@foss.global/gitmanager 2.10.0 → 2.11.1

package/changelog.md

@@ -1,5 +1,27 @@
 # Changelog
 
+## 2026-11-15 - 2.11.1
+
+### Fixes
+
+- decide a Smart HTTP push by its whole body even when the bytes after the pack exceed Git's input pipe (receive gate)
+  - A complete pack followed by more trailing bytes than Git's stdin pipe holds now gets `413` when the body is over `maxRequestBodyBytes` and is admitted when it is within it, decided as soon as the body ends. It used to wait for the pre-receive hook's 30 s timeout and answer `200` "pre-receive hook declined"; no ref moved in either case.
+  - Trailing bytes that arrive more than 30 s after the pack still get `503` and move no ref.
+
+## 2026-11-14 - 2.11.0
+
+### Features
+
+- `pushRefs()` pushes to `ssh://` remotes with an `sshKey` credential, `{ kind: 'sshKey', privateKey, hostKey }` (`IGitManagerRemoteSshKeyCredential` from `@foss.global/interfaces` 3.5.0).
+  - `remoteUrl` is `ssh://<user>@<host>[:<port>]/<path>`; a user, host or path outside its character set is refused before any process starts, never escaped. `hostKey` is the remote's host key as one OpenSSH key line, checked exactly and pinned: `ssh` accepts that key and no other. `privateKey` is an unencrypted PEM key the OpenSSH client reads.
+  - The push has the semantics of an `https` push: the engine reads the remote's ref advertisement over the system `ssh` client, checks every lease against it, and relays `git send-pack --stateless-rpc --atomic` to the remote as remote-curl does over HTTP, so the remote checks every lease again inside one atomic ref transaction and no command line grows with the updates. Results, `reason`s and `atomicPushUnsupported` are those of `https`.
+  - The key exists for the push only, as a `0600` file in a `0700` `remote-ssh-<pid>-<nonce>` directory under `transferDir`, removed once the advertisement is read and on every error, abort and timeout, and swept at the next engine start after a kill. It is never on a command line, in an environment variable, an error or a log; `ssh` reads no config file, uses no agent and inherits only `PATH`.
+  - A failure before the advertisement throws a `GitManagerError`, and nothing was pushed: `sshHostKeyMismatch` (the key was never offered), `sshAuthenticationFailed`, `remoteConnectionRefused`, `remoteConnectionFailed` (any other `ssh` failure, including a server that does not offer the pinned key's type) or `remoteProtocolError` (the remote did not answer with a Git advertisement). They are classified from `ssh`'s exit status 255 and the fixed texts of the local OpenSSH client, pinned against the system `ssh` in a test; the message carries the redacted `ssh` output for operator logs only.
+  - Messages and `remoteMessages` redact the key's text, its base64 body and each of its lines of 16 characters or more. A shorter last line of the key, which can be as short as 4 characters, is not redacted on its own, so a hook's output that happens to contain it stays intact.
+  - `remoteTransportMismatch` refuses, before anything runs, an `sshKey` credential with any URL but `ssh://`, an `ssh://` URL without an `sshKey` credential, and `caCertificates` with an `sshKey` credential.
+- Every push result carries `remoteMessages`, for `https` and `ssh` alike: the remote's `remote: ` lines, such as a hook's output, without the prefix and padding, in order; `[]` when there are none. At most 100 lines and 16 KiB, with `[remote messages truncated]` as the last element when the remote sent more; credentials are redacted as in `message`.
+- Minor release. Upgrade: requires `@foss.global/interfaces` ^3.5.0 (from ^2.4.0; the 3.0.0 break concerns forge release types gitmanager does not use). `TGitManagerErrorCode` gains `sshHostKeyMismatch`, `sshAuthenticationFailed`, `remoteConnectionRefused`, `remoteConnectionFailed`, `remoteProtocolError` and `remoteTransportMismatch`; an exhaustive `switch` over the codes needs them. `remoteMessages` is a required result field, so code that builds push results, such as a test double, must add it. An `ssh://` push URL without an `sshKey` credential threw a plain URL-policy error and now throws `remoteTransportMismatch`. Rollback below this release refuses `sshKey` credentials and returns results without `remoteMessages`; a consumer that uses either (the foss.global website S11 SSH canary) must be rolled back with it.
+
 ## 2026-11-11 - 2.10.0
 
 ### Features

package/dist_rust/rustgitmanager_linux_amd64.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "002231d960e299f95ff5ce74eb862364f4bb24303e105df2094c82ebe6714681",
+  "binarySha256": "c2188d359a9ddef107475f7a4df7a7a5763f63df9af03abc3fd99ae51d806d87",
   "buildInfo": {
     "projectName": "@foss.global/gitmanager",
-    "projectVersion": "2.10.0",
-    "gitCommit": "38fab840798a335c5fb0156ac4f0994cb924390a",
+    "projectVersion": "2.11.1",
+    "gitCommit": "9178fc8e3ad6cd064bacc2e553bc9f1a34288122",
     "gitDirty": false,
-    "builtAt": "2026-11-11T01:38:19.970Z",
-    "tsrustVersion": "1.3.0",
+    "builtAt": "2026-11-15T00:09:51.411Z",
+    "tsrustVersion": "1.3.1",
     "binary": "rustgitmanager",
     "target": "linux_amd64"
   }

package/dist_rust/rustgitmanager_linux_arm64.tsrust-build.json

@@ -1,13 +1,13 @@
 {
   "format": "tsrust.build-provenance.v2",
-  "binarySha256": "152964f0946017a69c7ec0677ff26813f1d7be6958b9fa15d8f86016d5505a17",
+  "binarySha256": "3ed7212e93ea72e2487ec26ea9531af9e4c16bd8a740d82b9d39f51e85ac66ee",
   "buildInfo": {
     "projectName": "@foss.global/gitmanager",
-    "projectVersion": "2.10.0",
-    "gitCommit": "38fab840798a335c5fb0156ac4f0994cb924390a",
+    "projectVersion": "2.11.1",
+    "gitCommit": "9178fc8e3ad6cd064bacc2e553bc9f1a34288122",
     "gitDirty": false,
-    "builtAt": "2026-11-11T01:39:55.948Z",
-    "tsrustVersion": "1.3.0",
+    "builtAt": "2026-11-15T00:11:36.993Z",
+    "tsrustVersion": "1.3.1",
     "binary": "rustgitmanager",
     "target": "linux_arm64"
   }

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@foss.global/gitmanager',
-    version: '2.10.0',
+    version: '2.11.1',
     description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx5QkFBeUI7SUFDL0IsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLCtGQUErRjtDQUM3RyxDQUFBIn0=

package/dist_ts/classes.gitmanager.d.ts

@@ -70,7 +70,22 @@ export declare class GitManager extends plugins.EventEmitter {
      * throws `remoteLimitExceeded`, and nothing is pushed. `remoteUrl` must
      * be `https`, or `http` to a loopback IP address (`127.0.0.0/8`, `[::1]`;
      * never a host name such as `localhost`), without user information; the
-     * credential travels as for `importMirror`. A ref that already holds its
+     * credential travels as for `importMirror`.
+     *
+     * With an `sshKey` credential, and only with one, `remoteUrl` is
+     * `ssh://<user>@<host>[:<port>]/<path>` and the push runs over the system
+     * `ssh` client: the key exists for the push only, as a file readable by the
+     * engine alone, and the remote must present exactly the pinned `hostKey`.
+     * A failure before the remote's ref advertisement throws one of
+     * `sshHostKeyMismatch`, `sshAuthenticationFailed`,
+     * `remoteConnectionRefused`, `remoteConnectionFailed` or
+     * `remoteProtocolError`, and nothing is pushed. An `sshKey` credential
+     * without an `ssh://` URL, an `ssh://` URL without one, and
+     * `caCertificates` with one throw `remoteTransportMismatch` before anything
+     * runs. `remoteMessages` holds the remote's `remote:` lines, such as a
+     * hook's output, for every transport.
+     *
+     * A ref that already holds its
      * `newObjectId` is reported `ok` without its lease being checked; it is not
      * changed, so `ok` never means the lease matched. Any refusal the remote
      * reports per ref returns status `rejected`, with the refused refs `stale`

package/dist_ts/classes.gitmanager.js

@@ -5,23 +5,21 @@ import { runArchiveInspection } from './classes.archiveinspection.js';
 const readinessDefaultTimeoutMs = 2_000;
 const readinessMaximumTimeoutMs = 30_000;
 const remoteTransferMaximumTimeoutMs = 21_600_000;
-/**
- * Checks transfer options before they reach the engine, which answers a
- * malformed credential-bearing request with fixed text only. Messages never
- * quote a credential value.
- */
-const assertRemoteTransferOptions = (optionsArg) => {
-    const { credential, caCertificates, timeoutMs } = optionsArg;
-    if (credential !== undefined) {
-        if (credential === null
-            || typeof credential !== 'object'
-            || credential.kind !== 'basic'
-            || typeof credential.username !== 'string'
-            || typeof credential.password !== 'string'
-            || Object.keys(credential).some((key) => !['kind', 'username', 'password'].includes(key))) {
-            throw new TypeError('credential must be { kind: "basic", username: string, password: string }');
-        }
-    }
+/** Whether `valueArg` is an object with exactly `kind` and the named string fields. */
+const isCredentialShape = (valueArg, kindArg, fieldsArg) => {
+    if (valueArg === null || typeof valueArg !== 'object') {
+        return false;
+    }
+    const record = valueArg;
+    return record.kind === kindArg
+        && fieldsArg.every((field) => typeof record[field] === 'string')
+        && Object.keys(record).every((key) => key === 'kind' || fieldsArg.includes(key));
+};
+const basicCredentialFields = ['username', 'password'];
+const sshKeyCredentialFields = ['privateKey', 'hostKey'];
+/** Checks the CA bundle and the time limit of a remote transfer. */
+const assertTransferLimits = (optionsArg) => {
+    const { caCertificates, timeoutMs } = optionsArg;
     if (caCertificates !== undefined
         && (!Array.isArray(caCertificates) || caCertificates.some((certificate) => typeof certificate !== 'string'))) {
         throw new TypeError('caCertificates must be an array of PEM strings');
@@ -31,6 +29,32 @@ const assertRemoteTransferOptions = (optionsArg) => {
         throw new RangeError(`timeoutMs must be an integer between 1 and ${remoteTransferMaximumTimeoutMs}`);
     }
 };
+/**
+ * Checks transfer options before they reach the engine, which answers a
+ * malformed credential-bearing request with fixed text only. Messages never
+ * quote a credential value.
+ */
+const assertRemoteTransferOptions = (optionsArg) => {
+    const { credential } = optionsArg;
+    if (credential !== undefined && !isCredentialShape(credential, 'basic', basicCredentialFields)) {
+        throw new TypeError('credential must be { kind: "basic", username: string, password: string }');
+    }
+    assertTransferLimits(optionsArg);
+};
+/**
+ * Checks the options of a push, whose credential may also be an SSH key, as
+ * `assertRemoteTransferOptions` does. The engine validates the key, the host
+ * key and the URL.
+ */
+const assertAtomicPushOptions = (requestArg) => {
+    const { credential } = requestArg;
+    if (credential !== undefined
+        && !isCredentialShape(credential, 'basic', basicCredentialFields)
+        && !isCredentialShape(credential, 'sshKey', sshKeyCredentialFields)) {
+        throw new TypeError('credential must be { kind: "basic", username: string, password: string } or { kind: "sshKey", privateKey: string, hostKey: string }');
+    }
+    assertTransferLimits(requestArg);
+};
 /**
  * Checks the shape of push updates before they reach the engine, which
  * answers a malformed request with fixed text only. Ref names and object IDs
@@ -347,7 +371,22 @@ export class GitManager extends plugins.EventEmitter {
      * throws `remoteLimitExceeded`, and nothing is pushed. `remoteUrl` must
      * be `https`, or `http` to a loopback IP address (`127.0.0.0/8`, `[::1]`;
      * never a host name such as `localhost`), without user information; the
-     * credential travels as for `importMirror`. A ref that already holds its
+     * credential travels as for `importMirror`.
+     *
+     * With an `sshKey` credential, and only with one, `remoteUrl` is
+     * `ssh://<user>@<host>[:<port>]/<path>` and the push runs over the system
+     * `ssh` client: the key exists for the push only, as a file readable by the
+     * engine alone, and the remote must present exactly the pinned `hostKey`.
+     * A failure before the remote's ref advertisement throws one of
+     * `sshHostKeyMismatch`, `sshAuthenticationFailed`,
+     * `remoteConnectionRefused`, `remoteConnectionFailed` or
+     * `remoteProtocolError`, and nothing is pushed. An `sshKey` credential
+     * without an `ssh://` URL, an `ssh://` URL without one, and
+     * `caCertificates` with one throw `remoteTransportMismatch` before anything
+     * runs. `remoteMessages` holds the remote's `remote:` lines, such as a
+     * hook's output, for every transport.
+     *
+     * A ref that already holds its
      * `newObjectId` is reported `ok` without its lease being checked; it is not
      * changed, so `ok` never means the lease matched. Any refusal the remote
      * reports per ref returns status `rejected`, with the refused refs `stale`
@@ -365,7 +404,7 @@ export class GitManager extends plugins.EventEmitter {
      */
     async pushRefs(requestArg, optionsArg = {}) {
         this.assertRunning();
-        assertRemoteTransferOptions(requestArg);
+        assertAtomicPushOptions(requestArg);
         assertAtomicPushUpdates(requestArg.updates);
         return this.bridge.pushRefs(requestArg, optionsArg);
     }
@@ -855,4 +894,4 @@ export class GitManager extends plugins.EventEmitter {
         await Promise.all(services.map((service) => service.close()));
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRtYW5hZ2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5naXRtYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBdUR4QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNuRSxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUM3RSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV0RSxNQUFNLHlCQUF5QixHQUFHLEtBQUssQ0FBQztBQUN4QyxNQUFNLHlCQUF5QixHQUFHLE1BQU0sQ0FBQztBQUN6QyxNQUFNLDhCQUE4QixHQUFHLFVBQVUsQ0FBQztBQUVsRDs7OztHQUlHO0FBQ0gsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLFVBQTRDLEVBQVEsRUFBRTtJQUN6RixNQUFNLEVBQUUsVUFBVSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFDN0QsSUFBSSxVQUFVLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDN0IsSUFDRSxVQUFVLEtBQUssSUFBSTtlQUNoQixPQUFPLFVBQVUsS0FBSyxRQUFRO2VBQzlCLFVBQVUsQ0FBQyxJQUFJLEtBQUssT0FBTztlQUMzQixPQUFPLFVBQVUsQ0FBQyxRQUFRLEtBQUssUUFBUTtlQUN2QyxPQUFPLFVBQVUsQ0FBQyxRQUFRLEtBQUssUUFBUTtlQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQ3pGLENBQUM7WUFDRCxNQUFNLElBQUksU0FBUyxDQUFDLDBFQUEwRSxDQUFDLENBQUM7UUFDbEcsQ0FBQztJQUNILENBQUM7SUFDRCxJQUNFLGNBQWMsS0FBSyxTQUFTO1dBQ3pCLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxJQUFJLGNBQWMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLE9BQU8sV0FBVyxLQUFLLFFBQVEsQ0FBQyxDQUFDLEVBQzVHLENBQUM7UUFDRCxNQUFNLElBQUksU0FBUyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQ0UsU0FBUyxLQUFLLFNBQVM7V0FDcEIsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxHQUFHLENBQUMsSUFBSSxTQUFTLEdBQUcsOEJBQThCLENBQUMsRUFDcEcsQ0FBQztRQUNELE1BQU0sSUFBSSxVQUFVLENBQUMsOENBQThDLDhCQUE4QixFQUFFLENBQUMsQ0FBQztJQUN2RyxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxVQUFtQixFQUFRLEVBQUU7SUFDNUQsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQVcsRUFBRSxDQUFDLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDO0lBQzNHLElBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztXQUN2QixVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBZSxFQUFFLEVBQUU7WUFDckMsSUFBSSxNQUFNLEtBQUssSUFBSSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUNsRCxPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFpQyxDQUFDO1lBQ2pELE9BQU8sT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7bUJBQ2hDLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUFDO21CQUM3QyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUM7bUJBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLHFCQUFxQixFQUFFLGFBQWEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3ZHLENBQUMsQ0FBQyxFQUNGLENBQUM7UUFDRCxNQUFNLElBQUksU0FBUyxDQUNqQiw2R0FBNkcsQ0FDOUcsQ0FBQztJQUNKLENBQUM7QUFDSCxDQUFDLENBQUM7QUFLRixNQUFNLE9BQU8sVUFBVyxTQUFRLE9BQU8sQ0FBQyxZQUFZO0lBY2xELFlBQVksVUFBVSxHQUF1QixFQUFFO1FBQzdDLEtBQUssRUFBRSxDQUFDO1FBZEYsV0FBTSxHQUFHLElBQUksb0JBQW9CLEVBQUUsQ0FBQztRQUNwQyxZQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ2hCLGlCQUFZLEdBQXlCLElBQUksQ0FBQztRQUMxQyxrQkFBYSxHQUFHLEtBQUssQ0FBQztRQUN0QixnQkFBVyxHQUF5QixJQUFJLENBQUM7UUFFaEMsdUJBQWtCLEdBQUcsSUFBSSxHQUFHLEVBQStCLENBQUM7UUFDNUQsdUJBQWtCLEdBQUcsSUFBSSxHQUFHLEVBQXFDLENBQUM7UUFDM0UsbUJBQWMsR0FBRyxDQUFDLENBQUM7UUFDbkIsc0JBQWlCLEdBQWtCLElBQUksQ0FBQztRQUMvQiwrQkFBMEIsR0FBRyxJQUFJLEdBQUcsRUFBbUIsQ0FBQztRQUNqRSxpQ0FBNEIsR0FBcUQsSUFBSSxDQUFDO1FBSTVGLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxPQUFPO2VBQzdCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsRUFBRSxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDakUsTUFBTSxnQkFBZ0IsR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDO1FBQzlDLElBQUksQ0FBQyxNQUFNLEdBQUc7WUFDWixPQUFPO1lBQ1AsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFdBQVcsQ0FBQztZQUM5RSxjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWMsSUFBSSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO1lBQ25FLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZSxJQUFJLEdBQUcsR0FBRyxJQUFJLEdBQUcsSUFBSTtZQUNoRSx3QkFBd0IsRUFDdEIsVUFBVSxDQUFDLHdCQUF3QixJQUFJLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7WUFDaEUsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLGlCQUFpQixJQUFJLFNBQVM7WUFDNUQsU0FBUyxFQUFFLGdCQUFnQixJQUFJLGdCQUFnQixDQUFDLE9BQU8sS0FBSyxLQUFLO2dCQUMvRCxDQUFDLENBQUM7b0JBQ0UsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVcsSUFBSSxXQUFXO29CQUN4RCxJQUFJLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxJQUFJLENBQUM7b0JBQ2hDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLHNCQUFzQixJQUFJLEtBQUs7b0JBQ3hFLG9CQUFvQixFQUFFLGdCQUFnQixDQUFDLG9CQUFvQixJQUFJLEtBQUs7b0JBQ3BFLG1CQUFtQixFQUFFLGdCQUFnQixDQUFDLG1CQUFtQixFQUFFLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQzt3QkFDOUUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO3dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7cUJBQ3RCLENBQUMsQ0FBQyxJQUFJLEVBQUU7b0JBQ1Qsc0JBQXNCLEVBQUUsZ0JBQWdCLENBQUMsc0JBQXNCLElBQUksRUFBRTtvQkFDckUsbUJBQW1CLEVBQUUsZ0JBQWdCLENBQUMsbUJBQW1CLElBQUksRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO29CQUM3RSxxQkFBcUIsRUFBRSxnQkFBZ0IsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQ2hGLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQzdFLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtvQkFDckUsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksR0FBRztvQkFDOUQsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksTUFBTTtvQkFDakUsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVc7MkJBQ3BDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxPQUFPLEtBQUssS0FBSzt3QkFDakQsQ0FBQyxDQUFDOzRCQUNFLG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1CO3lCQUNuRDt3QkFDSCxDQUFDLENBQUMsU0FBUztvQkFDYixXQUFXLEVBQUUsZ0JBQWdCLENBQUMsV0FBVzsyQkFDcEMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLE9BQU8sS0FBSyxLQUFLO3dCQUNqRCxDQUFDLENBQUM7NEJBQ0UsbUJBQW1CLEVBQ2pCLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxtQkFBbUI7NEJBQ2xELG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1CO21DQUM3QyxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO3lCQUM1Qjt3QkFDSCxDQUFDLENBQUMsU0FBUztpQkFDZDtnQkFDSCxDQUFDLENBQUMsU0FBUztTQUNkLENBQUM7UUFDRixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNyQixJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDdEIsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQztZQUM5QixJQUFJLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztZQUNsQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDbEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFFRCxJQUFJLENBQUMsYUFBYSxHQUFHLEtBQUssQ0FBQztRQUMzQixJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQzFCLENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBQzNCLENBQUM7SUFDSCxDQUFDO0lBRU0sSUFBSTtRQUNULElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3JCLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMxQixDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3hDLElBQUksQ0FBQyxXQUFXLEdBQUcsV0FBVyxDQUFDO1FBQy9CLEtBQUssV0FBVyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDNUIsSUFBSSxJQUFJLENBQUMsV0FBVyxLQUFLLFdBQVcsRUFBRSxDQUFDO2dCQUNyQyxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztZQUMxQixDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFCLE9BQU8sV0FBVyxDQUFDO0lBQ3JCLENBQUM7SUFFTyxLQUFLLENBQUMsWUFBWTtRQUN4QixJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztRQUMxQixJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQztRQUM5QixJQUFJLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztRQUNsQyxJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxDQUFDLHVCQUF1QixFQUFFLENBQUM7WUFDckMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3JCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsdUJBQXVCLEVBQUUsQ0FBQztZQUNyQyxNQUFNLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNyQyxDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7UUFDdkIsQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsU0FBUztRQUNwQixJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixPQUFPO2dCQUNMLE9BQU8sRUFBRSxLQUFLO2dCQUNkLE9BQU8sRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87Z0JBQzVCLFFBQVEsRUFBRSxDQUFDO2FBQ1osQ0FBQztRQUNKLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDakMsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxjQUFjLENBQ3pCLFVBQVUsR0FBZ0MsRUFBRTtRQUU1QyxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDcEMsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFNBQVMsSUFBSSx5QkFBeUIsQ0FBQztRQUNwRSxJQUNFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7WUFDaEMsU0FBUyxJQUFJLENBQUM7WUFDZCxTQUFTLEdBQUcseUJBQXlCLEVBQ3JDLENBQUM7WUFDRCxNQUFNLElBQUksU0FBUyxDQUNqQix1RUFBdUUseUJBQXlCLEdBQUcsQ0FDcEcsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ3ZDLElBQUksWUFBWSxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzFCLE9BQU8sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsTUFBTSxlQUFlLEdBQUcsSUFBSSxDQUFDLDJCQUEyQixFQUFFLENBQUM7UUFDM0QsSUFBSSxlQUFlLEVBQUUsQ0FBQztZQUNwQixPQUFPLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxlQUFlLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUM7UUFDM0MsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO1FBQ2xELElBQUksV0FBd0QsQ0FBQztRQUM3RCxNQUFNLGNBQWMsR0FBRyxHQUFTLEVBQUU7WUFDaEMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNqQixXQUFXLEdBQUcsUUFBUSxDQUFDO1lBQ3pCLENBQUM7WUFDRCxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM5QixDQUFDLENBQUM7UUFDRixZQUFZLEVBQUUsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLGNBQWMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUU7WUFDcEMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNqQixXQUFXLEdBQUcsVUFBVSxDQUFDO1lBQzNCLENBQUM7WUFDRCxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM5QixDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDZCxJQUFJLENBQUMsMEJBQTBCLENBQUMsR0FBRyxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFFekQsSUFBSSxZQUE4QyxDQUFDO1FBQ25ELElBQUksQ0FBQztZQUNILFlBQVksR0FBRyxJQUFJLENBQUMsaUJBQWlCO2dCQUNuQyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQzdCLElBQUksQ0FBQyxpQkFBaUIsRUFDdEIsbUJBQW1CLENBQUMsTUFBTSxDQUMzQjtnQkFDSCxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMscUJBQXFCLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkUsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQzVCLFlBQVksRUFBRSxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDM0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxjQUFjLEtBQUssY0FBYyxFQUFFLENBQUM7WUFDM0MsT0FBTyxJQUFJLENBQUMsc0JBQXNCLENBQ2hDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxJQUFJLGFBQWEsRUFDbkQsU0FBUyxDQUNWLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDL0IsSUFBSSxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzdCLE9BQU8sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsSUFBSSxXQUFXLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUMsc0JBQXNCLENBQUMsYUFBYSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLFlBQVksS0FBSyxhQUFhLEVBQUUsQ0FBQztZQUNuQyxPQUFPLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELE9BQU87WUFDTCxLQUFLLEVBQUUsSUFBSTtZQUNYLE1BQU0sRUFBRSxPQUFPO1lBQ2YsVUFBVSxFQUFFLFdBQVcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxTQUFTO1NBQzFDLENBQUM7SUFDSixDQUFDO0lBRU0sS0FBSyxDQUFDLDRCQUE0QixDQUN2QyxTQUErQztRQUUvQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLDRCQUE0QixDQUFDO1lBQzlDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxvQkFBb0I7WUFDcEQsbUJBQW1CLEVBQUUsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDdEUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO2dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7YUFDdEIsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FDM0MsYUFBdUQ7UUFFdkQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQ0FBZ0MsQ0FBQztZQUNsRCxHQUFHLEVBQUUsYUFBYSxDQUFDLEdBQUc7WUFDdEIsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO1lBQ3hCLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtZQUM1QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7U0FDakMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxtQ0FBbUMsQ0FDOUMsZ0JBQTZEO1FBRTdELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsbUNBQW1DLENBQUM7WUFDckQsR0FBRyxFQUFFLGdCQUFnQixDQUFDLEdBQUc7WUFDekIsSUFBSSxFQUFFLGdCQUFnQixDQUFDLElBQUk7WUFDM0IsUUFBUSxFQUFFLGdCQUFnQixDQUFDLFFBQVE7WUFDbkMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzNDLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztnQkFDckIsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO2dCQUMvQixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7Z0JBQy9CLGdCQUFnQixFQUFFLElBQUksQ0FBQyxnQkFBZ0I7YUFDeEMsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxVQUFnRDtRQUM5RSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFRDs7Ozs7Ozs7Ozs7OztPQWFHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FDdkIsVUFBMEMsRUFDMUMsVUFBVSxHQUFzQyxFQUFFO1FBRWxELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQiwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7OztPQVlHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FDeEIsVUFBMkMsRUFDM0MsVUFBVSxHQUFzQyxFQUFFO1FBRWxELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQiwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUMzRCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQXdCRztJQUNJLEtBQUssQ0FBQyxRQUFRLENBQ25CLFVBQXdDLEVBQ3hDLFVBQVUsR0FBc0MsRUFBRTtRQUVsRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsMkJBQTJCLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDeEMsdUJBQXVCLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O09Bd0JHO0lBQ0ksS0FBSyxDQUFDLDJCQUEyQixDQUN0QyxVQUFvRDtRQUVwRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsdUJBQXVCLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQywyQkFBMkIsQ0FBQztZQUM3QyxHQUFHLEVBQUUsVUFBVSxDQUFDLEdBQUc7WUFDbkIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO1lBQ3JCLEtBQUssRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDckMsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO2dCQUNyQixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7Z0JBQy9CLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDL0IsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGdCQUFnQjthQUN4QyxDQUFDLENBQUM7WUFDSCxPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzNDLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztnQkFDZixtQkFBbUIsRUFBRSxNQUFNLENBQUMsbUJBQW1CO2dCQUMvQyxXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7YUFDaEMsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsZ0JBQWdCLENBQzNCLFVBQThDO1FBRTlDLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVELGlFQUFpRTtJQUMxRCxLQUFLLENBQUMsaUJBQWlCLENBQUMsVUFBeUM7UUFDdEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFVBQXlDO1FBQ3JFLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLHNCQUFzQixDQUNqQyxVQUF5QztRQUV6QyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHNCQUFzQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFTSxLQUFLLENBQUMsdUJBQXVCLENBQ2xDLFVBQStDLEVBQy9DLFVBQVUsR0FBd0MsRUFBRTtRQUVwRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FtQkc7SUFDSSxLQUFLLENBQUMscUJBQXFCLENBQ2hDLFVBQStDO1FBRS9DLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDO1FBQ3pDLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxPQUFPLEtBQUssY0FBYztZQUN6RCxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUU7WUFDN0IsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUNkLElBQUksT0FBb0MsQ0FBQztRQUN6QyxJQUFJLENBQUM7WUFDSCxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsd0JBQXdCLENBQUM7Z0JBQzVELEdBQUcsRUFBRSxVQUFVLENBQUMsR0FBRztnQkFDbkIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO2dCQUNyQixPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQU87Z0JBQzNCLEdBQUcsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDakUsR0FBRyxDQUFDLGFBQWEsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQzthQUMxRCxDQUFDLENBQUM7WUFDSCxJQUNFLElBQUksQ0FBQyxjQUFjLEtBQUssWUFBWTttQkFDakMsSUFBSSxDQUFDLGFBQWE7bUJBQ2xCLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFDaEIsQ0FBQztnQkFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7WUFDM0UsQ0FBQztZQUNELElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxhQUFhLEVBQUUsQ0FBQztnQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO1lBQ2xGLENBQUM7WUFDRCxPQUFPLEdBQUcsSUFBSSwyQkFBMkIsQ0FDdkMsVUFBVSxFQUNWLFVBQVUsRUFDVixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FDcEIsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxhQUFhLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ2hDLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUNELE1BQU0sTUFBTSxJQUFJLENBQUMsbUJBQW1CLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JDLE9BQU8sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtZQUM3QixJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMxQixPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxXQUFtQixFQUFFLFFBQWlCO1FBQ3RFLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLHdCQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ2pELE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO1lBQ3RCLElBQUksUUFBUSxZQUFZLEtBQUssSUFBSSxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM5RCxRQUFRLENBQUMsS0FBSyxHQUFHLFlBQVksQ0FBQztnQkFDOUIsT0FBTyxRQUFRLENBQUM7WUFDbEIsQ0FBQztZQUNELE9BQU8sSUFBSSxjQUFjLENBQ3ZCLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxFQUN4Qiw4RUFBOEUsRUFDOUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQ3BCLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsV0FBbUI7UUFDdkQsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNwQyxNQUFNLElBQUksU0FBUyxDQUFDLDJCQUEyQixDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3pCLE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLHVCQUF1QixDQUNsQyxVQUEyQztRQUUzQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0ksS0FBSyxDQUFDLGlCQUFpQixDQUM1QixVQUErQztRQUUvQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFTSxLQUFLLENBQUMsZ0JBQWdCO1FBQzNCLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztJQUN4QyxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsUUFBUSxDQUNuQixVQUFpQztRQUVqQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksS0FBSyxDQUFDLHlCQUF5QixDQUNwQyxVQUF5QztRQUV6QyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFTSxLQUFLLENBQUMsZUFBZSxDQUMxQixVQUFtQztRQUVuQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBRU0sS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUFrQztRQUN0RCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUFzQztRQUMxRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsVUFBVSxDQUFDLFVBQXNDO1FBQzVELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0ksS0FBSyxDQUFDLGNBQWMsQ0FDekIsVUFBK0MsRUFDL0MsVUFBVSxHQUF3QyxFQUFFO1FBRXBELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixNQUFNLFVBQVUsR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sWUFBWSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7UUFDdkMsTUFBTSxjQUFjLEdBQUcsR0FBUyxFQUFFO1lBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLENBQUMsQ0FBQztRQUNGLElBQUksWUFBWSxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzFCLE1BQU0sWUFBWSxDQUFDLE1BQU0sQ0FBQztRQUM1QixDQUFDO1FBQ0QsWUFBWSxFQUFFLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxjQUFjLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN4RSxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO1lBQzlELE9BQU8sb0JBQW9CLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDekUsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sVUFBVSxDQUFDO1FBQzFCLENBQUM7Z0JBQVMsQ0FBQztZQUNULFlBQVksRUFBRSxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDM0QsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM3QyxDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQUMsVUFBeUM7UUFDaEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTLENBQUMsVUFBb0M7UUFDekQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBa0M7UUFDckQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBc0M7UUFDMUQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBaUM7UUFDbkQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVPLEtBQUssQ0FBQyxhQUFhO1FBQ3pCLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQy9DLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUN2QixJQUFJLENBQUM7b0JBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO2dCQUNyQyxDQUFDO3dCQUFTLENBQUM7b0JBQ1QsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUM5QixJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztnQkFDdkIsQ0FBQztnQkFDRCxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7WUFDcEQsQ0FBQztZQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ3BCLE1BQU0sSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7UUFDeEMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDckIsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyx3QkFBd0I7UUFDcEMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDM0IsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDakUsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQztRQUNoQyxDQUFDO0lBQ0gsQ0FBQztJQUVPLHdCQUF3QixDQUFDLFNBQTRCO1FBQzNELE1BQU0sZUFBZSxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUM7UUFDNUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxPQUFPLElBQUksQ0FBQyxlQUFlLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDMUQsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxPQUFZLENBQUM7UUFDakIsSUFBSSxDQUFDO1lBQ0gsT0FBTyxHQUFHLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE9BQU8sQ0FBQyxRQUFRLEdBQUcsV0FBVyxDQUFDO1FBQ2pDLENBQUM7YUFBTSxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDcEUsT0FBTyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUM7UUFDN0IsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7UUFDbEMsTUFBTSxVQUFVLEdBQ2QsUUFBUSxLQUFLLFdBQVc7WUFDeEIsUUFBUSxLQUFLLEtBQUs7WUFDbEIsUUFBUSxLQUFLLE9BQU87WUFDcEIsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDO0lBQ3hCLENBQUM7SUFFTyxvQkFBb0IsQ0FDMUIsV0FBbUIsRUFDbkIsU0FBc0I7UUFFdEIsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFO1lBQzdCLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNwQixJQUFJLGFBQXFELENBQUM7WUFDMUQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxVQUE0QyxFQUFRLEVBQUU7Z0JBQ3BFLElBQUksT0FBTyxFQUFFLENBQUM7b0JBQ1osT0FBTztnQkFDVCxDQUFDO2dCQUNELE9BQU8sR0FBRyxJQUFJLENBQUM7Z0JBQ2YsU0FBUyxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQztnQkFDbkQsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ3RCLENBQUMsQ0FBQztZQUNGLE1BQU0sVUFBVSxHQUFHLEdBQVMsRUFBRTtnQkFDNUIsYUFBYSxFQUFFLE9BQU8sRUFBRSxDQUFDO2dCQUN6QixNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDcEIsQ0FBQyxDQUFDO1lBQ0YsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNoRSxJQUFJLFNBQVMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDdEIsVUFBVSxFQUFFLENBQUM7Z0JBQ2IsT0FBTztZQUNULENBQUM7WUFDRCxJQUFJLENBQUM7Z0JBQ0gsYUFBYSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUNsQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQ2hDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEVBQy9CLENBQUMsUUFBUSxFQUFFLEVBQUU7b0JBQ1gsTUFBTSxPQUFPLEdBQ1gsUUFBUSxDQUFDLFVBQVUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDO29CQUN4RCxnRUFBZ0U7b0JBQ2hFLCtEQUErRDtvQkFDL0QsYUFBYSxFQUFFLE9BQU8sRUFBRSxDQUFDO29CQUN6QixNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7Z0JBQ2xCLENBQUMsQ0FDRixDQUFDO2dCQUNGLGFBQWEsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO2dCQUN2RCxhQUFhLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDdEIsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDeEIsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLHFCQUFxQixDQUMzQixTQUFzQjtRQUV0QixJQUFJLENBQUMsSUFBSSxDQUFDLDRCQUE0QixFQUFFLENBQUM7WUFDdkMsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQztZQUN2QyxNQUFNLGVBQWUsR0FBRyxJQUFJLENBQUMsTUFBTTtpQkFDaEMsU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLHlCQUF5QixFQUFFLENBQUM7aUJBQ25ELElBQUksQ0FDSCxDQUFDLE1BQU0sRUFBb0MsRUFBRTtnQkFDM0MsSUFDRSxJQUFJLENBQUMsY0FBYyxLQUFLLFVBQVU7b0JBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUztvQkFDckIsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEVBQ3ZCLENBQUM7b0JBQ0QsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDakUsQ0FBQztnQkFDRCxPQUFPLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDO1lBQ2xELENBQUMsRUFDRCxHQUFxQyxFQUFFLENBQUMsYUFBYSxDQUN0RCxDQUFDO1lBQ0osSUFBSSxDQUFDLDRCQUE0QixHQUFHLGVBQWUsQ0FBQztZQUNwRCxLQUFLLGVBQWUsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO2dCQUNoQyxJQUFJLElBQUksQ0FBQyw0QkFBNEIsS0FBSyxlQUFlLEVBQUUsQ0FBQztvQkFDMUQsSUFBSSxDQUFDLDRCQUE0QixHQUFHLElBQUksQ0FBQztnQkFDM0MsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyw0QkFBNEIsQ0FBQztRQUN0RCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7WUFDN0IsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3BCLE1BQU0sTUFBTSxHQUFHLENBQUMsVUFBNEMsRUFBUSxFQUFFO2dCQUNwRSxJQUFJLE9BQU8sRUFBRSxDQUFDO29CQUNaLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxPQUFPLEdBQUcsSUFBSSxDQUFDO2dCQUNmLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7Z0JBQ2xELE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUN0QixDQUFDLENBQUM7WUFDRixNQUFNLFNBQVMsR0FBRyxHQUFTLEVBQUU7Z0JBQzNCLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNwQixDQUFDLENBQUM7WUFDRixTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQy9ELElBQUksU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUN0QixTQUFTLEVBQUUsQ0FBQztnQkFDWixPQUFPO1lBQ1QsQ0FBQztZQUNELEtBQUssV0FBVyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoQyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTywyQkFBMkI7UUFNakMsSUFBSSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDdEIsT0FBTyxVQUFVLENBQUM7UUFDcEIsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbEIsT0FBTyxhQUFhLENBQUM7UUFDdkIsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLE9BQU8sVUFBVSxDQUFDO1FBQ3BCLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRU8sc0JBQXNCLENBQzVCLFNBQTRDLEVBQzVDLFlBQW9CO1FBRXBCLE9BQU87WUFDTCxLQUFLLEVBQUUsS0FBSztZQUNaLE1BQU0sRUFBRSxhQUFhO1lBQ3JCLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxFQUFFLEdBQUcsWUFBWTtTQUM3QyxDQUFDO0lBQ0osQ0FBQztJQUVPLDBCQUEwQjtRQUNoQyxLQUFLLE1BQU0sbUJBQW1CLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLENBQUM7WUFDdkUsbUJBQW1CLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDOUIsQ0FBQztJQUNILENBQUM7SUFFTyxhQUFhO1FBQ25CLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksS0FBSyxDQUFDLDJCQUEyQixDQUFDLENBQUM7UUFDL0MsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsdUJBQXVCO1FBQ25DLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNqRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDaEMsS0FBSyxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUM7WUFDdkMsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBRU8sS0FBSyxDQUFDLHVCQUF1QjtRQUNuQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2hDLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRtYW5hZ2VyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvY2xhc3Nlcy5naXRtYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sY0FBYyxDQUFDO0FBdUR4QyxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUNuRSxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUM3RSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxnQ0FBZ0MsQ0FBQztBQUV0RSxNQUFNLHlCQUF5QixHQUFHLEtBQUssQ0FBQztBQUN4QyxNQUFNLHlCQUF5QixHQUFHLE1BQU0sQ0FBQztBQUN6QyxNQUFNLDhCQUE4QixHQUFHLFVBQVUsQ0FBQztBQUVsRCx1RkFBdUY7QUFDdkYsTUFBTSxpQkFBaUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFFLFNBQW1CLEVBQVcsRUFBRTtJQUM3RixJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDdEQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsUUFBbUMsQ0FBQztJQUNuRCxPQUFPLE1BQU0sQ0FBQyxJQUFJLEtBQUssT0FBTztXQUN6QixTQUFTLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxPQUFPLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxRQUFRLENBQUM7V0FDN0QsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLEdBQUcsS0FBSyxNQUFNLElBQUksU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO0FBQ3JGLENBQUMsQ0FBQztBQUVGLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxVQUFVLEVBQUUsVUFBVSxDQUFDLENBQUM7QUFDdkQsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLFlBQVksRUFBRSxTQUFTLENBQUMsQ0FBQztBQUV6RCxvRUFBb0U7QUFDcEUsTUFBTSxvQkFBb0IsR0FBRyxDQUMzQixVQUFrRixFQUM1RSxFQUFFO0lBQ1IsTUFBTSxFQUFFLGNBQWMsRUFBRSxTQUFTLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFDakQsSUFDRSxjQUFjLEtBQUssU0FBUztXQUN6QixDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsSUFBSSxjQUFjLENBQUMsSUFBSSxDQUFDLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxPQUFPLFdBQVcsS0FBSyxRQUFRLENBQUMsQ0FBQyxFQUM1RyxDQUFDO1FBQ0QsTUFBTSxJQUFJLFNBQVMsQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxJQUNFLFNBQVMsS0FBSyxTQUFTO1dBQ3BCLENBQUMsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLFNBQVMsR0FBRyxDQUFDLElBQUksU0FBUyxHQUFHLDhCQUE4QixDQUFDLEVBQ3BHLENBQUM7UUFDRCxNQUFNLElBQUksVUFBVSxDQUFDLDhDQUE4Qyw4QkFBOEIsRUFBRSxDQUFDLENBQUM7SUFDdkcsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSCxNQUFNLDJCQUEyQixHQUFHLENBQUMsVUFBNEMsRUFBUSxFQUFFO0lBQ3pGLE1BQU0sRUFBRSxVQUFVLEVBQUUsR0FBRyxVQUFVLENBQUM7SUFDbEMsSUFBSSxVQUFVLEtBQUssU0FBUyxJQUFJLENBQUMsaUJBQWlCLENBQUMsVUFBVSxFQUFFLE9BQU8sRUFBRSxxQkFBcUIsQ0FBQyxFQUFFLENBQUM7UUFDL0YsTUFBTSxJQUFJLFNBQVMsQ0FBQywwRUFBMEUsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7SUFDRCxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRjs7OztHQUlHO0FBQ0gsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFVBQXdDLEVBQVEsRUFBRTtJQUNqRixNQUFNLEVBQUUsVUFBVSxFQUFFLEdBQUcsVUFBVSxDQUFDO0lBQ2xDLElBQ0UsVUFBVSxLQUFLLFNBQVM7V0FDckIsQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLEVBQUUsT0FBTyxFQUFFLHFCQUFxQixDQUFDO1dBQzlELENBQUMsaUJBQWlCLENBQUMsVUFBVSxFQUFFLFFBQVEsRUFBRSxzQkFBc0IsQ0FBQyxFQUNuRSxDQUFDO1FBQ0QsTUFBTSxJQUFJLFNBQVMsQ0FDakIscUlBQXFJLENBQ3RJLENBQUM7SUFDSixDQUFDO0lBQ0Qsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBRUY7Ozs7R0FJRztBQUNILE1BQU0sdUJBQXVCLEdBQUcsQ0FBQyxVQUFtQixFQUFRLEVBQUU7SUFDNUQsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFFBQWlCLEVBQVcsRUFBRSxDQUFDLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxDQUFDO0lBQzNHLElBQ0UsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztXQUN2QixVQUFVLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBZSxFQUFFLEVBQUU7WUFDckMsSUFBSSxNQUFNLEtBQUssSUFBSSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsRUFBRSxDQUFDO2dCQUNsRCxPQUFPLElBQUksQ0FBQztZQUNkLENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFpQyxDQUFDO1lBQ2pELE9BQU8sT0FBTyxNQUFNLENBQUMsR0FBRyxLQUFLLFFBQVE7bUJBQ2hDLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUFDO21CQUM3QyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUM7bUJBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsS0FBSyxFQUFFLHFCQUFxQixFQUFFLGFBQWEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQ3ZHLENBQUMsQ0FBQyxFQUNGLENBQUM7UUFDRCxNQUFNLElBQUksU0FBUyxDQUNqQiw2R0FBNkcsQ0FDOUcsQ0FBQztJQUNKLENBQUM7QUFDSCxDQUFDLENBQUM7QUFLRixNQUFNLE9BQU8sVUFBVyxTQUFRLE9BQU8sQ0FBQyxZQUFZO0lBY2xELFlBQVksVUFBVSxHQUF1QixFQUFFO1FBQzdDLEtBQUssRUFBRSxDQUFDO1FBZEYsV0FBTSxHQUFHLElBQUksb0JBQW9CLEVBQUUsQ0FBQztRQUNwQyxZQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ2hCLGlCQUFZLEdBQXlCLElBQUksQ0FBQztRQUMxQyxrQkFBYSxHQUFHLEtBQUssQ0FBQztRQUN0QixnQkFBVyxHQUF5QixJQUFJLENBQUM7UUFFaEMsdUJBQWtCLEdBQUcsSUFBSSxHQUFHLEVBQStCLENBQUM7UUFDNUQsdUJBQWtCLEdBQUcsSUFBSSxHQUFHLEVBQXFDLENBQUM7UUFDM0UsbUJBQWMsR0FBRyxDQUFDLENBQUM7UUFDbkIsc0JBQWlCLEdBQWtCLElBQUksQ0FBQztRQUMvQiwrQkFBMEIsR0FBRyxJQUFJLEdBQUcsRUFBbUIsQ0FBQztRQUNqRSxpQ0FBNEIsR0FBcUQsSUFBSSxDQUFDO1FBSTVGLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxPQUFPO2VBQzdCLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUUsRUFBRSxRQUFRLEVBQUUsWUFBWSxDQUFDLENBQUM7UUFDakUsTUFBTSxnQkFBZ0IsR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDO1FBQzlDLElBQUksQ0FBQyxNQUFNLEdBQUc7WUFDWixPQUFPO1lBQ1AsV0FBVyxFQUFFLFVBQVUsQ0FBQyxXQUFXLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLFdBQVcsQ0FBQztZQUM5RSxjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWMsSUFBSSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO1lBQ25FLGVBQWUsRUFBRSxVQUFVLENBQUMsZUFBZSxJQUFJLEdBQUcsR0FBRyxJQUFJLEdBQUcsSUFBSTtZQUNoRSx3QkFBd0IsRUFDdEIsVUFBVSxDQUFDLHdCQUF3QixJQUFJLEVBQUUsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7WUFDaEUsaUJBQWlCLEVBQUUsVUFBVSxDQUFDLGlCQUFpQixJQUFJLFNBQVM7WUFDNUQsU0FBUyxFQUFFLGdCQUFnQixJQUFJLGdCQUFnQixDQUFDLE9BQU8sS0FBSyxLQUFLO2dCQUMvRCxDQUFDLENBQUM7b0JBQ0UsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVcsSUFBSSxXQUFXO29CQUN4RCxJQUFJLEVBQUUsZ0JBQWdCLENBQUMsSUFBSSxJQUFJLENBQUM7b0JBQ2hDLHNCQUFzQixFQUFFLGdCQUFnQixDQUFDLHNCQUFzQixJQUFJLEtBQUs7b0JBQ3hFLG9CQUFvQixFQUFFLGdCQUFnQixDQUFDLG9CQUFvQixJQUFJLEtBQUs7b0JBQ3BFLG1CQUFtQixFQUFFLGdCQUFnQixDQUFDLG1CQUFtQixFQUFFLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQzt3QkFDOUUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO3dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7cUJBQ3RCLENBQUMsQ0FBQyxJQUFJLEVBQUU7b0JBQ1Qsc0JBQXNCLEVBQUUsZ0JBQWdCLENBQUMsc0JBQXNCLElBQUksRUFBRTtvQkFDckUsbUJBQW1CLEVBQUUsZ0JBQWdCLENBQUMsbUJBQW1CLElBQUksRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO29CQUM3RSxxQkFBcUIsRUFBRSxnQkFBZ0IsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQ2hGLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLENBQUMsR0FBRyxJQUFJLEdBQUcsSUFBSSxHQUFHLElBQUk7b0JBQzdFLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLGdCQUFnQixJQUFJLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSTtvQkFDckUsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksR0FBRztvQkFDOUQsa0JBQWtCLEVBQUUsZ0JBQWdCLENBQUMsa0JBQWtCLElBQUksTUFBTTtvQkFDakUsV0FBVyxFQUFFLGdCQUFnQixDQUFDLFdBQVc7MkJBQ3BDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxPQUFPLEtBQUssS0FBSzt3QkFDakQsQ0FBQyxDQUFDOzRCQUNFLG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1CO3lCQUNuRDt3QkFDSCxDQUFDLENBQUMsU0FBUztvQkFDYixXQUFXLEVBQUUsZ0JBQWdCLENBQUMsV0FBVzsyQkFDcEMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLE9BQU8sS0FBSyxLQUFLO3dCQUNqRCxDQUFDLENBQUM7NEJBQ0UsbUJBQW1CLEVBQ2pCLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxtQkFBbUI7NEJBQ2xELG1CQUFtQixFQUNqQixnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsbUJBQW1CO21DQUM3QyxDQUFDLEdBQUcsSUFBSSxHQUFHLElBQUksR0FBRyxJQUFJO3lCQUM1Qjt3QkFDSCxDQUFDLENBQUMsU0FBUztpQkFDZDtnQkFDSCxDQUFDLENBQUMsU0FBUztTQUNkLENBQUM7UUFDRixJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxJQUFtQixFQUFFLE1BQXFCLEVBQUUsRUFBRTtZQUNwRSxJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNyQixJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDdEIsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQztZQUM5QixJQUFJLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztZQUNsQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDbEMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUN4QyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsQ0FBQztRQUM1QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNqQixNQUFNLElBQUksS0FBSyxDQUFDLCtCQUErQixDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3RCLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDckIsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQzVDLENBQUM7UUFFRCxJQUFJLENBQUMsYUFBYSxHQUFHLEtBQUssQ0FBQztRQUMzQixJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLFlBQVksR0FBRyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDekMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDO1FBQzFCLENBQUM7Z0JBQVMsQ0FBQztZQUNULElBQUksQ0FBQyxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBQzNCLENBQUM7SUFDSCxDQUFDO0lBRU0sSUFBSTtRQUNULElBQUksSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ3JCLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQztRQUMxQixDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3hDLElBQUksQ0FBQyxXQUFXLEdBQUcsV0FBVyxDQUFDO1FBQy9CLEtBQUssV0FBVyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDNUIsSUFBSSxJQUFJLENBQUMsV0FBVyxLQUFLLFdBQVcsRUFBRSxDQUFDO2dCQUNyQyxJQUFJLENBQUMsV0FBVyxHQUFHLElBQUksQ0FBQztZQUMxQixDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFCLE9BQU8sV0FBVyxDQUFDO0lBQ3JCLENBQUM7SUFFTyxLQUFLLENBQUMsWUFBWTtRQUN4QixJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztRQUMxQixJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQztRQUM5QixJQUFJLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztRQUNsQyxJQUFJLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ2pELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxDQUFDLHVCQUF1QixFQUFFLENBQUM7WUFDckMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQzlCLElBQUksQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3JCLE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsdUJBQXVCLEVBQUUsQ0FBQztZQUNyQyxNQUFNLElBQUksQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNyQyxDQUFDO2dCQUFTLENBQUM7WUFDVCxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7UUFDdkIsQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsU0FBUztRQUNwQixJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixPQUFPO2dCQUNMLE9BQU8sRUFBRSxLQUFLO2dCQUNkLE9BQU8sRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87Z0JBQzVCLFFBQVEsRUFBRSxDQUFDO2FBQ1osQ0FBQztRQUNKLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7SUFDakMsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxjQUFjLENBQ3pCLFVBQVUsR0FBZ0MsRUFBRTtRQUU1QyxNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDcEMsTUFBTSxTQUFTLEdBQUcsVUFBVSxDQUFDLFNBQVMsSUFBSSx5QkFBeUIsQ0FBQztRQUNwRSxJQUNFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7WUFDaEMsU0FBUyxJQUFJLENBQUM7WUFDZCxTQUFTLEdBQUcseUJBQXlCLEVBQ3JDLENBQUM7WUFDRCxNQUFNLElBQUksU0FBUyxDQUNqQix1RUFBdUUseUJBQXlCLEdBQUcsQ0FDcEcsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ3ZDLElBQUksWUFBWSxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzFCLE9BQU8sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsTUFBTSxlQUFlLEdBQUcsSUFBSSxDQUFDLDJCQUEyQixFQUFFLENBQUM7UUFDM0QsSUFBSSxlQUFlLEVBQUUsQ0FBQztZQUNwQixPQUFPLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxlQUFlLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxjQUFjLENBQUM7UUFDM0MsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO1FBQ2xELElBQUksV0FBd0QsQ0FBQztRQUM3RCxNQUFNLGNBQWMsR0FBRyxHQUFTLEVBQUU7WUFDaEMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNqQixXQUFXLEdBQUcsUUFBUSxDQUFDO1lBQ3pCLENBQUM7WUFDRCxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM5QixDQUFDLENBQUM7UUFDRixZQUFZLEVBQUUsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLGNBQWMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3hFLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUU7WUFDcEMsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNqQixXQUFXLEdBQUcsVUFBVSxDQUFDO1lBQzNCLENBQUM7WUFDRCxtQkFBbUIsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM5QixDQUFDLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDZCxJQUFJLENBQUMsMEJBQTBCLENBQUMsR0FBRyxDQUFDLG1CQUFtQixDQUFDLENBQUM7UUFFekQsSUFBSSxZQUE4QyxDQUFDO1FBQ25ELElBQUksQ0FBQztZQUNILFlBQVksR0FBRyxJQUFJLENBQUMsaUJBQWlCO2dCQUNuQyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQzdCLElBQUksQ0FBQyxpQkFBaUIsRUFDdEIsbUJBQW1CLENBQUMsTUFBTSxDQUMzQjtnQkFDSCxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMscUJBQXFCLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkUsQ0FBQztnQkFBUyxDQUFDO1lBQ1QsWUFBWSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQzVCLFlBQVksRUFBRSxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDM0QsSUFBSSxDQUFDLDBCQUEwQixDQUFDLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxjQUFjLEtBQUssY0FBYyxFQUFFLENBQUM7WUFDM0MsT0FBTyxJQUFJLENBQUMsc0JBQXNCLENBQ2hDLElBQUksQ0FBQywyQkFBMkIsRUFBRSxJQUFJLGFBQWEsRUFDbkQsU0FBUyxDQUNWLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDL0IsSUFBSSxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzdCLE9BQU8sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsSUFBSSxXQUFXLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUMsc0JBQXNCLENBQUMsYUFBYSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLFlBQVksS0FBSyxhQUFhLEVBQUUsQ0FBQztZQUNuQyxPQUFPLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxhQUFhLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELE9BQU87WUFDTCxLQUFLLEVBQUUsSUFBSTtZQUNYLE1BQU0sRUFBRSxPQUFPO1lBQ2YsVUFBVSxFQUFFLFdBQVcsQ0FBQyxHQUFHLEVBQUUsR0FBRyxTQUFTO1NBQzFDLENBQUM7SUFDSixDQUFDO0lBRU0sS0FBSyxDQUFDLDRCQUE0QixDQUN2QyxTQUErQztRQUUvQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLDRCQUE0QixDQUFDO1lBQzlDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxvQkFBb0I7WUFDcEQsbUJBQW1CLEVBQUUsU0FBUyxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDdEUsR0FBRyxFQUFFLFVBQVUsQ0FBQyxHQUFHO2dCQUNuQixJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUk7YUFDdEIsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FDM0MsYUFBdUQ7UUFFdkQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxnQ0FBZ0MsQ0FBQztZQUNsRCxHQUFHLEVBQUUsYUFBYSxDQUFDLEdBQUc7WUFDdEIsSUFBSSxFQUFFLGFBQWEsQ0FBQyxJQUFJO1lBQ3hCLE1BQU0sRUFBRSxhQUFhLENBQUMsTUFBTTtZQUM1QixRQUFRLEVBQUUsYUFBYSxDQUFDLFFBQVE7U0FDakMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxtQ0FBbUMsQ0FDOUMsZ0JBQTZEO1FBRTdELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsbUNBQW1DLENBQUM7WUFDckQsR0FBRyxFQUFFLGdCQUFnQixDQUFDLEdBQUc7WUFDekIsSUFBSSxFQUFFLGdCQUFnQixDQUFDLElBQUk7WUFDM0IsUUFBUSxFQUFFLGdCQUFnQixDQUFDLFFBQVE7WUFDbkMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzNDLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztnQkFDckIsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZO2dCQUMvQixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7Z0JBQy9CLGdCQUFnQixFQUFFLElBQUksQ0FBQyxnQkFBZ0I7YUFDeEMsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVELElBQVcsT0FBTztRQUNoQixPQUFPLElBQUksQ0FBQyxPQUFPLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxVQUFnRDtRQUM5RSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGtCQUFrQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFFRDs7Ozs7Ozs7Ozs7OztPQWFHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FDdkIsVUFBMEMsRUFDMUMsVUFBVSxHQUFzQyxFQUFFO1FBRWxELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQiwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7OztPQVlHO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FDeEIsVUFBMkMsRUFDM0MsVUFBVSxHQUFzQyxFQUFFO1FBRWxELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQiwyQkFBMkIsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4QyxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUMzRCxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQXVDRztJQUNJLEtBQUssQ0FBQyxRQUFRLENBQ25CLFVBQXdDLEVBQ3hDLFVBQVUsR0FBc0MsRUFBRTtRQUVsRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsdUJBQXVCLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDcEMsdUJBQXVCLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxFQUFFLFVBQVUsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O09Bd0JHO0lBQ0ksS0FBSyxDQUFDLDJCQUEyQixDQUN0QyxVQUFvRDtRQUVwRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsdUJBQXVCLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQywyQkFBMkIsQ0FBQztZQUM3QyxHQUFHLEVBQUUsVUFBVSxDQUFDLEdBQUc7WUFDbkIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO1lBQ3JCLEtBQUssRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDckMsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPO2dCQUNyQixZQUFZLEVBQUUsSUFBSSxDQUFDLFlBQVk7Z0JBQy9CLFlBQVksRUFBRSxJQUFJLENBQUMsWUFBWTtnQkFDL0IsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLGdCQUFnQjthQUN4QyxDQUFDLENBQUM7WUFDSCxPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzNDLEdBQUcsRUFBRSxNQUFNLENBQUMsR0FBRztnQkFDZixtQkFBbUIsRUFBRSxNQUFNLENBQUMsbUJBQW1CO2dCQUMvQyxXQUFXLEVBQUUsTUFBTSxDQUFDLFdBQVc7YUFDaEMsQ0FBQyxDQUFDO1NBQ0osQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsZ0JBQWdCLENBQzNCLFVBQThDO1FBRTlDLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVELGlFQUFpRTtJQUMxRCxLQUFLLENBQUMsaUJBQWlCLENBQUMsVUFBeUM7UUFDdEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFVBQXlDO1FBQ3JFLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLHNCQUFzQixDQUNqQyxVQUF5QztRQUV6QyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHNCQUFzQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFFTSxLQUFLLENBQUMsdUJBQXVCLENBQ2xDLFVBQStDLEVBQy9DLFVBQVUsR0FBd0MsRUFBRTtRQUVwRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztJQUNyRSxDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7T0FtQkc7SUFDSSxLQUFLLENBQUMscUJBQXFCLENBQ2hDLFVBQStDO1FBRS9DLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDO1FBQ3pDLE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxPQUFPLEtBQUssY0FBYztZQUN6RCxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUU7WUFDN0IsQ0FBQyxDQUFDLFNBQVMsQ0FBQztRQUNkLElBQUksT0FBb0MsQ0FBQztRQUN6QyxJQUFJLENBQUM7WUFDSCxNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsd0JBQXdCLENBQUM7Z0JBQzVELEdBQUcsRUFBRSxVQUFVLENBQUMsR0FBRztnQkFDbkIsSUFBSSxFQUFFLFVBQVUsQ0FBQyxJQUFJO2dCQUNyQixPQUFPLEVBQUUsVUFBVSxDQUFDLE9BQU87Z0JBQzNCLEdBQUcsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxFQUFFLFFBQVEsRUFBRSxVQUFVLENBQUMsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDakUsR0FBRyxDQUFDLGFBQWEsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsQ0FBQzthQUMxRCxDQUFDLENBQUM7WUFDSCxJQUNFLElBQUksQ0FBQyxjQUFjLEtBQUssWUFBWTttQkFDakMsSUFBSSxDQUFDLGFBQWE7bUJBQ2xCLENBQUMsSUFBSSxDQUFDLE9BQU8sRUFDaEIsQ0FBQztnQkFDRCxNQUFNLElBQUksS0FBSyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7WUFDM0UsQ0FBQztZQUNELElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxhQUFhLEVBQUUsQ0FBQztnQkFDL0MsTUFBTSxJQUFJLEtBQUssQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO1lBQ2xGLENBQUM7WUFDRCxPQUFPLEdBQUcsSUFBSSwyQkFBMkIsQ0FDdkMsVUFBVSxFQUNWLFVBQVUsRUFDVixJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FDcEIsQ0FBQztRQUNKLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxhQUFhLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ2hDLE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztZQUNELE1BQU0sTUFBTSxJQUFJLENBQUMsbUJBQW1CLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JDLE9BQU8sQ0FBQyxTQUFTLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRTtZQUM3QixJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMxQixPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxXQUFtQixFQUFFLFFBQWlCO1FBQ3RFLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLHdCQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ2pELE9BQU8sUUFBUSxDQUFDO1FBQ2xCLENBQUM7UUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO1lBQ3RCLElBQUksUUFBUSxZQUFZLEtBQUssSUFBSSxRQUFRLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUM5RCxRQUFRLENBQUMsS0FBSyxHQUFHLFlBQVksQ0FBQztnQkFDOUIsT0FBTyxRQUFRLENBQUM7WUFDbEIsQ0FBQztZQUNELE9BQU8sSUFBSSxjQUFjLENBQ3ZCLENBQUMsUUFBUSxFQUFFLFlBQVksQ0FBQyxFQUN4Qiw4RUFBOEUsRUFDOUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQ3BCLENBQUM7UUFDSixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsV0FBbUI7UUFDdkQsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNwQyxNQUFNLElBQUksU0FBUyxDQUFDLDJCQUEyQixDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3pCLE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLHVCQUF1QixDQUNsQyxVQUEyQztRQUUzQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pELENBQUM7SUFFRDs7Ozs7Ozs7OztPQVVHO0lBQ0ksS0FBSyxDQUFDLGlCQUFpQixDQUM1QixVQUErQztRQUUvQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ25ELENBQUM7SUFFTSxLQUFLLENBQUMsZ0JBQWdCO1FBQzNCLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztJQUN4QyxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsUUFBUSxDQUNuQixVQUFpQztRQUVqQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksS0FBSyxDQUFDLHlCQUF5QixDQUNwQyxVQUF5QztRQUV6QyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFFTSxLQUFLLENBQUMsZUFBZSxDQUMxQixVQUFtQztRQUVuQyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBRU0sS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUFrQztRQUN0RCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRU0sS0FBSyxDQUFDLFFBQVEsQ0FBQyxVQUFzQztRQUMxRCxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDckIsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsVUFBVSxDQUFDLFVBQXNDO1FBQzVELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0ksS0FBSyxDQUFDLGNBQWMsQ0FDekIsVUFBK0MsRUFDL0MsVUFBVSxHQUF3QyxFQUFFO1FBRXBELElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNyQixNQUFNLFVBQVUsR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sWUFBWSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7UUFDdkMsTUFBTSxjQUFjLEdBQUcsR0FBUyxFQUFFO1lBQ2hDLFVBQVUsQ0FBQyxLQUFLLENBQUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3pDLENBQUMsQ0FBQztRQUNGLElBQUksWUFBWSxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzFCLE1BQU0sWUFBWSxDQUFDLE1BQU0sQ0FBQztRQUM1QixDQUFDO1FBQ0QsWUFBWSxFQUFFLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxjQUFjLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN4RSxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxFQUFFO1lBQzlELE9BQU8sb0JBQW9CLENBQUMsVUFBVSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDekUsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sVUFBVSxDQUFDO1FBQzFCLENBQUM7Z0JBQVMsQ0FBQztZQUNULFlBQVksRUFBRSxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDM0QsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUM3QyxDQUFDO0lBQ0gsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQUMsVUFBeUM7UUFDaEUsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxTQUFTLENBQUMsVUFBb0M7UUFDekQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBa0M7UUFDckQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVNLEtBQUssQ0FBQyxRQUFRLENBQUMsVUFBc0M7UUFDMUQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDMUMsQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBaUM7UUFDbkQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUVPLEtBQUssQ0FBQyxhQUFhO1FBQ3pCLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDYixNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUM5QixNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQy9DLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUN2QixJQUFJLENBQUM7b0JBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO2dCQUNyQyxDQUFDO3dCQUFTLENBQUM7b0JBQ1QsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO29CQUM5QixJQUFJLENBQUMsT0FBTyxHQUFHLEtBQUssQ0FBQztnQkFDdkIsQ0FBQztnQkFDRCxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7WUFDcEQsQ0FBQztZQUNELElBQUksQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ3BCLE1BQU0sSUFBSSxDQUFDLHdCQUF3QixFQUFFLENBQUM7UUFDeEMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDOUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDckIsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyx3QkFBd0I7UUFDcEMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDM0IsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDakUsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQztRQUNoQyxDQUFDO0lBQ0gsQ0FBQztJQUVPLHdCQUF3QixDQUFDLFNBQTRCO1FBQzNELE1BQU0sZUFBZSxHQUFHLFNBQVMsQ0FBQyxTQUFTLENBQUM7UUFDNUMsSUFBSSxDQUFDLGVBQWUsRUFBRSxPQUFPLElBQUksQ0FBQyxlQUFlLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDMUQsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxPQUFZLENBQUM7UUFDakIsSUFBSSxDQUFDO1lBQ0gsT0FBTyxHQUFHLElBQUksR0FBRyxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM3QyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ25DLE9BQU8sQ0FBQyxRQUFRLEdBQUcsV0FBVyxDQUFDO1FBQ2pDLENBQUM7YUFBTSxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssSUFBSSxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssTUFBTSxFQUFFLENBQUM7WUFDcEUsT0FBTyxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUM7UUFDN0IsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUM7UUFDbEMsTUFBTSxVQUFVLEdBQ2QsUUFBUSxLQUFLLFdBQVc7WUFDeEIsUUFBUSxLQUFLLEtBQUs7WUFDbEIsUUFBUSxLQUFLLE9BQU87WUFDcEIsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDaEIsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDO0lBQ3hCLENBQUM7SUFFTyxvQkFBb0IsQ0FDMUIsV0FBbUIsRUFDbkIsU0FBc0I7UUFFdEIsT0FBTyxJQUFJLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFO1lBQzdCLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztZQUNwQixJQUFJLGFBQXFELENBQUM7WUFDMUQsTUFBTSxNQUFNLEdBQUcsQ0FBQyxVQUE0QyxFQUFRLEVBQUU7Z0JBQ3BFLElBQUksT0FBTyxFQUFFLENBQUM7b0JBQ1osT0FBTztnQkFDVCxDQUFDO2dCQUNELE9BQU8sR0FBRyxJQUFJLENBQUM7Z0JBQ2YsU0FBUyxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsQ0FBQztnQkFDbkQsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ3RCLENBQUMsQ0FBQztZQUNGLE1BQU0sVUFBVSxHQUFHLEdBQVMsRUFBRTtnQkFDNUIsYUFBYSxFQUFFLE9BQU8sRUFBRSxDQUFDO2dCQUN6QixNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDcEIsQ0FBQyxDQUFDO1lBQ0YsU0FBUyxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxVQUFVLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztZQUNoRSxJQUFJLFNBQVMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDdEIsVUFBVSxFQUFFLENBQUM7Z0JBQ2IsT0FBTztZQUNULENBQUM7WUFDRCxJQUFJLENBQUM7Z0JBQ0gsYUFBYSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUNsQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLEVBQ2hDLEVBQUUsTUFBTSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEVBQy9CLENBQUMsUUFBUSxFQUFFLEVBQUU7b0JBQ1gsTUFBTSxPQUFPLEdBQ1gsUUFBUSxDQUFDLFVBQVUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDO29CQUN4RCxnRUFBZ0U7b0JBQ2hFLCtEQUErRDtvQkFDL0QsYUFBYSxFQUFFLE9BQU8sRUFBRSxDQUFDO29CQUN6QixNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7Z0JBQ2xCLENBQUMsQ0FDRixDQUFDO2dCQUNGLGFBQWEsQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDO2dCQUN2RCxhQUFhLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDdEIsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDeEIsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLHFCQUFxQixDQUMzQixTQUFzQjtRQUV0QixJQUFJLENBQUMsSUFBSSxDQUFDLDRCQUE0QixFQUFFLENBQUM7WUFDdkMsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQztZQUN2QyxNQUFNLGVBQWUsR0FBRyxJQUFJLENBQUMsTUFBTTtpQkFDaEMsU0FBUyxDQUFDLEVBQUUsU0FBUyxFQUFFLHlCQUF5QixFQUFFLENBQUM7aUJBQ25ELElBQUksQ0FDSCxDQUFDLE1BQU0sRUFBb0MsRUFBRTtnQkFDM0MsSUFDRSxJQUFJLENBQUMsY0FBYyxLQUFLLFVBQVU7b0JBQ2xDLElBQUksQ0FBQyxNQUFNLENBQUMsU0FBUztvQkFDckIsQ0FBQyxJQUFJLENBQUMsaUJBQWlCLEVBQ3ZCLENBQUM7b0JBQ0QsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDakUsQ0FBQztnQkFDRCxPQUFPLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsYUFBYSxDQUFDO1lBQ2xELENBQUMsRUFDRCxHQUFxQyxFQUFFLENBQUMsYUFBYSxDQUN0RCxDQUFDO1lBQ0osSUFBSSxDQUFDLDRCQUE0QixHQUFHLGVBQWUsQ0FBQztZQUNwRCxLQUFLLGVBQWUsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFO2dCQUNoQyxJQUFJLElBQUksQ0FBQyw0QkFBNEIsS0FBSyxlQUFlLEVBQUUsQ0FBQztvQkFDMUQsSUFBSSxDQUFDLDRCQUE0QixHQUFHLElBQUksQ0FBQztnQkFDM0MsQ0FBQztZQUNILENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyw0QkFBNEIsQ0FBQztRQUN0RCxPQUFPLElBQUksT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUU7WUFDN0IsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3BCLE1BQU0sTUFBTSxHQUFHLENBQUMsVUFBNEMsRUFBUSxFQUFFO2dCQUNwRSxJQUFJLE9BQU8sRUFBRSxDQUFDO29CQUNaLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxPQUFPLEdBQUcsSUFBSSxDQUFDO2dCQUNmLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7Z0JBQ2xELE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUN0QixDQUFDLENBQUM7WUFDRixNQUFNLFNBQVMsR0FBRyxHQUFTLEVBQUU7Z0JBQzNCLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNwQixDQUFDLENBQUM7WUFDRixTQUFTLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQy9ELElBQUksU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUN0QixTQUFTLEVBQUUsQ0FBQztnQkFDWixPQUFPO1lBQ1QsQ0FBQztZQUNELEtBQUssV0FBVyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoQyxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTywyQkFBMkI7UUFNakMsSUFBSSxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7WUFDdEIsT0FBTyxVQUFVLENBQUM7UUFDcEIsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbEIsT0FBTyxhQUFhLENBQUM7UUFDdkIsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLE9BQU8sVUFBVSxDQUFDO1FBQ3BCLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRU8sc0JBQXNCLENBQzVCLFNBQTRDLEVBQzVDLFlBQW9CO1FBRXBCLE9BQU87WUFDTCxLQUFLLEVBQUUsS0FBSztZQUNaLE1BQU0sRUFBRSxhQUFhO1lBQ3JCLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLFVBQVUsRUFBRSxXQUFXLENBQUMsR0FBRyxFQUFFLEdBQUcsWUFBWTtTQUM3QyxDQUFDO0lBQ0osQ0FBQztJQUVPLDBCQUEwQjtRQUNoQyxLQUFLLE1BQU0sbUJBQW1CLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQywwQkFBMEIsQ0FBQyxFQUFFLENBQUM7WUFDdkUsbUJBQW1CLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDOUIsQ0FBQztJQUNILENBQUM7SUFFTyxhQUFhO1FBQ25CLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsQ0FBQztRQUM1QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksS0FBSyxDQUFDLDJCQUEyQixDQUFDLENBQUM7UUFDL0MsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsdUJBQXVCO1FBQ25DLE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNqRCxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDaEMsS0FBSyxNQUFNLENBQUMsVUFBVSxDQUFDLElBQUksV0FBVyxFQUFFLENBQUM7WUFDdkMsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM1RixDQUFDO0lBRU8sS0FBSyxDQUFDLHVCQUF1QjtRQUNuQyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLENBQUM7UUFDOUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2hDLE1BQU0sT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ2hFLENBQUM7Q0FDRiJ9

package/dist_ts/classes.gitmanagererror.js

@@ -11,6 +11,12 @@ const gitManagerErrorCodes = new Set([
     'transferAborted',
     'repositoryBusy',
     'lfsScanLimitExceeded',
+    'sshHostKeyMismatch',
+    'sshAuthenticationFailed',
+    'remoteConnectionRefused',
+    'remoteConnectionFailed',
+    'remoteProtocolError',
+    'remoteTransportMismatch',
 ]);
 export const isGitManagerErrorCode = (valueArg) => typeof valueArg === 'string' && gitManagerErrorCodes.has(valueArg);
 /**
@@ -25,4 +31,4 @@ export class GitManagerError extends Error {
         this.code = codeArg;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRtYW5hZ2VyZXJyb3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmdpdG1hbmFnZXJlcnJvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLG9CQUFvQixHQUF3QixJQUFJLEdBQUcsQ0FBdUI7SUFDOUUsaUJBQWlCO0lBQ2pCLGdCQUFnQjtJQUNoQixpQkFBaUI7SUFDakIsd0JBQXdCO0lBQ3hCLHNCQUFzQjtJQUN0QixpQkFBaUI7SUFDakIscUJBQXFCO0lBQ3JCLHVCQUF1QjtJQUN2QixxQkFBcUI7SUFDckIsaUJBQWlCO0lBQ2pCLGdCQUFnQjtJQUNoQixzQkFBc0I7Q0FDdkIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFpQixFQUFvQyxFQUFFLENBQzNGLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFckU7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxlQUFnQixTQUFRLEtBQUs7SUFHeEMsWUFBWSxPQUE2QixFQUFFLFVBQWtCLEVBQUUsVUFBeUI7UUFDdEYsS0FBSyxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsSUFBSSxHQUFHLGlCQUFpQixDQUFDO1FBQzlCLElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDO0lBQ3RCLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5naXRtYW5hZ2VyZXJyb3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmdpdG1hbmFnZXJlcnJvci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFFQSxNQUFNLG9CQUFvQixHQUF3QixJQUFJLEdBQUcsQ0FBdUI7SUFDOUUsaUJBQWlCO0lBQ2pCLGdCQUFnQjtJQUNoQixpQkFBaUI7SUFDakIsd0JBQXdCO0lBQ3hCLHNCQUFzQjtJQUN0QixpQkFBaUI7SUFDakIscUJBQXFCO0lBQ3JCLHVCQUF1QjtJQUN2QixxQkFBcUI7SUFDckIsaUJBQWlCO0lBQ2pCLGdCQUFnQjtJQUNoQixzQkFBc0I7SUFDdEIsb0JBQW9CO0lBQ3BCLHlCQUF5QjtJQUN6Qix5QkFBeUI7SUFDekIsd0JBQXdCO0lBQ3hCLHFCQUFxQjtJQUNyQix5QkFBeUI7Q0FDMUIsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxRQUFpQixFQUFvQyxFQUFFLENBQzNGLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxvQkFBb0IsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLENBQUM7QUFFckU7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxlQUFnQixTQUFRLEtBQUs7SUFHeEMsWUFBWSxPQUE2QixFQUFFLFVBQWtCLEVBQUUsVUFBeUI7UUFDdEYsS0FBSyxDQUFDLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztRQUM5QixJQUFJLENBQUMsSUFBSSxHQUFHLGlCQUFpQixDQUFDO1FBQzlCLElBQUksQ0FBQyxJQUFJLEdBQUcsT0FBTyxDQUFDO0lBQ3RCLENBQUM7Q0FDRiJ9

package/dist_ts/models.d.ts

@@ -151,8 +151,31 @@ export interface IGitManagerArchiveInspection {
  * - `lfsScanLimitExceeded`: the Git LFS pointer scan of
  *   `listRepositoryLfsPointers()` exceeded one of its bounds; the message
  *   names the bound. The pointer set is unknown, never empty.
+ *
+ * An SSH push (`pushRefs()` with an `sshKey` credential) that fails before
+ * the remote's ref advertisement is complete throws one of the following;
+ * nothing was pushed. They are classified from the exit status 255 and the
+ * fixed texts of the local OpenSSH client, and the message carries ssh's
+ * redacted standard error for operator logs only.
+ *
+ * - `sshHostKeyMismatch`: the remote's host key is not the pinned `hostKey`;
+ *   the key was never offered.
+ * - `sshAuthenticationFailed`: the remote refused the SSH key.
+ * - `remoteConnectionRefused`: the remote host refused the TCP connection.
+ * - `remoteConnectionFailed`: any other failure of the SSH connection, such
+ *   as an unknown host, a timeout of the connection, or a server that does
+ *   not offer the pinned key's type.
+ * - `remoteProtocolError`: the remote command ran but did not answer with a
+ *   Git receive-pack advertisement (or one without `report-status`), such as
+ *   a forge that refuses SSH with a message or a missing repository.
+ *
+ * - `remoteTransportMismatch`: a push's credential or options do not fit the
+ *   transport of its `remoteUrl`: an `sshKey` credential without an
+ *   `ssh://` URL, an `ssh://` URL without an `sshKey` credential, or
+ *   `caCertificates` with an `sshKey` credential. Refused before anything
+ *   runs; nothing was pushed.
  */
-export type TGitManagerErrorCode = 'invalidObjectId' | 'objectNotFound' | 'objectNotCommit' | 'ancestryBudgetExceeded' | 'archiveLimitExceeded' | 'archiveRejected' | 'bundleLimitExceeded' | 'atomicPushUnsupported' | 'remoteLimitExceeded' | 'transferAborted' | 'repositoryBusy' | 'lfsScanLimitExceeded';
+export type TGitManagerErrorCode = 'invalidObjectId' | 'objectNotFound' | 'objectNotCommit' | 'ancestryBudgetExceeded' | 'archiveLimitExceeded' | 'archiveRejected' | 'bundleLimitExceeded' | 'atomicPushUnsupported' | 'remoteLimitExceeded' | 'transferAborted' | 'repositoryBusy' | 'lfsScanLimitExceeded' | 'sshHostKeyMismatch' | 'sshAuthenticationFailed' | 'remoteConnectionRefused' | 'remoteConnectionFailed' | 'remoteProtocolError' | 'remoteTransportMismatch';
 export interface IGitManagerRepositoryLfsPointer {
     oid: string;
     sizeBytes: number;
@@ -274,4 +297,4 @@ export type TGitManagerReadinessResult = {
     reason: TGitManagerReadinessFailureReason;
     durationMs: number;
 };
-export type { IGitManagerAtomicPushRefResult, IGitManagerAtomicPushRefUpdate, IGitManagerAtomicPushRequest, IGitManagerAtomicPushResult, IGitManagerCommitDetail, IGitManagerCommitRequest, IGitManagerCommitSummary, IGitManagerDiff, IGitManagerDiffFile, IGitManagerDiffHunk, IGitManagerDiffLine, IGitManagerDiffRequest, IGitManagerDiffStats, IGitManagerFileContent, IGitManagerImportMirrorRequest, IGitManagerInitBareRepositoryRequest, IGitManagerListCommitsRequest, IGitManagerListTagsRequest, IGitManagerMergeRequest, IGitManagerMergeResult, IGitManagerProtectedRefViolation, IGitManagerReadFileRequest, IGitManagerRef, IGitManagerRefHead, IGitManagerRefInventoryPage, IGitManagerRefInventoryStale, IGitManagerRefRequest, IGitManagerRefreshMirrorRequest, IGitManagerRemoteBasicCredential, IGitManagerRemoteTransferOptions, IGitManagerRepositoryInfo, IGitManagerRepositorySelector, IGitManagerRepositorySize, IGitManagerSetDefaultBranchRequest, IGitManagerTag, IGitManagerTagRequest, IGitManagerTreeEntry, IGitManagerTreeRequest, TGitManagerAtomicPushRefReason, TGitManagerAtomicPushRefStatus, TGitManagerDiffFileStatus, TGitManagerDiffLineKind, TGitManagerProtectedRefViolationRule, TGitManagerMergeMethod, TGitManagerMergeStatus, TGitManagerObjectType, TGitManagerRefInventoryPagination, TGitManagerRefInventoryResult, TGitManagerRemoteCredential, TGitManagerTreeEntryType, } from '@foss.global/interfaces';
+export type { IGitManagerAtomicPushRefResult, IGitManagerAtomicPushRefUpdate, IGitManagerAtomicPushRequest, IGitManagerAtomicPushResult, IGitManagerCommitDetail, IGitManagerCommitRequest, IGitManagerCommitSummary, IGitManagerDiff, IGitManagerDiffFile, IGitManagerDiffHunk, IGitManagerDiffLine, IGitManagerDiffRequest, IGitManagerDiffStats, IGitManagerFileContent, IGitManagerImportMirrorRequest, IGitManagerInitBareRepositoryRequest, IGitManagerListCommitsRequest, IGitManagerListTagsRequest, IGitManagerMergeRequest, IGitManagerMergeResult, IGitManagerProtectedRefViolation, IGitManagerReadFileRequest, IGitManagerRef, IGitManagerRefHead, IGitManagerRefInventoryPage, IGitManagerRefInventoryStale, IGitManagerRefRequest, IGitManagerRefreshMirrorRequest, IGitManagerRemoteBasicCredential, IGitManagerRemoteSshKeyCredential, IGitManagerRemoteTransferOptions, IGitManagerRepositoryInfo, IGitManagerRepositorySelector, IGitManagerRepositorySize, IGitManagerSetDefaultBranchRequest, IGitManagerTag, IGitManagerTagRequest, IGitManagerTreeEntry, IGitManagerTreeRequest, TGitManagerAtomicPushCredential, TGitManagerAtomicPushRefReason, TGitManagerAtomicPushRefStatus, TGitManagerDiffFileStatus, TGitManagerDiffLineKind, TGitManagerProtectedRefViolationRule, TGitManagerMergeMethod, TGitManagerMergeStatus, TGitManagerObjectType, TGitManagerRefInventoryPagination, TGitManagerRefInventoryResult, TGitManagerRemoteCredential, TGitManagerTreeEntryType, } from '@foss.global/interfaces';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@foss.global/gitmanager",
-  "version": "2.10.0",
+  "version": "2.11.1",
   "private": false,
   "description": "Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.",
   "exports": {
@@ -10,13 +10,13 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "dependencies": {
-    "@foss.global/interfaces": "^2.4.0",
+    "@foss.global/interfaces": "^3.5.0",
     "@push.rocks/smartrust": "^1.7.0"
   },
   "devDependencies": {
     "@foss.global/ci-spec": "1.1.1",
-    "@git.zone/rsrepo": "^1.3.0",
-    "@git.zone/tsrepo": "^2.0.0",
+    "@git.zone/rsrepo": "^1.3.1",
+    "@git.zone/tsrepo": "^2.2.0",
     "@types/node": "^26.6.6"
   },
   "files": [

package/readme.md

@@ -169,7 +169,7 @@ const result = await gitManager.pushRefs({
     { ref: 'refs/heads/old', expectedOldObjectId: oldOid, newObjectId: null }, // delete
   ],
 });
-// { org, repo, status: 'applied' | 'rejected', refs: [{ ref, status: 'ok' | 'rejected' | 'stale', reason?, message? }] }
+// { org, repo, status: 'applied' | 'rejected', refs: [{ ref, status: 'ok' | 'rejected' | 'stale', reason?, message? }], remoteMessages: string[] }
 
 await gitManager.setDefaultBranch({ org: 'mirror.org', repo: 'interfaces', defaultBranch: 'main' });
 ```
@@ -184,13 +184,48 @@ await gitManager.setDefaultBranch({ org: 'mirror.org', repo: 'interfaces', defau
   - `non-fast-forward`: the remote or the local Git refused the ref as not a fast-forward.
   - `local-rejected`: the local Git refused the ref for another reason, such as an existing ref it would not overwrite.
   - `remote-rejected`: the remote refused the ref with a reason not listed above, or with none.
+- `remoteMessages` holds the messages the remote sent during the push, such as a hook's output, for `https` and `ssh` remotes alike: the text of each `remote: ` line of Git's standard error in order, without the prefix and the trailing padding. It is `[]` when the remote sent none and is never omitted. It holds at most 100 lines and 16 KiB of text; when the remote sent more, the last element is `[remote messages truncated]` (a line cut at the byte bound keeps its first part). Credentials are redacted as in `message`. It is free text: look for a value you chose yourself, such as a nonce, and never branch on anything else in it.
 - Git sends nothing for a ref that already holds `newObjectId`, whatever its lease says, and reports it `ok` with the message `up to date` while the push's other refs are sent as usual, so a retried push whose first response was lost reads as `applied`. Such a ref is not changed, but its lease was not checked either: `ok` never means the lease matched. Deleting a ref that is already gone is `stale`.
 - The remote must advertise the `atomic` receive-pack capability. Without it Git refuses before it sends anything, and `pushRefs()` throws a `GitManagerError` with code `atomicPushUnsupported`; it never falls back to ref-by-ref updates. That holds for Smart HTTP remotes only: against a dumb-HTTP remote Git runs `http-push`, which updates ref by ref and is not atomic, so a push remote must serve Smart HTTP.
 - Each `newObjectId` must be in the managed repository; a missing one throws a `GitManagerError` with code `objectNotFound` before any connection. A push holds one or more updates of distinct full ref names under `refs/`; object IDs are full lowercase hexadecimal. GitManager sets no limit on the number of updates and never splits a push. It reads at most 128 MiB of the remote helper's output per push (the remote's ref listing and one status line per listed or pushed ref) and at most 64 KiB per line, and throws when the helper writes more. A remote that refuses the push request as too large (HTTP 413) makes `pushRefs()` throw a `GitManagerError` with code `remoteLimitExceeded`; nothing was pushed.
-- URL policy, enforced by GitManager: `https://`, or `http://` only to a loopback IP literal in its canonical spelling, `127.0.0.0/8` as four decimal octets without leading zeros or exactly `[::1]`. Other spellings of a loopback address (an uppercase scheme, octal, hexadecimal or single-integer forms, a trailing dot, other IPv6 forms) are refused rather than normalized, so Git receives exactly the URL the policy checked. Host names over `http`, `localhost` included, are refused, because a credential sent over plain `http` to a name would go wherever that name resolves. `ssh://`, `git://`, `file://`, `ext::`, local paths, scp-like URLs and URLs with user information are refused. The policy runs before any process starts, and its errors never quote the URL.
+- URL policy, enforced by GitManager: `https://`, or `http://` only to a loopback IP literal in its canonical spelling, `127.0.0.0/8` as four decimal octets without leading zeros or exactly `[::1]`. Other spellings of a loopback address (an uppercase scheme, octal, hexadecimal or single-integer forms, a trailing dot, other IPv6 forms) are refused rather than normalized, so Git receives exactly the URL the policy checked. Host names over `http`, `localhost` included, are refused, because a credential sent over plain `http` to a name would go wherever that name resolves. `git://`, `file://`, `ext::`, local paths, scp-like URLs and URLs with user information are refused. `ssh://` is the transport of an `sshKey` credential and of nothing else (see [SSH pushes](#ssh-pushes)): an `ssh://` URL without an `sshKey` credential, an `sshKey` credential with any other URL, and `caCertificates` with an `sshKey` credential throw a `GitManagerError` with code `remoteTransportMismatch`. The policy runs before any process starts, and its errors never quote the URL.
 - The credential, `caCertificates` and `timeoutMs` behave as for mirrors: the credential travels only in the Git process environment as an `Authorization` header, with no credential helper, no hooks, no redirects and no global or system Git config; error text replaces the remote URL with `<push-remote>`. The remote URL is never stored in the repository.
 - `{ signal }` aborts a push as described in [Cancellation, concurrency and stop](#cancellation-concurrency-and-stop). An abort before the updates are sent (the signal already aborted, or an abort during the local object check or the remote ref listing) changes nothing anywhere. An abort after that rejects with `transferAborted` as well, but the remote may have applied the push: the remote applies an atomic push completely or not at all, and the abort can land before or after it did. Read the remote refs again before retrying.
 - A loopback `http` push never goes through a proxy, so the credential cannot leave the machine; see the proxy note above.
+### SSH pushes
+
+An `sshKey` credential pushes to an `ssh://` remote with the remote's host key pinned:
+
+```ts
+const result = await gitManager.pushRefs({
+  org: 'canary.org',
+  repo: 'canary',
+  remoteUrl: 'ssh://git@code.example:29419/canary.org/canary.git',
+  credential: { kind: 'sshKey', privateKey: canaryKeyPem, hostKey: 'ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAA...' },
+  updates: [{ ref: 'refs/heads/main', expectedOldObjectId: oldOid, newObjectId: newOid }],
+});
+if (result.refs[0].reason === 'hook-declined' && result.remoteMessages.some((line) => line.includes(nonce))) {
+  // refused by the hook that printed the nonce
+}
+```
+
+- `remoteUrl` is `ssh://<user>@<host>[:<port>]/<path>`. The user is required and may hold `[A-Za-z0-9._-]` (not starting with `-` or `.`); the host is a name, an IPv4 address or a bracketed IPv6 address in canonical form; the port defaults to 22; the path holds only `[A-Za-z0-9._/-]`. Anything else is refused, never escaped or quoted, before any process starts. The remote runs `git-receive-pack '<path>'`.
+- `hostKey` is the remote's public host key as one OpenSSH key line, `<type> <base64>` without host name or comment (`ssh-ed25519`, `ecdsa-sha2-nistp256`/`384`/`521` or `ssh-rsa`); the key blob is checked against its type. `ssh` accepts that key and no other: there is no known-hosts file, no trust on first use and no host key update. A fingerprint alone is not accepted.
+- `privateKey` is one PEM private key the OpenSSH client reads, without a passphrase: `-----BEGIN OPENSSH PRIVATE KEY-----` (what `ssh-keygen` writes), or PEM RSA, EC or PKCS #8. An encrypted key is refused.
+- The push runs the system `ssh` client, which has to be on the engine's `PATH`. The key exists for the push only, as a `0600` file in a `0700` `remote-ssh-<pid>-<nonce>` directory under `transferDir`, next to a known-hosts file holding only `hostKey`; it is removed as soon as the remote's ref advertisement is read, and on every error, abort and timeout. A directory a killed engine left behind is removed when the next engine starts. Only the file's path is on the `ssh` command line; the key is never in an argument, an environment variable, an error or a log. `ssh` runs with `-F none -T`, `BatchMode`, `IdentitiesOnly`, no agent, `PreferredAuthentications=publickey`, `StrictHostKeyChecking=yes`, `UpdateHostKeys=no`, `ConnectTimeout` (at most 30 s), `LogLevel=ERROR` and `--` before the destination, and with only `PATH` and `LC_ALL=C` in its environment.
+- The push has the same semantics as over `https`: the engine reads the remote's ref advertisement, checks every lease against it, and hands the refspecs and the advertisement to `git send-pack --stateless-rpc --atomic`, relaying its request to the remote as remote-curl does over HTTP. Each command carries the advertised old object, so the remote checks every lease again inside its atomic ref transaction; command lines stay the same size however many updates a push holds. A remote without the `atomic` capability throws `atomicPushUnsupported` before anything is sent.
+- A failure before the remote's ref advertisement is complete throws a `GitManagerError`, and nothing was pushed. The code comes from `ssh`'s exit status 255 and the fixed texts of the local OpenSSH client (pinned against the system `ssh` in `test/test.sshpush.node.ts`); the message carries `ssh`'s redacted standard error for operator logs only, never as something to judge by:
+
+  | Code | When |
+  | --- | --- |
+  | `sshHostKeyMismatch` | `Host key verification failed.`: the remote's host key is not `hostKey`; the private key was never offered. |
+  | `sshAuthenticationFailed` | `<user>@<host>: Permission denied (<methods>).`: the remote refused the key. |
+  | `remoteConnectionRefused` | `ssh: connect to host <host> port <port>: Connection refused`. |
+  | `remoteConnectionFailed` | Any other `ssh` failure (exit 255): an unknown host, a connection timeout, or a server that does not offer the type of `hostKey` (OpenSSH reports that at a level `LogLevel=ERROR` hides). |
+  | `remoteProtocolError` | The remote command ran but did not answer with a Git receive-pack advertisement with `report-status`, such as a forge that refuses SSH with a message, or a missing repository. GitManager never matches a forge's own text. |
+
+- After the advertisement, the outcome is read from `send-pack`'s report exactly as over `https`: `applied`, `rejected` with a `reason` per ref, or an error when the report does not say what the remote did.
+
 - `setDefaultBranch()` points HEAD at `refs/heads/<defaultBranch>` and returns the repository info. The branch name is given without `refs/heads/`; a branch that does not exist is refused and HEAD stays unchanged. A mirror's next `refreshMirror()` points HEAD at the source's default branch again.
 - With `allowUnborn: true` the branch may not exist yet: HEAD names it unborn, as in a new repository, until a push creates it, and clones check out nothing until then. receive-pack refuses to delete the branch HEAD names (`deletion of the current branch prohibited`), which fails a whole atomic push, so a push that renames the default branch (creates the new one and deletes the old one) needs HEAD on the new name first. If that push is refused, HEAD stays unborn; `setDefaultBranch()` without the flag to an existing branch points it back. The name is validated either way.
 
@@ -292,7 +327,7 @@ All numeric options must be integers.
 - `gracefulShutdownMs`: `10,000`; accepted range 100–60,000.
 - `privateRead.trustedIngressToken`: required when trusted private reads are enabled; 32–512 non-whitespace characters.
 - `receivePack.trustedIngressToken`: required when receive-pack is enabled; 32–512 non-whitespace characters.
-- `receivePack.maxRequestBodyBytes`: 4 GiB; accepted range 1 KiB–16 TiB. Request bodies are streamed and counted. A declared `Content-Length` above the limit is answered with `413` before Git starts. A streamed body that exceeds it is answered with `413` as well: the response status is decided only after the request body has reached Git completely, the Git process tree is killed at once, and the private pre-receive hook admits ref updates only after the transfer supervisor confirmed the complete body within the limit. An over-limit push therefore never updates a ref, even when Git has already read a complete pack before the excess bytes arrive. The rest of a rejected body is read for up to 1 MiB or 2 seconds so the client receives the `413`.
+- `receivePack.maxRequestBodyBytes`: 4 GiB; accepted range 1 KiB–16 TiB. Request bodies are streamed and counted. A declared `Content-Length` above the limit is answered with `413` before Git starts. A streamed body that exceeds it is answered with `413` as well: the response status is decided only after the whole request body has been read and counted (Git reads no more of it once its pre-receive hook runs, so the rest is counted without passing it to Git, however large it is), the Git process tree is killed at once, and the private pre-receive hook admits ref updates only after the transfer supervisor confirmed the complete body within the limit. An over-limit push therefore never updates a ref, even when Git has already read a complete pack before the excess bytes arrive. The rest of a rejected body is read for up to 1 MiB or 2 seconds so the client receives the `413`.
 
 While the service is running, access can be replaced atomically:
 
@@ -484,7 +519,7 @@ try {
 - `GitManager.importMirror()`: imports a remote repository with `git clone --mirror`. Supported remote forms are `https://`, `http://`, `ssh://`, `git://`, `file://`, and SCP-like `git@host:org/repo.git` URLs.
 - `GitManager.refreshMirror()`: atomically fetches and verifies the configured mirror source and mirrors its default branch.
 - `GitManager.importMirror()` and `GitManager.refreshMirror()` accept a `credential`, `caCertificates` and `timeoutMs`; see [Credentialed mirrors and repository size](#credentialed-mirrors-and-repository-size).
-- `GitManager.pushRefs()`: pushes leased ref updates to an `https` or loopback-IP `http` remote as one atomic transaction; see [Atomic pushes and the default branch](#atomic-pushes-and-the-default-branch).
+- `GitManager.pushRefs()`: pushes leased ref updates to an `https` or loopback-IP `http` remote, or with an `sshKey` credential to an `ssh://` remote, as one atomic transaction and returns the remote's messages; see [Atomic pushes and the default branch](#atomic-pushes-and-the-default-branch) and [SSH pushes](#ssh-pushes).
 - `GitManager.importMirror(request, { signal? })`, `GitManager.refreshMirror(request, { signal? })` and `GitManager.pushRefs(request, { signal? })` run concurrently with other commands, hold mirror repositories against writes (`repositoryBusy`) and reject with `transferAborted` when aborted; see [Cancellation, concurrency and stop](#cancellation-concurrency-and-stop).
 - `GitManager.setDefaultBranch()`: points a repository's HEAD at an existing branch, or with `allowUnborn` at one a later push creates.
 - `GitManager.getRepositorySize()`: returns the exact object count, uncompressed object bytes and on-disk object storage bytes of a repository.
@@ -537,7 +572,7 @@ pnpm run test:rust
 pnpm run build
 ```
 
-`pnpm test` runs the `pretest` hook first, which builds the Rust binaries with `rsrepo`, and then runs lifecycle, bounded readiness, local mirror/read API, raw upload-pack/receive-pack preparation, clone/fetch denial, trusted receive-pack denial, explicit policy initialization, protected create/delete/non-fast-forward enforcement, inherited self-test hardening, restart replay, and real push tests through `smartrust`. `test/test.refinventory.node.ts` covers every ref namespace, peeled and nested tags, symbolic and dangling symbolic refs, unborn HEAD, prefix selection and exact lookup, ref names that are not valid UTF-8, pagination of 1,001 refs, stale and foreign cursors, 50,000 loose and packed refs, and a bundle round trip across namespaces. `test/test.pushlimits.node.ts` covers fixed-length and chunked Smart HTTP pushes over the limit, a complete pack followed by late excess bytes, an over-limit SSH-style receive-pack, an SSH-style receive-pack cut after Git already moved a ref (the update stays), and a bounded `stop()` while a service's output is never read, the rejected cases proving the refs unchanged, no Git or hook process left, no uncaught stream error, the engine serving, and a later push succeeding. `test/test.repositorybundles.node.ts` covers bundles of a repository whose only refs are notes and of one without its default branch (restored with HEAD on the unborn default branch), the refusal of a repository without refs, `bundleLimitExceeded` leaving no file, `replaceRepository()` with a bundle and without one, and a failed replacement that keeps the live repository and leaves no scratch. `test/test.protectedrefs.node.ts` covers `evaluateProtectedRefUpdates()` for every rule, unprotected refs, missing old objects and invalid requests, names the one protected ref among 1,003 updates and counts the engine's Git processes through a PATH wrapper (3 for one protected update, 66 for 64 protected updates on a 2,000-commit history with 500 tags), pins the pre-receive hook's decline messages over Smart HTTP, shows that the hook refuses an update and a deletion naming a missing old object even where the rule allows force pushes and deletions, and renames a default branch in one atomic Smart HTTP push after `setDefaultBranch()` with `allowUnborn` (refused while HEAD names the deleted branch, HEAD left unborn by a declined push and recovered without the flag, a missing branch still refused without it). `test/test.ancestry.node.ts` covers ancestors, the reverse direction, siblings, merges, unrelated histories, the same commit, invalid, missing and non-commit objects, a budget exceeded on a 20,000-commit history next to the exact answer, and a stalled walk whose Git process is killed. `test/test.remotetransfer.node.ts` serves fixtures through `git http-backend` over HTTPS with a private CA and over plain HTTP on `127.0.0.1` and `[::1]`, and covers credentialed mirror imports and refreshes, the source default branch on import and refresh, `setDefaultBranch()`, the push URL policy, atomic creates, updates and deletes, stale leases that change no ref, a remote without the `atomic` capability, 5,000 creates and 5,000 deletes in one receive-pack request with no command line naming a ref, a stale lease on the last of 1,500 updates that changes no ref, a pre-receive hook that declines a push and an update hook that declines one ref (the others failing as collateral), the `reason` of every ref that is not `ok`, and the credential staying out of every command line, error and file. Its fixture can hold or refuse a receive-pack request, which covers a ref that moves between the listing and the push (the remote fails all 1,500 updates) and a `413` answer (`remoteLimitExceeded`, no ref changed). It can also withhold pack requests to stall a transfer midway, which covers aborting an import (no repository or scratch left), a refresh (refs and HEAD unchanged) and a push, a push aborted before it sends its updates that changes nothing, other commands and transfers completing while transfers stall, `repositoryBusy` (including `replaceRepository()`) and the Smart HTTP `503` while a mirror refreshes, an atomic refresh that prunes nothing when one ref update fails, a refresh that times out inside its ref transaction without leaving lock files, a refresh refused during a Smart HTTP push, the receive-pack guard ticket (refused while held, admitted after release, idempotent release, released by `stop()`, released when its preparation times out on the bridge after the engine issued it), a bounded `stop()` during a stalled transfer, and a credentialed loopback `http` push that never reaches the `http_proxy`, `all_proxy` and `ALL_PROXY` set in the engine's environment. `test/test.archiveinspection.node.ts` runs every ci-spec archive conformance vector through `inspectArchive()` as bytes and as a chunked stream, the compressed limit at its boundary, an 8 MiB streamed archive, an early refusal that closes the source, and abort, source failure and `stop()` during an inspection.
+`pnpm test` runs the `pretest` hook first, which builds the Rust binaries with `rsrepo`, and then runs lifecycle, bounded readiness, local mirror/read API, raw upload-pack/receive-pack preparation, clone/fetch denial, trusted receive-pack denial, explicit policy initialization, protected create/delete/non-fast-forward enforcement, inherited self-test hardening, restart replay, and real push tests through `smartrust`. `test/test.refinventory.node.ts` covers every ref namespace, peeled and nested tags, symbolic and dangling symbolic refs, unborn HEAD, prefix selection and exact lookup, ref names that are not valid UTF-8, pagination of 1,001 refs, stale and foreign cursors, 50,000 loose and packed refs, and a bundle round trip across namespaces. `test/test.pushlimits.node.ts` covers fixed-length and chunked Smart HTTP pushes over the limit, a complete pack followed by late excess bytes, a complete pack followed by more bytes than Git's input pipe holds (`413` over the limit, admitted within it, both decided as soon as the body ends), an over-limit SSH-style receive-pack, an SSH-style receive-pack cut after Git already moved a ref (the update stays), and a bounded `stop()` while a service's output is never read, the rejected cases proving the refs unchanged, no Git or hook process left, no uncaught stream error, the engine serving, and a later push succeeding. `test/test.repositorybundles.node.ts` covers bundles of a repository whose only refs are notes and of one without its default branch (restored with HEAD on the unborn default branch), the refusal of a repository without refs, `bundleLimitExceeded` leaving no file, `replaceRepository()` with a bundle and without one, and a failed replacement that keeps the live repository and leaves no scratch. `test/test.protectedrefs.node.ts` covers `evaluateProtectedRefUpdates()` for every rule, unprotected refs, missing old objects and invalid requests, names the one protected ref among 1,003 updates and counts the engine's Git processes through a PATH wrapper (3 for one protected update, 66 for 64 protected updates on a 2,000-commit history with 500 tags), pins the pre-receive hook's decline messages over Smart HTTP, shows that the hook refuses an update and a deletion naming a missing old object even where the rule allows force pushes and deletions, and renames a default branch in one atomic Smart HTTP push after `setDefaultBranch()` with `allowUnborn` (refused while HEAD names the deleted branch, HEAD left unborn by a declined push and recovered without the flag, a missing branch still refused without it). `test/test.ancestry.node.ts` covers ancestors, the reverse direction, siblings, merges, unrelated histories, the same commit, invalid, missing and non-commit objects, a budget exceeded on a 20,000-commit history next to the exact answer, and a stalled walk whose Git process is killed. `test/test.remotetransfer.node.ts` serves fixtures through `git http-backend` over HTTPS with a private CA and over plain HTTP on `127.0.0.1` and `[::1]`, and covers credentialed mirror imports and refreshes, the source default branch on import and refresh, `setDefaultBranch()`, the push URL policy, atomic creates, updates and deletes, stale leases that change no ref, a remote without the `atomic` capability, 5,000 creates and 5,000 deletes in one receive-pack request with no command line naming a ref, a stale lease on the last of 1,500 updates that changes no ref, a pre-receive hook that declines a push and an update hook that declines one ref (the others failing as collateral), with their `remoteMessages`, the `reason` of every ref that is not `ok`, and the credential staying out of every command line, error and file. Its fixture can hold or refuse a receive-pack request, which covers a ref that moves between the listing and the push (the remote fails all 1,500 updates) and a `413` answer (`remoteLimitExceeded`, no ref changed). It can also withhold pack requests to stall a transfer midway, which covers aborting an import (no repository or scratch left), a refresh (refs and HEAD unchanged) and a push, a push aborted before it sends its updates that changes nothing, other commands and transfers completing while transfers stall, `repositoryBusy` (including `replaceRepository()`) and the Smart HTTP `503` while a mirror refreshes, an atomic refresh that prunes nothing when one ref update fails, a refresh that times out inside its ref transaction without leaving lock files, a refresh refused during a Smart HTTP push, the receive-pack guard ticket (refused while held, admitted after release, idempotent release, released by `stop()`, released when its preparation times out on the bridge after the engine issued it), a bounded `stop()` during a stalled transfer, and a credentialed loopback `http` push that never reaches the `http_proxy`, `all_proxy` and `ALL_PROXY` set in the engine's environment. `test/test.sshpush.node.ts` needs `/usr/sbin/sshd`, `ssh`, `ssh-keygen` and `git-shell`: it starts an unprivileged `sshd` on `127.0.0.1` whose authorized keys run `git-shell`, and records every `ssh` and `git` command line through PATH wrappers. It pins the OpenSSH client texts the engine classifies against the system `ssh`, and covers an accepted push with the key only as a `0600` file in a `0700` directory that is gone afterwards, leased updates and deletes, a stale lease and an up-to-date ref decided without `send-pack`, a PEM RSA key, a declining hook (`hook-declined` with the nonce in `remoteMessages`), the bounds, truncation marker and redaction of `remoteMessages`, `sshHostKeyMismatch` before the key is offered, an unoffered host key type, `sshAuthenticationFailed`, `remoteConnectionRefused`, `remoteProtocolError` for a missing repository, `atomicPushUnsupported`, the refusals of URLs, users, hosts, paths, keys and transport mismatches before `ssh` runs, an abort while `ssh` runs (directory removed), the startup sweep of a stale key directory, and no key text in any command line, error or engine log. `test/test.archiveinspection.node.ts` runs every ci-spec archive conformance vector through `inspectArchive()` as bytes and as a chunked stream, the compressed limit at its boundary, an 8 MiB streamed archive, an early refusal that closes the source, and abort, source failure and `stop()` during an inspection.
 
 ## License and Legal Information
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@foss.global/gitmanager',
-  version: '2.10.0',
+  version: '2.11.1',
   description: 'Headless Git manager for the foss.global Git platform, with a TypeScript API and Rust engine.'
 }

package/ts/classes.gitmanager.ts

@@ -61,25 +61,25 @@ const readinessDefaultTimeoutMs = 2_000;
 const readinessMaximumTimeoutMs = 30_000;
 const remoteTransferMaximumTimeoutMs = 21_600_000;
 
-/**
- * Checks transfer options before they reach the engine, which answers a
- * malformed credential-bearing request with fixed text only. Messages never
- * quote a credential value.
- */
-const assertRemoteTransferOptions = (optionsArg: IGitManagerRemoteTransferOptions): void => {
-  const { credential, caCertificates, timeoutMs } = optionsArg;
-  if (credential !== undefined) {
-    if (
-      credential === null
-      || typeof credential !== 'object'
-      || credential.kind !== 'basic'
-      || typeof credential.username !== 'string'
-      || typeof credential.password !== 'string'
-      || Object.keys(credential).some((key) => !['kind', 'username', 'password'].includes(key))
-    ) {
-      throw new TypeError('credential must be { kind: "basic", username: string, password: string }');
-    }
+/** Whether `valueArg` is an object with exactly `kind` and the named string fields. */
+const isCredentialShape = (valueArg: unknown, kindArg: string, fieldsArg: string[]): boolean => {
+  if (valueArg === null || typeof valueArg !== 'object') {
+    return false;
   }
+  const record = valueArg as Record<string, unknown>;
+  return record.kind === kindArg
+    && fieldsArg.every((field) => typeof record[field] === 'string')
+    && Object.keys(record).every((key) => key === 'kind' || fieldsArg.includes(key));
+};
+
+const basicCredentialFields = ['username', 'password'];
+const sshKeyCredentialFields = ['privateKey', 'hostKey'];
+
+/** Checks the CA bundle and the time limit of a remote transfer. */
+const assertTransferLimits = (
+  optionsArg: Pick<IGitManagerRemoteTransferOptions, 'caCertificates' | 'timeoutMs'>,
+): void => {
+  const { caCertificates, timeoutMs } = optionsArg;
   if (
     caCertificates !== undefined
     && (!Array.isArray(caCertificates) || caCertificates.some((certificate) => typeof certificate !== 'string'))
@@ -94,6 +94,38 @@ const assertRemoteTransferOptions = (optionsArg: IGitManagerRemoteTransferOption
   }
 };
 
+/**
+ * Checks transfer options before they reach the engine, which answers a
+ * malformed credential-bearing request with fixed text only. Messages never
+ * quote a credential value.
+ */
+const assertRemoteTransferOptions = (optionsArg: IGitManagerRemoteTransferOptions): void => {
+  const { credential } = optionsArg;
+  if (credential !== undefined && !isCredentialShape(credential, 'basic', basicCredentialFields)) {
+    throw new TypeError('credential must be { kind: "basic", username: string, password: string }');
+  }
+  assertTransferLimits(optionsArg);
+};
+
+/**
+ * Checks the options of a push, whose credential may also be an SSH key, as
+ * `assertRemoteTransferOptions` does. The engine validates the key, the host
+ * key and the URL.
+ */
+const assertAtomicPushOptions = (requestArg: IGitManagerAtomicPushRequest): void => {
+  const { credential } = requestArg;
+  if (
+    credential !== undefined
+    && !isCredentialShape(credential, 'basic', basicCredentialFields)
+    && !isCredentialShape(credential, 'sshKey', sshKeyCredentialFields)
+  ) {
+    throw new TypeError(
+      'credential must be { kind: "basic", username: string, password: string } or { kind: "sshKey", privateKey: string, hostKey: string }',
+    );
+  }
+  assertTransferLimits(requestArg);
+};
+
 /**
  * Checks the shape of push updates before they reach the engine, which
  * answers a malformed request with fixed text only. Ref names and object IDs
@@ -463,7 +495,22 @@ export class GitManager extends plugins.EventEmitter {
    * throws `remoteLimitExceeded`, and nothing is pushed. `remoteUrl` must
    * be `https`, or `http` to a loopback IP address (`127.0.0.0/8`, `[::1]`;
    * never a host name such as `localhost`), without user information; the
-   * credential travels as for `importMirror`. A ref that already holds its
+   * credential travels as for `importMirror`.
+   *
+   * With an `sshKey` credential, and only with one, `remoteUrl` is
+   * `ssh://<user>@<host>[:<port>]/<path>` and the push runs over the system
+   * `ssh` client: the key exists for the push only, as a file readable by the
+   * engine alone, and the remote must present exactly the pinned `hostKey`.
+   * A failure before the remote's ref advertisement throws one of
+   * `sshHostKeyMismatch`, `sshAuthenticationFailed`,
+   * `remoteConnectionRefused`, `remoteConnectionFailed` or
+   * `remoteProtocolError`, and nothing is pushed. An `sshKey` credential
+   * without an `ssh://` URL, an `ssh://` URL without one, and
+   * `caCertificates` with one throw `remoteTransportMismatch` before anything
+   * runs. `remoteMessages` holds the remote's `remote:` lines, such as a
+   * hook's output, for every transport.
+   *
+   * A ref that already holds its
    * `newObjectId` is reported `ok` without its lease being checked; it is not
    * changed, so `ok` never means the lease matched. Any refusal the remote
    * reports per ref returns status `rejected`, with the refused refs `stale`
@@ -484,7 +531,7 @@ export class GitManager extends plugins.EventEmitter {
     optionsArg: IGitManagerTransferControlOptions = {},
   ): Promise<IGitManagerAtomicPushResult> {
     this.assertRunning();
-    assertRemoteTransferOptions(requestArg);
+    assertAtomicPushOptions(requestArg);
     assertAtomicPushUpdates(requestArg.updates);
     return this.bridge.pushRefs(requestArg, optionsArg);
   }

package/ts/classes.gitmanagererror.ts

@@ -13,6 +13,12 @@ const gitManagerErrorCodes: ReadonlySet<string> = new Set<TGitManagerErrorCode>(
   'transferAborted',
   'repositoryBusy',
   'lfsScanLimitExceeded',
+  'sshHostKeyMismatch',
+  'sshAuthenticationFailed',
+  'remoteConnectionRefused',
+  'remoteConnectionFailed',
+  'remoteProtocolError',
+  'remoteTransportMismatch',
 ]);
 
 export const isGitManagerErrorCode = (valueArg: unknown): valueArg is TGitManagerErrorCode =>

package/ts/models.ts

@@ -180,6 +180,29 @@ export interface IGitManagerArchiveInspection {
  * - `lfsScanLimitExceeded`: the Git LFS pointer scan of
  *   `listRepositoryLfsPointers()` exceeded one of its bounds; the message
  *   names the bound. The pointer set is unknown, never empty.
+ *
+ * An SSH push (`pushRefs()` with an `sshKey` credential) that fails before
+ * the remote's ref advertisement is complete throws one of the following;
+ * nothing was pushed. They are classified from the exit status 255 and the
+ * fixed texts of the local OpenSSH client, and the message carries ssh's
+ * redacted standard error for operator logs only.
+ *
+ * - `sshHostKeyMismatch`: the remote's host key is not the pinned `hostKey`;
+ *   the key was never offered.
+ * - `sshAuthenticationFailed`: the remote refused the SSH key.
+ * - `remoteConnectionRefused`: the remote host refused the TCP connection.
+ * - `remoteConnectionFailed`: any other failure of the SSH connection, such
+ *   as an unknown host, a timeout of the connection, or a server that does
+ *   not offer the pinned key's type.
+ * - `remoteProtocolError`: the remote command ran but did not answer with a
+ *   Git receive-pack advertisement (or one without `report-status`), such as
+ *   a forge that refuses SSH with a message or a missing repository.
+ *
+ * - `remoteTransportMismatch`: a push's credential or options do not fit the
+ *   transport of its `remoteUrl`: an `sshKey` credential without an
+ *   `ssh://` URL, an `ssh://` URL without an `sshKey` credential, or
+ *   `caCertificates` with an `sshKey` credential. Refused before anything
+ *   runs; nothing was pushed.
  */
 export type TGitManagerErrorCode =
   | 'invalidObjectId'
@@ -193,7 +216,13 @@ export type TGitManagerErrorCode =
   | 'remoteLimitExceeded'
   | 'transferAborted'
   | 'repositoryBusy'
-  | 'lfsScanLimitExceeded';
+  | 'lfsScanLimitExceeded'
+  | 'sshHostKeyMismatch'
+  | 'sshAuthenticationFailed'
+  | 'remoteConnectionRefused'
+  | 'remoteConnectionFailed'
+  | 'remoteProtocolError'
+  | 'remoteTransportMismatch';
 
 export interface IGitManagerRepositoryLfsPointer {
   oid: string;
@@ -385,6 +414,7 @@ export type {
   IGitManagerRefRequest,
   IGitManagerRefreshMirrorRequest,
   IGitManagerRemoteBasicCredential,
+  IGitManagerRemoteSshKeyCredential,
   IGitManagerRemoteTransferOptions,
   IGitManagerRepositoryInfo,
   IGitManagerRepositorySelector,
@@ -394,6 +424,7 @@ export type {
   IGitManagerTagRequest,
   IGitManagerTreeEntry,
   IGitManagerTreeRequest,
+  TGitManagerAtomicPushCredential,
   TGitManagerAtomicPushRefReason,
   TGitManagerAtomicPushRefStatus,
   TGitManagerDiffFileStatus,