner(this.#kind, this.#options.maxLifetimeMs);
+            const authority = await ForgeFixtureCertificateAuthority.create(this.#owner.lifecycleId, this.#options.maxLifetimeMs + 24 * 60 * 60 * 1000);
+            const certificate = await authority.issueServerCertificate({ ipAddresses: ['127.0.0.1'], dnsNames: ['localhost'] });
+            this.assertNotStopping();
+            this.#terminator = new ForgeFixtureTlsTerminator(certificate);
+            const port = await this.#terminator.listen();
+            this.assertNotStopping();
+            this.#endpoint = { baseUrl: `https://127.0.0.1:${port}`, caCertificatePem: authority.certificatePem };
+            this.#http = new ForgeFixtureHttpClient({ baseUrl: this.#endpoint.baseUrl, caCertificatePem: authority.certificatePem });
+            this.#state = 'prepared';
+            return this.#endpoint;
+        }
+        catch (error) {
+            const reported = this.stopAwareError(error);
+            await this.#failAndCleanup(reported);
+            throw reported;
+        }
+    }
+    /** Pulls the pinned image, creates the owned network and container, starts it and wires the terminator. */
+    async startContainer(specArg) {
+        this.assertNotStopping();
+        if (this.#state !== 'prepared')
+            throw new Error(`Cannot start a container in a ${this.#state} lifecycle.`);
+        this.#state = 'starting';
+        return this.#track(this.#startContainer(specArg));
+    }
+    async #startContainer(specArg) {
+        const dockerHost = this.dockerHost;
+        const owner = this.#require(this.#owner, 'lifecycle owner');
+        const labels = forgeFixtureOwnerLabels(owner);
+        const name = `forgefixtures-${owner.kind}-${owner.lifecycleId}`;
+        try {
+            const image = await dockerHost.pullImage({
+                reference: specArg.image.repoDigest,
+                expectedRepoDigest: specArg.image.repoDigest,
+                signal: AbortSignal.any([AbortSignal.timeout(this.#options.pullTimeoutMs), this.#stopController.signal]),
+            });
+            this.assertNotStopping();
+            this.#network = await dockerHost.createNetwork({ Name: name, Driver: 'bridge', Labels: labels });
+            this.assertNotStopping();
+            for (const volume of specArg.volumes ?? []) {
+                if (!/^[a-z][a-z0-9-]{0,30}$/.test(volume.purpose))
+                    throw new TypeError(`Volume purpose "${volume.purpose}" is malformed.`);
+                this.#volumes.push(await dockerHost.createVolume({ name: `${name}-${volume.purpose}`, labels }));
+                this.assertNotStopping();
+            }
+            // The host port is chosen here rather than by Docker: a rootless daemon allocates
+            // "ephemeral" ports inside its own namespace, blind to host listeners, and then
+            // fails to bind them on the host. A conflict recreates the container on a new port.
+            for (let attempt = 1;; attempt++) {
+                const hostPort = await reserveLoopbackPort();
+                this.#container = await dockerHost.createContainer({
+                    name,
+                    imageId: image.Id,
+                    imageReference: specArg.image.repoDigest,
+                    user: specArg.user,
+                    ...(specArg.allowRootOnRootless ? { allowRootOnRootless: true } : {}),
+                    command: specArg.command,
+                    env: specArg.env,
+                    labels,
+                    stopTimeout: specArg.stopTimeoutSeconds,
+                    memoryBytes: specArg.memoryBytes,
+                    memorySwapBytes: specArg.memoryBytes,
+                    nanoCpus: specArg.nanoCpus,
+                    pidsLimit: specArg.pidsLimit,
+                    ...(specArg.shmSizeBytes === undefined ? {} : { shmSize: specArg.shmSizeBytes }),
+                    ...(specArg.tmpfsMounts === undefined ? {} : { tmpfsMounts: specArg.tmpfsMounts }),
+                    ...(specArg.healthcheck === undefined ? {} : { healthcheck: specArg.healthcheck }),
+                    namedVolumeMounts: (specArg.volumes ?? []).map((volumeArg, indexArg) => ({
+                        source: this.#volumes[indexArg].Name, target: volumeArg.target,
+                    })),
+                    networkEndpoints: [{ networkId: this.#network.Id }],
+                    portBindings: [{ containerPort: specArg.httpPort, hostPort, hostIp: '127.0.0.1', protocol: 'tcp' }],
+                });
+                this.assertNotStopping();
+                try {
+                    await this.#container.start();
+                    break;
+                }
+                catch (error) {
+                    if (attempt >= maxPortAttempts || !isPortConflict(error))
+                        throw error;
+                    await this.#container.remove({ force: true, removeAnonymousVolumes: true });
+                    this.#container = undefined;
+                }
+            }
+            this.assertNotStopping();
+            const publishedPort = await this.#publishedPort(this.#container, specArg.httpPort);
+            this.assertNotStopping();
+            this.#require(this.#terminator, 'TLS terminator').setUpstreamPort(publishedPort);
+            this.#state = 'running';
+        }
+        catch (error) {
+            const reported = this.stopAwareError(error);
+            await this.#failAndCleanup(reported);
+            throw reported;
+        }
+    }
+    /** Runs argv in the container as its configured user. Never logs stdin or output. */
+    async exec(commandArg, optionsArg = {}) {
+        if (this.#state !== 'running')
+            throw new Error(`Cannot exec in a ${this.#state} lifecycle.`);
+        return this.#require(this.#container, 'container').exec(commandArg, optionsArg);
+    }
+    /** Fails with the container's exit state and recent logs when it stopped running. */
+    async assertContainerRunning() {
+        const container = this.#require(this.#container, 'container');
+        const state = await container.inspectState();
+        if (state.Running)
+            return;
+        const logs = await container.logs({ tail: 40 });
+        throw new Error(`The ${this.#kind} fixture container is ${state.Status} (exit ${state.ExitCode}, OOM ${state.OOMKilled}). Last logs:\n${logs}`);
+    }
+    /** Docker's view of the container healthcheck (`none` without a healthcheck). */
+    async containerHealth() {
+        const inspection = await this.#require(this.#container, 'container').inspect();
+        const state = inspection.State;
+        const health = typeof state === 'object' && state !== null ? Reflect.get(state, 'Health') : undefined;
+        if (health === undefined || health === null)
+            return 'none';
+        const status = typeof health === 'object' ? Reflect.get(health, 'Status') : undefined;
+        if (status === 'starting' || status === 'healthy' || status === 'unhealthy')
+            return status;
+        throw new Error('Docker reported a malformed container health status.');
+    }
+    /** Recent container logs, for diagnostics after a failed readiness wait. */
+    async logsTail(linesArg) {
+        return this.#require(this.#container, 'container').logs({ tail: linesArg });
+    }
+    /**
+     * Requests a stop, waits for a running prepare or container start to observe
+     * it, then removes every owned resource in dependency order, including those
+     * that step created. Idempotent. When a removal fails, the remaining
+     * resources stay recorded and a later call retries them; the failures are
+     * thrown together.
+     */
+    async stop() {
+        this.requestStop();
+        const inflight = this.#inflight;
+        if (inflight)
+            await inflight.catch(() => undefined);
+        await this.#cleanup();
+    }
+    async #track(operationArg) {
+        this.#inflight = operationArg;
+        try {
+            return await operationArg;
+        }
+        finally {
+            if (this.#inflight === operationArg)
+                this.#inflight = undefined;
+        }
+    }
+    #cleanup() {
+        const run = this.#cleanupQueue.catch(() => undefined).then(() => this.#removeResources());
+        this.#cleanupQueue = run;
+        return run;
+    }
+    async #removeResources() {
+        if (!this.#hasResources()) {
+            this.#http = undefined;
+            this.#endpoint = undefined;
+            this.#state = 'stopped';
+            return;
+        }
+        this.#state = 'stopping';
+        const failures = [];
+        const attempt = async (operationArg) => {
+            try {
+                await operationArg();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+        };
+        this.#http?.close();
+        this.#http = undefined;
+        await attempt(async () => {
+            await this.#terminator?.close();
+            this.#terminator = undefined;
+        });
+        await attempt(async () => {
+            await this.#container?.remove({ force: true, removeAnonymousVolumes: true });
+            this.#container = undefined;
+        });
+        await attempt(async () => {
+            if (this.#container)
+                return;
+            await this.#network?.remove();
+            this.#network = undefined;
+        });
+        while (this.#volumes.length > 0 && !this.#container) {
+            const volume = this.#volumes[0];
+            try {
+                await volume.remove({ force: true });
+                this.#volumes.shift();
+            }
+            catch (error) {
+                failures.push(error);
+                break;
+            }
+        }
+        if (!this.#hasResources()) {
+            await attempt(async () => {
+                await this.#dockerHost?.stop();
+                this.#dockerHost = undefined;
+            });
+        }
+        this.#endpoint = undefined;
+        this.#state = this.#hasResources() ? 'stopping' : 'stopped';
+        if (failures.length > 0) {
+            throw new AggregateError(failures, `The ${this.#kind} fixture ${this.#owner?.lifecycleId ?? ''} did not clean up completely.`);
+        }
+    }
+    #hasResources() {
+        return this.#terminator !== undefined || this.#container !== undefined
+            || this.#network !== undefined || this.#volumes.length > 0 || this.#dockerHost !== undefined;
+    }
+    async #failAndCleanup(errorArg) {
+        try {
+            await this.#cleanup();
+        }
+        catch (cleanupError) {
+            throw new AggregateError([errorArg, cleanupError], `The ${this.#kind} fixture failed to start and to clean up.`);
+        }
+    }
+    async #publishedPort(containerArg, containerPortArg) {
+        const inspection = await containerArg.inspect();
+        const settings = inspection.NetworkSettings;
+        const ports = typeof settings === 'object' && settings !== null ? Reflect.get(settings, 'Ports') : undefined;
+        const bindings = typeof ports === 'object' && ports !== null ? Reflect.get(ports, `${containerPortArg}/tcp`) : undefined;
+        if (Array.isArray(bindings)) {
+            for (const binding of bindings) {
+                if (typeof binding !== 'object' || binding === null)
+                    continue;
+                const hostIp = Reflect.get(binding, 'HostIp');
+                const hostPort = Reflect.get(binding, 'HostPort');
+                if (hostIp === '127.0.0.1' && typeof hostPort === 'string' && /^[0-9]{1,5}$/.test(hostPort)) {
+                    return Number(hostPort);
+                }
+            }
+        }
+        throw new Error(`Docker did not publish container port ${containerPortArg} on 127.0.0.1.`);
+    }
+    #require(valueArg, nameArg) {
+        if (valueArg === undefined)
+            throw new Error(`The ${this.#kind} fixture has no ${nameArg} in state ${this.#state}.`);
+        return valueArg;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5jb250YWluZXJsaWZlY3ljbGUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmNvbnRhaW5lcmxpZmVjeWNsZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUM1RSxPQUFPLEVBQUUsZ0NBQWdDLEVBQUUsTUFBTSxtQ0FBbUMsQ0FBQztBQUNyRixPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNqRSxPQUFPLEVBQUUsNEJBQTRCLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSxxQkFBcUIsQ0FBQztBQUMzRixPQUFPLEVBQUUseUJBQXlCLEVBQUUsTUFBTSw0QkFBNEIsQ0FBQztBQUN2RSxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQW1DbEYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxDQUFDO0FBRTFCLHlHQUF5RztBQUN6RyxNQUFNLG1CQUFtQixHQUFHLEtBQUssSUFBcUIsRUFBRTtJQUN0RCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsR0FBRyxDQUFDLFlBQVksRUFBRSxDQUFDO0lBQzFDLE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxVQUFVLEVBQUUsU0FBUyxFQUFFLEVBQUU7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsSUFBSSxFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsSUFBSSxFQUFFLEVBQUUsR0FBRyxFQUFFLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztJQUNyRixDQUFDLENBQUMsQ0FBQztJQUNILE1BQU0sT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUNqQyxNQUFNLElBQUksT0FBTyxDQUFPLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUMxRSxJQUFJLE9BQU8sS0FBSyxJQUFJLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUTtRQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUNwSCxPQUFPLE9BQU8sQ0FBQyxJQUFJLENBQUM7QUFDdEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FDcEQsUUFBUSxZQUFZLEtBQUssSUFBSSxrREFBa0QsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0FBRXpHLDZEQUE2RDtBQUM3RCxNQUFNLE9BQU8sd0JBQXlCLFNBQVEsS0FBSztJQUNqRCxZQUFZLE9BQTBCLEVBQUUsVUFBeUI7UUFDL0QsS0FBSyxDQUFDLE9BQU8sT0FBTyx1QkFBdUIsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUN6RCxJQUFJLENBQUMsSUFBSSxHQUFHLDBCQUEwQixDQUFDO0lBQ3pDLENBQUM7Q0FDRjtBQUVEOzs7O0dBSUc7QUFDSCxNQUFNLE9BQU8sOEJBQThCO0lBQ2hDLEtBQUssQ0FBb0I7SUFDekIsUUFBUSxDQUFvRztJQUNySCxNQUFNLEdBQWdDLE1BQU0sQ0FBQztJQUM3QyxXQUFXLENBQXdDO0lBQ25ELE1BQU0sQ0FBaUM7SUFDdkMsV0FBVyxDQUF3QztJQUNuRCxLQUFLLENBQXFDO0lBQzFDLFNBQVMsQ0FBb0M7SUFDN0MsVUFBVSxDQUE2QztJQUN2RCxRQUFRLENBQTJDO0lBQzFDLFFBQVEsR0FBa0MsRUFBRSxDQUFDO0lBQ3RELGVBQWUsQ0FBc0M7SUFDNUMsZUFBZSxHQUFHLElBQUksZUFBZSxFQUFFLENBQUM7SUFDakQsa0dBQWtHO0lBQ2xHLFNBQVMsQ0FBK0I7SUFDeEMsd0ZBQXdGO0lBQ3hGLGFBQWEsR0FBa0IsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBRWpELFlBQVksT0FBMEIsRUFBRSxVQUF5QyxFQUFFLG1CQUEyQjtRQUM1RyxJQUFJLENBQUMsS0FBSyxHQUFHLE9BQU8sQ0FBQztRQUNyQixJQUFJLENBQUMsUUFBUSxHQUFHO1lBQ2QsR0FBRyxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUN2RyxhQUFhLEVBQUUsVUFBVSxDQUFDLGFBQWEsSUFBSSxvQkFBb0I7WUFDL0QsYUFBYSxFQUFFLFVBQVUsQ0FBQyxhQUFhLElBQUksb0JBQW9CO1lBQy9ELGdCQUFnQixFQUFFLFVBQVUsQ0FBQyxnQkFBZ0IsSUFBSSxtQkFBbUI7U0FDckUsQ0FBQztRQUNGLEtBQUssTUFBTSxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzFELElBQUksSUFBSSxLQUFLLGtCQUFrQixJQUFJLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFLLEtBQWdCLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDM0YsTUFBTSxJQUFJLFNBQVMsQ0FBQyxHQUFHLElBQUksOEJBQThCLENBQUMsQ0FBQztZQUM3RCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFXLEtBQUs7UUFDZCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUM7SUFDckIsQ0FBQztJQUVELElBQVcsZ0JBQWdCO1FBQ3pCLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQztJQUN4QyxDQUFDO0lBRUQsSUFBVyxXQUFXO1FBQ3BCLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLGlCQUFpQixDQUFDLENBQUMsV0FBVyxDQUFDO0lBQ25FLENBQUM7SUFFRCxJQUFXLFFBQVE7UUFDakIsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVELElBQVcsSUFBSTtRQUNiLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFRCxJQUFXLFVBQVU7UUFDbkIsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsYUFBYSxDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVELDJEQUEyRDtJQUMzRCxJQUFXLFVBQVU7UUFDbkIsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQztJQUNyQyxDQUFDO0lBRUQseUVBQXlFO0lBQ2xFLGlCQUFpQjtRQUN0QixJQUFJLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLE9BQU87WUFBRSxNQUFNLElBQUksd0JBQXdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzFGLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksY0FBYyxDQUFDLFFBQWlCO1FBQ3JDLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxPQUFPLElBQUksUUFBUSxZQUFZLHdCQUF3QjtZQUFFLE9BQU8sUUFBUSxDQUFDO1FBQzFHLE9BQU8sSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxXQUFXO1FBQ2hCLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxPQUFPO1lBQUUsSUFBSSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsSUFBSSx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztJQUNqSCxDQUFDO0lBRUQsNkRBQTZEO0lBQzdELElBQVcsY0FBYztRQUN2QixPQUFPLElBQUksQ0FBQyxlQUFlLENBQUM7SUFDOUIsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxPQUFPO1FBQ2xCLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1FBQ3pCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxNQUFNO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxvQkFBb0IsSUFBSSxDQUFDLE1BQU0sYUFBYSxDQUFDLENBQUM7UUFDMUYsSUFBSSxDQUFDLE1BQU0sR0FBRyxXQUFXLENBQUM7UUFDMUIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO0lBQ3RDLENBQUM7SUFFRCxLQUFLLENBQUMsUUFBUTtRQUNaLElBQUksQ0FBQztZQUNILElBQUksQ0FBQyxXQUFXLEdBQUcsNEJBQTRCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ2hGLElBQUksQ0FBQyxlQUFlLEdBQUcsTUFBTSxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDdEUsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLHVCQUF1QixDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUNyRixNQUFNLFNBQVMsR0FBRyxNQUFNLGdDQUFnQyxDQUFDLE1BQU0sQ0FDN0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUMzRSxDQUFDO1lBQ0YsTUFBTSxXQUFXLEdBQUcsTUFBTSxTQUFTLENBQUMsc0JBQXNCLENBQUMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDcEgsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDLFdBQVcsR0FBRyxJQUFJLHlCQUF5QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQzlELE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM3QyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUN6QixJQUFJLENBQUMsU0FBUyxHQUFHLEVBQUUsT0FBTyxFQUFFLHFCQUFxQixJQUFJLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxTQUFTLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDdEcsSUFBSSxDQUFDLEtBQUssR0FBRyxJQUFJLHNCQUFzQixDQUFDLEVBQUUsT0FBTyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLFNBQVMsQ0FBQyxjQUFjLEVBQUUsQ0FBQyxDQUFDO1lBQ3pILElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDO1lBQ3pCLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUN4QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDNUMsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3JDLE1BQU0sUUFBUSxDQUFDO1FBQ2pCLENBQUM7SUFDSCxDQUFDO0lBRUQsMkdBQTJHO0lBQ3BHLEtBQUssQ0FBQyxjQUFjLENBQUMsT0FBbUM7UUFDN0QsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDekIsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFVBQVU7WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGlDQUFpQyxJQUFJLENBQUMsTUFBTSxhQUFhLENBQUMsQ0FBQztRQUMzRyxJQUFJLENBQUMsTUFBTSxHQUFHLFVBQVUsQ0FBQztRQUN6QixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFRCxLQUFLLENBQUMsZUFBZSxDQUFDLE9BQW1DO1FBQ3ZELE1BQU0sVUFBVSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUM7UUFDbkMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLGlCQUFpQixDQUFDLENBQUM7UUFDNUQsTUFBTSxNQUFNLEdBQUcsdUJBQXVCLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDOUMsTUFBTSxJQUFJLEdBQUcsaUJBQWlCLEtBQUssQ0FBQyxJQUFJLElBQUksS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ2hFLElBQUksQ0FBQztZQUNILE1BQU0sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDLFNBQVMsQ0FBQztnQkFDdkMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsVUFBVTtnQkFDbkMsa0JBQWtCLEVBQUUsT0FBTyxDQUFDLEtBQUssQ0FBQyxVQUFVO2dCQUM1QyxNQUFNLEVBQUUsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxhQUFhLENBQUMsRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sQ0FBQyxDQUFDO2FBQ3pHLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3pCLElBQUksQ0FBQyxRQUFRLEdBQUcsTUFBTSxVQUFVLENBQUMsYUFBYSxDQUFDLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsQ0FBQyxDQUFDO1lBQ2pHLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3pCLEtBQUssTUFBTSxNQUFNLElBQUksT0FBTyxDQUFDLE9BQU8sSUFBSSxFQUFFLEVBQUUsQ0FBQztnQkFDM0MsSUFBSSxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO29CQUFFLE1BQU0sSUFBSSxTQUFTLENBQUMsbUJBQW1CLE1BQU0sQ0FBQyxPQUFPLGlCQUFpQixDQUFDLENBQUM7Z0JBQzVILElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sVUFBVSxDQUFDLFlBQVksQ0FBQyxFQUFFLElBQUksRUFBRSxHQUFHLElBQUksSUFBSSxNQUFNLENBQUMsT0FBTyxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDO2dCQUNqRyxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUMzQixDQUFDO1lBQ0Qsa0ZBQWtGO1lBQ2xGLGdGQUFnRjtZQUNoRixvRkFBb0Y7WUFDcEYsS0FBSyxJQUFJLE9BQU8sR0FBRyxDQUFDLEdBQUksT0FBTyxFQUFFLEVBQUUsQ0FBQztnQkFDbEMsTUFBTSxRQUFRLEdBQUcsTUFBTSxtQkFBbUIsRUFBRSxDQUFDO2dCQUM3QyxJQUFJLENBQUMsVUFBVSxHQUFHLE1BQU0sVUFBVSxDQUFDLGVBQWUsQ0FBQztvQkFDakQsSUFBSTtvQkFDSixPQUFPLEVBQUUsS0FBSyxDQUFDLEVBQUU7b0JBQ2pCLGNBQWMsRUFBRSxPQUFPLENBQUMsS0FBSyxDQUFDLFVBQVU7b0JBQ3hDLElBQUksRUFBRSxPQUFPLENBQUMsSUFBSTtvQkFDbEIsR0FBRyxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLENBQUMsRUFBRSxtQkFBbUIsRUFBRSxJQUFhLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO29CQUM5RSxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU87b0JBQ3hCLEdBQUcsRUFBRSxPQUFPLENBQUMsR0FBRztvQkFDaEIsTUFBTTtvQkFDTixXQUFXLEVBQUUsT0FBTyxDQUFDLGtCQUFrQjtvQkFDdkMsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFXO29CQUNoQyxlQUFlLEVBQUUsT0FBTyxDQUFDLFdBQVc7b0JBQ3BDLFFBQVEsRUFBRSxPQUFPLENBQUMsUUFBUTtvQkFDMUIsU0FBUyxFQUFFLE9BQU8sQ0FBQyxTQUFTO29CQUM1QixHQUFHLENBQUMsT0FBTyxDQUFDLFlBQVksS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLFlBQVksRUFBRSxDQUFDO29CQUNoRixHQUFHLENBQUMsT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUNsRixHQUFHLENBQUMsT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDO29CQUNsRixpQkFBaUIsRUFBRSxDQUFDLE9BQU8sQ0FBQyxPQUFPLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsU0FBUyxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQzt3QkFDdkUsTUFBTSxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFFLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxTQUFTLENBQUMsTUFBTTtxQkFDaEUsQ0FBQyxDQUFDO29CQUNILGdCQUFnQixFQUFFLENBQUMsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQztvQkFDbkQsWUFBWSxFQUFFLENBQUMsRUFBRSxhQUFhLEVBQUUsT0FBTyxDQUFDLFFBQVEsRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLENBQUM7aUJBQ3BHLENBQUMsQ0FBQztnQkFDSCxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztnQkFDekIsSUFBSSxDQUFDO29CQUNILE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztvQkFDOUIsTUFBTTtnQkFDUixDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQ2YsSUFBSSxPQUFPLElBQUksZUFBZSxJQUFJLENBQUMsY0FBYyxDQUFDLEtBQUssQ0FBQzt3QkFBRSxNQUFNLEtBQUssQ0FBQztvQkFDdEUsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztvQkFDNUUsSUFBSSxDQUFDLFVBQVUsR0FBRyxTQUFTLENBQUM7Z0JBQzlCLENBQUM7WUFDSCxDQUFDO1lBQ0QsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDekIsTUFBTSxhQUFhLEdBQUcsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ25GLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3pCLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxnQkFBZ0IsQ0FBQyxDQUFDLGVBQWUsQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUNqRixJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUMxQixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDNUMsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3JDLE1BQU0sUUFBUSxDQUFDO1FBQ2pCLENBQUM7SUFDSCxDQUFDO0lBRUQscUZBQXFGO0lBQzlFLEtBQUssQ0FBQyxJQUFJLENBQ2YsVUFBNEMsRUFDNUMsYUFBbUQsRUFBRTtRQUVyRCxJQUFJLElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0JBQW9CLElBQUksQ0FBQyxNQUFNLGFBQWEsQ0FBQyxDQUFDO1FBQzdGLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDbEYsQ0FBQztJQUVELHFGQUFxRjtJQUM5RSxLQUFLLENBQUMsc0JBQXNCO1FBQ2pDLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQztRQUM5RCxNQUFNLEtBQUssR0FBRyxNQUFNLFNBQVMsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUM3QyxJQUFJLEtBQUssQ0FBQyxPQUFPO1lBQUUsT0FBTztRQUMxQixNQUFNLElBQUksR0FBRyxNQUFNLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNoRCxNQUFNLElBQUksS0FBSyxDQUNiLE9BQU8sSUFBSSxDQUFDLEtBQUsseUJBQXlCLEtBQUssQ0FBQyxNQUFNLFVBQVUsS0FBSyxDQUFDLFFBQVEsU0FBUyxLQUFLLENBQUMsU0FBUyxrQkFBa0IsSUFBSSxFQUFFLENBQy9ILENBQUM7SUFDSixDQUFDO0lBRUQsaUZBQWlGO0lBQzFFLEtBQUssQ0FBQyxlQUFlO1FBQzFCLE1BQU0sVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQy9FLE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7UUFDL0IsTUFBTSxNQUFNLEdBQVksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDL0csSUFBSSxNQUFNLEtBQUssU0FBUyxJQUFJLE1BQU0sS0FBSyxJQUFJO1lBQUUsT0FBTyxNQUFNLENBQUM7UUFDM0QsTUFBTSxNQUFNLEdBQVksT0FBTyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQy9GLElBQUksTUFBTSxLQUFLLFVBQVUsSUFBSSxNQUFNLEtBQUssU0FBUyxJQUFJLE1BQU0sS0FBSyxXQUFXO1lBQUUsT0FBTyxNQUFNLENBQUM7UUFDM0YsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFFRCw0RUFBNEU7SUFDckUsS0FBSyxDQUFDLFFBQVEsQ0FBQyxRQUFnQjtRQUNwQyxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxXQUFXLENBQUMsQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDbkIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNoQyxJQUFJLFFBQVE7WUFBRSxNQUFNLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDcEQsTUFBTSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVELEtBQUssQ0FBQyxNQUFNLENBQUksWUFBd0I7UUFDdEMsSUFBSSxDQUFDLFNBQVMsR0FBRyxZQUFZLENBQUM7UUFDOUIsSUFBSSxDQUFDO1lBQ0gsT0FBTyxNQUFNLFlBQVksQ0FBQztRQUM1QixDQUFDO2dCQUFTLENBQUM7WUFDVCxJQUFJLElBQUksQ0FBQyxTQUFTLEtBQUssWUFBWTtnQkFBRSxJQUFJLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztRQUNsRSxDQUFDO0lBQ0gsQ0FBQztJQUVELFFBQVE7UUFDTixNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUMsQ0FBQztRQUMxRixJQUFJLENBQUMsYUFBYSxHQUFHLEdBQUcsQ0FBQztRQUN6QixPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFFRCxLQUFLLENBQUMsZ0JBQWdCO1FBQ3BCLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUMsS0FBSyxHQUFHLFNBQVMsQ0FBQztZQUN2QixJQUFJLENBQUMsU0FBUyxHQUFHLFNBQVMsQ0FBQztZQUMzQixJQUFJLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDO1FBQ3pCLE1BQU0sUUFBUSxHQUFjLEVBQUUsQ0FBQztRQUMvQixNQUFNLE9BQU8sR0FBRyxLQUFLLEVBQUUsWUFBaUMsRUFBRSxFQUFFO1lBQzFELElBQUksQ0FBQztnQkFDSCxNQUFNLFlBQVksRUFBRSxDQUFDO1lBQ3ZCLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDdkIsQ0FBQztRQUNILENBQUMsQ0FBQztRQUNGLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUM7UUFDcEIsSUFBSSxDQUFDLEtBQUssR0FBRyxTQUFTLENBQUM7UUFDdkIsTUFBTSxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDdkIsTUFBTSxJQUFJLENBQUMsV0FBVyxFQUFFLEtBQUssRUFBRSxDQUFDO1lBQ2hDLElBQUksQ0FBQyxXQUFXLEdBQUcsU0FBUyxDQUFDO1FBQy9CLENBQUMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDdkIsTUFBTSxJQUFJLENBQUMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsc0JBQXNCLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUM3RSxJQUFJLENBQUMsVUFBVSxHQUFHLFNBQVMsQ0FBQztRQUM5QixDQUFDLENBQUMsQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ3ZCLElBQUksSUFBSSxDQUFDLFVBQVU7Z0JBQUUsT0FBTztZQUM1QixNQUFNLElBQUksQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLFFBQVEsR0FBRyxTQUFTLENBQUM7UUFDNUIsQ0FBQyxDQUFDLENBQUM7UUFDSCxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNwRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBRSxDQUFDO1lBQ2pDLElBQUksQ0FBQztnQkFDSCxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDckMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUN4QixDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixRQUFRLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNyQixNQUFNO1lBQ1IsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUM7WUFDMUIsTUFBTSxPQUFPLENBQUMsS0FBSyxJQUFJLEVBQUU7Z0JBQ3ZCLE1BQU0sSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLEVBQUUsQ0FBQztnQkFDL0IsSUFBSSxDQUFDLFdBQVcsR0FBRyxTQUFTLENBQUM7WUFDL0IsQ0FBQyxDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFNBQVMsR0FBRyxTQUFTLENBQUM7UUFDM0IsSUFBSSxDQUFDLE1BQU0sR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzVELElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLElBQUksY0FBYyxDQUFDLFFBQVEsRUFBRSxPQUFPLElBQUksQ0FBQyxLQUFLLFlBQVksSUFBSSxDQUFDLE1BQU0sRUFBRSxXQUFXLElBQUksRUFBRSwrQkFBK0IsQ0FBQyxDQUFDO1FBQ2pJLENBQUM7SUFDSCxDQUFDO0lBRUQsYUFBYTtRQUNYLE9BQU8sSUFBSSxDQUFDLFdBQVcsS0FBSyxTQUFTLElBQUksSUFBSSxDQUFDLFVBQVUsS0FBSyxTQUFTO2VBQ2pFLElBQUksQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLENBQUMsSUFBSSxJQUFJLENBQUMsV0FBVyxLQUFLLFNBQVMsQ0FBQztJQUNqRyxDQUFDO0lBRUQsS0FBSyxDQUFDLGVBQWUsQ0FBQyxRQUFpQjtRQUNyQyxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztRQUN4QixDQUFDO1FBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksY0FBYyxDQUFDLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxFQUFFLE9BQU8sSUFBSSxDQUFDLEtBQUssMkNBQTJDLENBQUMsQ0FBQztRQUNuSCxDQUFDO0lBQ0gsQ0FBQztJQUVELEtBQUssQ0FBQyxjQUFjLENBQUMsWUFBNEMsRUFBRSxnQkFBd0I7UUFDekYsTUFBTSxVQUFVLEdBQUcsTUFBTSxZQUFZLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDaEQsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLGVBQWUsQ0FBQztRQUM1QyxNQUFNLEtBQUssR0FBRyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUM3RyxNQUFNLFFBQVEsR0FBWSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxnQkFBZ0IsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUNsSSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1QixLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO2dCQUMvQixJQUFJLE9BQU8sT0FBTyxLQUFLLFFBQVEsSUFBSSxPQUFPLEtBQUssSUFBSTtvQkFBRSxTQUFTO2dCQUM5RCxNQUFNLE1BQU0sR0FBWSxPQUFPLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQztnQkFDdkQsTUFBTSxRQUFRLEdBQVksT0FBTyxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsVUFBVSxDQUFDLENBQUM7Z0JBQzNELElBQUksTUFBTSxLQUFLLFdBQVcsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksY0FBYyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO29CQUM1RixPQUFPLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztnQkFDMUIsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyx5Q0FBeUMsZ0JBQWdCLGdCQUFnQixDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUVELFFBQVEsQ0FBSSxRQUF1QixFQUFFLE9BQWU7UUFDbEQsSUFBSSxRQUFRLEtBQUssU0FBUztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsT0FBTyxJQUFJLENBQUMsS0FBSyxtQkFBbUIsT0FBTyxhQUFhLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQ3BILE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7Q0FDRiJ9

package/dist_ts/classes.giteafixture.d.ts

@@ -0,0 +1,41 @@
+import type { ForgeFixtureHttpClient } from './classes.httpclient.js';
+import type { IForgeFixtureLifecycleOptions, IForgeFixtureReapReport, IGiteaFixtureRuntime } from './interfaces.js';
+export interface IGiteaFixtureOptions extends IForgeFixtureLifecycleOptions {
+    /** Container memory limit; swap is disabled. Defaults to 512 MiB. */
+    memoryBytes?: number;
+    /** CPU limit in billionths of a CPU. Defaults to 2 CPUs. */
+    nanoCpus?: number;
+}
+export interface IGiteaAccessTokenRequest {
+    username: string;
+    /** Unique per user. */
+    tokenName: string;
+    /** Gitea scopes such as `all`, `public-only` or `read:repository`. */
+    scopes: string[];
+}
+/**
+ * A disposable Gitea instance from the pinned rootless image, served over
+ * verified loopback TLS, with SQLite and all data in one owned named volume.
+ */
+export declare class GiteaFixture {
+    #private;
+    constructor(optionsArg?: IGiteaFixtureOptions);
+    get runtime(): IGiteaFixtureRuntime;
+    /** HTTPS client scoped to this fixture's origin and CA. */
+    get http(): ForgeFixtureHttpClient;
+    /** Report of the stale-fixture reaper run that preceded this start. */
+    get reapReport(): IForgeFixtureReapReport | undefined;
+    /**
+     * Starts the fixture and returns once Gitea answers with the pinned version
+     * and an admin token exists. A fixture starts at most once.
+     */
+    start(): Promise<IGiteaFixtureRuntime>;
+    /** Creates an access token through Gitea's supported admin CLI. The token is returned, never logged. */
+    createAccessToken(requestArg: IGiteaAccessTokenRequest): Promise<string>;
+    /**
+     * Removes every resource of this fixture. A start in progress is cancelled at
+     * its next checkpoint and awaited first, so nothing it created survives.
+     * Idempotent; retries incomplete cleanup.
+     */
+    stop(): Promise<void>;
+}

package/dist_ts/classes.giteafixture.js

@@ -0,0 +1,182 @@
+import * as plugins from './plugins.js';
+import { giteaFixtureImage } from './constants.js';
+import { ForgeFixtureContainerLifecycle } from './classes.containerlifecycle.js';
+const httpPort = 3000;
+const dataDirectory = '/var/lib/gitea';
+/** The configuration lives in the owned data volume, whose directories belong to the Gitea user. */
+const appIni = `${dataDirectory}/conf/app.ini`;
+const giteaBinary = '/usr/local/bin/gitea';
+const adminUsername = 'forgeadmin';
+const usernamePattern = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,38}$/;
+const scopePattern = /^(all|public-only|(read|write):[a-z]+)$/;
+const tokenPattern = /^[0-9a-f]{40}$/;
+const execTimeoutMs = 60_000;
+const sleep = (msArg) => new Promise((resolveArg) => setTimeout(resolveArg, msArg));
+/**
+ * A disposable Gitea instance from the pinned rootless image, served over
+ * verified loopback TLS, with SQLite and all data in one owned named volume.
+ */
+export class GiteaFixture {
+    #options;
+    #lifecycle;
+    #runtime;
+    #starting;
+    constructor(optionsArg = {}) {
+        this.#options = { ...optionsArg };
+        this.#lifecycle = new ForgeFixtureContainerLifecycle('gitea', optionsArg, 120_000);
+    }
+    get runtime() {
+        if (!this.#runtime)
+            throw new Error('The Gitea fixture is not running.');
+        return this.#runtime;
+    }
+    /** HTTPS client scoped to this fixture's origin and CA. */
+    get http() {
+        return this.#lifecycle.http;
+    }
+    /** Report of the stale-fixture reaper run that preceded this start. */
+    get reapReport() {
+        return this.#lifecycle.lastReapReport;
+    }
+    /**
+     * Starts the fixture and returns once Gitea answers with the pinned version
+     * and an admin token exists. A fixture starts at most once.
+     */
+    start() {
+        if (this.#starting)
+            return Promise.reject(new Error('The Gitea fixture was already started.'));
+        this.#starting = this.#start();
+        return this.#starting;
+    }
+    async #start() {
+        const endpoint = await this.#lifecycle.prepare();
+        try {
+            await this.#lifecycle.startContainer({
+                image: giteaFixtureImage,
+                user: '1000:1000',
+                command: [giteaBinary, '--config', appIni, 'web'],
+                env: {
+                    GITEA_APP_INI: appIni,
+                    GITEA__security__INSTALL_LOCK: 'true',
+                    GITEA__security__SECRET_KEY: plugins.crypto.randomBytes(32).toString('hex'),
+                    GITEA__server__ROOT_URL: `${endpoint.baseUrl}/`,
+                    GITEA__server__DOMAIN: '127.0.0.1',
+                    GITEA__server__SSH_DOMAIN: '127.0.0.1',
+                    GITEA__server__HTTP_PORT: String(httpPort),
+                    GITEA__server__LFS_START_SERVER: 'true',
+                    GITEA__server__OFFLINE_MODE: 'true',
+                    GITEA__service__DISABLE_REGISTRATION: 'true',
+                    GITEA__database__DB_TYPE: 'sqlite3',
+                    GITEA__log__LEVEL: 'Warn',
+                },
+                httpPort,
+                // Git hooks live in the data directory and must be executable, so it is an owned
+                // named volume (Docker mounts tmpfs noexec). It is removed with the lifecycle.
+                volumes: [{ purpose: 'data', target: dataDirectory }],
+                // Declared image volume, unused because the configuration lives in the data volume;
+                // mounted so Docker creates no anonymous volume for it.
+                tmpfsMounts: [{ target: '/etc/gitea', sizeBytes: 1024 * 1024 }],
+                memoryBytes: this.#options.memoryBytes ?? 512 * 1024 * 1024,
+                nanoCpus: this.#options.nanoCpus ?? 2_000_000_000,
+                pidsLimit: 512,
+                stopTimeoutSeconds: 10,
+            });
+            await this.#waitForHealth(Date.now() + this.#lifecycle.startupTimeoutMs);
+            const version = await this.#readVersion();
+            this.#lifecycle.assertNotStopping();
+            if (version !== giteaFixtureImage.version) {
+                throw new Error(`Gitea reports version ${version}; the pinned image is ${giteaFixtureImage.version}.`);
+            }
+            await this.#giteaCli([
+                'admin', 'user', 'create', '--username', adminUsername, '--email', `${adminUsername}@example.com`,
+                '--random-password', '--admin', '--must-change-password=false',
+            ], 'create the fixture administrator');
+            const token = await this.createAccessToken({ username: adminUsername, tokenName: 'forgefixtures-admin', scopes: ['all'] });
+            this.#lifecycle.assertNotStopping();
+            this.#runtime = {
+                kind: 'gitea',
+                lifecycleId: this.#lifecycle.lifecycleId,
+                baseUrl: endpoint.baseUrl,
+                caCertificatePem: endpoint.caCertificatePem,
+                version,
+                image: giteaFixtureImage,
+                admin: { username: adminUsername, token },
+            };
+            return this.#runtime;
+        }
+        catch (error) {
+            const reported = this.#lifecycle.stopAwareError(error);
+            try {
+                await this.#lifecycle.stop();
+            }
+            catch (cleanupError) {
+                throw new AggregateError([reported, cleanupError], 'The Gitea fixture failed to start and to clean up.');
+            }
+            throw reported;
+        }
+    }
+    /** Creates an access token through Gitea's supported admin CLI. The token is returned, never logged. */
+    async createAccessToken(requestArg) {
+        if (!usernamePattern.test(requestArg.username) || !/^[A-Za-z0-9_.-]{1,64}$/.test(requestArg.tokenName)
+            || requestArg.scopes.length === 0 || !requestArg.scopes.every((scopeArg) => scopePattern.test(scopeArg))) {
+            throw new TypeError('The access token request is malformed.');
+        }
+        const stdout = await this.#giteaCli([
+            'admin', 'user', 'generate-access-token', '--username', requestArg.username,
+            '--token-name', requestArg.tokenName, '--scopes', requestArg.scopes.join(','), '--raw',
+        ], `create an access token for ${requestArg.username}`);
+        const token = stdout.trim();
+        if (!tokenPattern.test(token))
+            throw new Error('Gitea returned an access token in an unexpected format.');
+        return token;
+    }
+    /**
+     * Removes every resource of this fixture. A start in progress is cancelled at
+     * its next checkpoint and awaited first, so nothing it created survives.
+     * Idempotent; retries incomplete cleanup.
+     */
+    async stop() {
+        this.#runtime = undefined;
+        this.#lifecycle.requestStop();
+        const starting = this.#starting;
+        if (starting)
+            await starting.catch(() => undefined);
+        await this.#lifecycle.stop();
+    }
+    async #waitForHealth(deadlineArg) {
+        let lastFailure = 'no attempt';
+        while (Date.now() < deadlineArg) {
+            this.#lifecycle.assertNotStopping();
+            await this.#lifecycle.assertContainerRunning();
+            try {
+                const response = await this.#lifecycle.http.request({
+                    method: 'GET', url: '/api/healthz', expectedStatus: [200, 503], timeoutMs: 5_000,
+                });
+                if (response.status === 200)
+                    return;
+                lastFailure = `status ${response.status}`;
+            }
+            catch (error) {
+                lastFailure = error instanceof Error ? error.message : String(error);
+            }
+            await sleep(500);
+        }
+        throw new Error(`Gitea did not become healthy within ${this.#lifecycle.startupTimeoutMs} ms (${lastFailure}). Last logs:\n${await this.#lifecycle.logsTail(40)}`);
+    }
+    async #readVersion() {
+        const body = await this.#lifecycle.http.requestJson({ method: 'GET', url: '/api/v1/version', expectedStatus: [200] });
+        const version = typeof body === 'object' && body !== null ? Reflect.get(body, 'version') : undefined;
+        if (typeof version !== 'string')
+            throw new Error('Gitea answered /api/v1/version without a version.');
+        return version;
+    }
+    /** Runs the Gitea CLI as the Gitea user. Output is returned but never included in errors. */
+    async #giteaCli(argsArg, purposeArg) {
+        const result = await this.#lifecycle.exec([giteaBinary, '--config', appIni, ...argsArg], { timeoutMs: execTimeoutMs });
+        if (result.exitCode !== 0) {
+            throw new Error(`Gitea CLI failed to ${purposeArg} (exit ${result.exitCode}): ${result.stderr.slice(0, 1024)}`);
+        }
+        return result.stdout;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRlYWZpeHR1cmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmdpdGVhZml4dHVyZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUN4QyxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxnQkFBZ0IsQ0FBQztBQUNuRCxPQUFPLEVBQUUsOEJBQThCLEVBQUUsTUFBTSxpQ0FBaUMsQ0FBQztBQW1CakYsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDO0FBQ3RCLE1BQU0sYUFBYSxHQUFHLGdCQUFnQixDQUFDO0FBQ3ZDLG9HQUFvRztBQUNwRyxNQUFNLE1BQU0sR0FBRyxHQUFHLGFBQWEsZUFBZSxDQUFDO0FBQy9DLE1BQU0sV0FBVyxHQUFHLHNCQUFzQixDQUFDO0FBQzNDLE1BQU0sYUFBYSxHQUFHLFlBQVksQ0FBQztBQUNuQyxNQUFNLGVBQWUsR0FBRyxtQ0FBbUMsQ0FBQztBQUM1RCxNQUFNLFlBQVksR0FBRyx5Q0FBeUMsQ0FBQztBQUMvRCxNQUFNLFlBQVksR0FBRyxnQkFBZ0IsQ0FBQztBQUN0QyxNQUFNLGFBQWEsR0FBRyxNQUFNLENBQUM7QUFFN0IsTUFBTSxLQUFLLEdBQUcsQ0FBQyxLQUFhLEVBQUUsRUFBRSxDQUFDLElBQUksT0FBTyxDQUFPLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFbEc7OztHQUdHO0FBQ0gsTUFBTSxPQUFPLFlBQVk7SUFDZCxRQUFRLENBQXVCO0lBQy9CLFVBQVUsQ0FBaUM7SUFDcEQsUUFBUSxDQUFtQztJQUMzQyxTQUFTLENBQTRDO0lBRXJELFlBQVksYUFBbUMsRUFBRTtRQUMvQyxJQUFJLENBQUMsUUFBUSxHQUFHLEVBQUUsR0FBRyxVQUFVLEVBQUUsQ0FBQztRQUNsQyxJQUFJLENBQUMsVUFBVSxHQUFHLElBQUksOEJBQThCLENBQUMsT0FBTyxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUNyRixDQUFDO0lBRUQsSUFBVyxPQUFPO1FBQ2hCLElBQUksQ0FBQyxJQUFJLENBQUMsUUFBUTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN6RSxPQUFPLElBQUksQ0FBQyxRQUFRLENBQUM7SUFDdkIsQ0FBQztJQUVELDJEQUEyRDtJQUMzRCxJQUFXLElBQUk7UUFDYixPQUFPLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDO0lBQzlCLENBQUM7SUFFRCx1RUFBdUU7SUFDdkUsSUFBVyxVQUFVO1FBQ25CLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUM7SUFDeEMsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUs7UUFDVixJQUFJLElBQUksQ0FBQyxTQUFTO1lBQUUsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUMsQ0FBQztRQUMvRixJQUFJLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUMvQixPQUFPLElBQUksQ0FBQyxTQUFTLENBQUM7SUFDeEIsQ0FBQztJQUVELEtBQUssQ0FBQyxNQUFNO1FBQ1YsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ2pELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUM7Z0JBQ25DLEtBQUssRUFBRSxpQkFBaUI7Z0JBQ3hCLElBQUksRUFBRSxXQUFXO2dCQUNqQixPQUFPLEVBQUUsQ0FBQyxXQUFXLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxLQUFLLENBQUM7Z0JBQ2pELEdBQUcsRUFBRTtvQkFDSCxhQUFhLEVBQUUsTUFBTTtvQkFDckIsNkJBQTZCLEVBQUUsTUFBTTtvQkFDckMsMkJBQTJCLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztvQkFDM0UsdUJBQXVCLEVBQUUsR0FBRyxRQUFRLENBQUMsT0FBTyxHQUFHO29CQUMvQyxxQkFBcUIsRUFBRSxXQUFXO29CQUNsQyx5QkFBeUIsRUFBRSxXQUFXO29CQUN0Qyx3QkFBd0IsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDO29CQUMxQywrQkFBK0IsRUFBRSxNQUFNO29CQUN2QywyQkFBMkIsRUFBRSxNQUFNO29CQUNuQyxvQ0FBb0MsRUFBRSxNQUFNO29CQUM1Qyx3QkFBd0IsRUFBRSxTQUFTO29CQUNuQyxpQkFBaUIsRUFBRSxNQUFNO2lCQUMxQjtnQkFDRCxRQUFRO2dCQUNSLGlGQUFpRjtnQkFDakYsK0VBQStFO2dCQUMvRSxPQUFPLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxDQUFDO2dCQUNyRCxvRkFBb0Y7Z0JBQ3BGLHdEQUF3RDtnQkFDeEQsV0FBVyxFQUFFLENBQUMsRUFBRSxNQUFNLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxJQUFJLEdBQUcsSUFBSSxFQUFFLENBQUM7Z0JBQy9ELFdBQVcsRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsSUFBSSxHQUFHLEdBQUcsSUFBSSxHQUFHLElBQUk7Z0JBQzNELFFBQVEsRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxhQUFhO2dCQUNqRCxTQUFTLEVBQUUsR0FBRztnQkFDZCxrQkFBa0IsRUFBRSxFQUFFO2FBQ3ZCLENBQUMsQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3pFLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQzFDLElBQUksQ0FBQyxVQUFVLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUNwQyxJQUFJLE9BQU8sS0FBSyxpQkFBaUIsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDMUMsTUFBTSxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsT0FBTyx5QkFBeUIsaUJBQWlCLENBQUMsT0FBTyxHQUFHLENBQUMsQ0FBQztZQUN6RyxDQUFDO1lBQ0QsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDO2dCQUNuQixPQUFPLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxZQUFZLEVBQUUsYUFBYSxFQUFFLFNBQVMsRUFBRSxHQUFHLGFBQWEsY0FBYztnQkFDakcsbUJBQW1CLEVBQUUsU0FBUyxFQUFFLDhCQUE4QjthQUMvRCxFQUFFLGtDQUFrQyxDQUFDLENBQUM7WUFDdkMsTUFBTSxLQUFLLEdBQUcsTUFBTSxJQUFJLENBQUMsaUJBQWlCLENBQUMsRUFBRSxRQUFRLEVBQUUsYUFBYSxFQUFFLFNBQVMsRUFBRSxxQkFBcUIsRUFBRSxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDM0gsSUFBSSxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3BDLElBQUksQ0FBQyxRQUFRLEdBQUc7Z0JBQ2QsSUFBSSxFQUFFLE9BQU87Z0JBQ2IsV0FBVyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVztnQkFDeEMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPO2dCQUN6QixnQkFBZ0IsRUFBRSxRQUFRLENBQUMsZ0JBQWdCO2dCQUMzQyxPQUFPO2dCQUNQLEtBQUssRUFBRSxpQkFBaUI7Z0JBQ3hCLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxhQUFhLEVBQUUsS0FBSyxFQUFFO2FBQzFDLENBQUM7WUFDRixPQUFPLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDdkIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN2RCxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQy9CLENBQUM7WUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO2dCQUN0QixNQUFNLElBQUksY0FBYyxDQUFDLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxFQUFFLG9EQUFvRCxDQUFDLENBQUM7WUFDM0csQ0FBQztZQUNELE1BQU0sUUFBUSxDQUFDO1FBQ2pCLENBQUM7SUFDSCxDQUFDO0lBRUQsd0dBQXdHO0lBQ2pHLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxVQUFvQztRQUNqRSxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQztlQUNqRyxVQUFVLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDM0csTUFBTSxJQUFJLFNBQVMsQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDbEMsT0FBTyxFQUFFLE1BQU0sRUFBRSx1QkFBdUIsRUFBRSxZQUFZLEVBQUUsVUFBVSxDQUFDLFFBQVE7WUFDM0UsY0FBYyxFQUFFLFVBQVUsQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLE9BQU87U0FDdkYsRUFBRSw4QkFBOEIsVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDeEQsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQzVCLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELENBQUMsQ0FBQztRQUMxRyxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLENBQUMsUUFBUSxHQUFHLFNBQVMsQ0FBQztRQUMxQixJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzlCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDaEMsSUFBSSxRQUFRO1lBQUUsTUFBTSxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3BELE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUMvQixDQUFDO0lBRUQsS0FBSyxDQUFDLGNBQWMsQ0FBQyxXQUFtQjtRQUN0QyxJQUFJLFdBQVcsR0FBRyxZQUFZLENBQUM7UUFDL0IsT0FBTyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsV0FBVyxFQUFFLENBQUM7WUFDaEMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO1lBQ3BDLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxzQkFBc0IsRUFBRSxDQUFDO1lBQy9DLElBQUksQ0FBQztnQkFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQztvQkFDbEQsTUFBTSxFQUFFLEtBQUssRUFBRSxHQUFHLEVBQUUsY0FBYyxFQUFFLGNBQWMsRUFBRSxDQUFDLEdBQUcsRUFBRSxHQUFHLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSztpQkFDakYsQ0FBQyxDQUFDO2dCQUNILElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHO29CQUFFLE9BQU87Z0JBQ3BDLFdBQVcsR0FBRyxVQUFVLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM1QyxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixXQUFXLEdBQUcsS0FBSyxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQ3ZFLENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNuQixDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FDYix1Q0FBdUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsUUFBUSxXQUFXLGtCQUFrQixNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQ2pKLENBQUM7SUFDSixDQUFDO0lBRUQsS0FBSyxDQUFDLFlBQVk7UUFDaEIsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxpQkFBaUIsRUFBRSxjQUFjLEVBQUUsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdEgsTUFBTSxPQUFPLEdBQVksT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDOUcsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO1FBQ3RHLE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFRCw2RkFBNkY7SUFDN0YsS0FBSyxDQUFDLFNBQVMsQ0FBQyxPQUFpQixFQUFFLFVBQWtCO1FBQ25ELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsVUFBVSxFQUFFLE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxFQUFFLEVBQUUsU0FBUyxFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDdkgsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUJBQXVCLFVBQVUsVUFBVSxNQUFNLENBQUMsUUFBUSxNQUFNLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEgsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2QixDQUFDO0NBQ0YifQ==