@git.zone/cli 6.4.0 → 6.6.0

package/assets/templates/asset_tspack_release_gitea/.gitea/workflows/release.yml

@@ -0,0 +1,60 @@
+name: Sealed release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+concurrency:
+  group: sealed-release-${-{ github.repository }-}-${-{ github.ref }-}
+  cancel-in-progress: false
+
+jobs:
+  build-and-release:
+    runs-on: ubuntu-latest
+    container:
+      image: code.foss.global/host.today/ht-docker-node:latest
+    steps:
+      - name: Checkout exact source
+        uses: https://github.com/actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Set up pinned Deno
+        uses: https://github.com/denoland/setup-deno@e95548e56dfa95d4e1a28d6f422fafe75c4c26fb # v2.0.3
+        with:
+          deno-version: '{{assets.sealedRelease.denoVersion}}'
+      - name: Install frozen dependencies
+        run: pnpm install --frozen-lockfile
+      - name: Find the original retained release
+        id: retention
+        env:
+          GITHUB_TOKEN: ${-{ secrets.GITHUB_TOKEN }-}
+        run: node scripts/gitzone-sealed-release.mjs discover
+      - name: Build and seal new artifacts
+        if: steps.retention.outputs.retained != 'true'
+        id: prepared
+        run: node scripts/gitzone-sealed-release.mjs prepare
+      # Gitea's legacy Actions artifact protocol is supported by the v3 actions.
+      - name: Retain the complete output before publication
+        if: steps.retention.outputs.retained != 'true'
+        uses: https://github.com/actions/upload-artifact@c6a3b2bd78b3985e4b2f15397fec357f0fd808de # v3.2.2-node20
+        with:
+          name: ${-{ steps.retention.outputs.artifact }-}
+          path: ${-{ steps.retention.outputs.output }-}/
+          if-no-files-found: error
+          retention-days: 90
+      - name: Download retained bytes into a fresh directory
+        uses: https://github.com/actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
+        with:
+          name: ${-{ steps.retention.outputs.artifact }-}
+          path: dist_gitzone_retained
+      - name: Verify retained component and complete archives
+        env:
+          EXPECTED_MANIFEST: ${-{ steps.prepared.outputs.manifest }-}
+        run: node scripts/gitzone-sealed-release.mjs restore
+      - name: Publish or resume the verified draft
+        env:
+          GITHUB_TOKEN: ${-{ secrets.GITHUB_TOKEN }-}
+          EXPECTED_MANIFEST: ${-{ steps.prepared.outputs.manifest }-}
+        run: node scripts/gitzone-sealed-release.mjs publish

package/assets/templates/asset_tspack_release_gitea/scripts/gitzone-release-api.mjs

@@ -0,0 +1,150 @@
+// Managed by GitZone's asset_tspack_release_gitea template.
+import { createHash } from 'node:crypto';
+
+const requireValue = (value, message) => { if (!value) throw new Error(message); };
+const identifier = (value) => Number.isSafeInteger(value) && value > 0;
+
+/** Gitea transport for retained, already-verified TsPack files. No compiler or packer runs here. */
+export class GiteaSealedRelease {
+  constructor({ server, repository, token, fetch: fetchArg = globalThis.fetch }) {
+    const origin = new URL(server);
+    requireValue(origin.protocol === 'https:' && !origin.username && !origin.password &&
+      origin.pathname === '/' && !origin.search && !origin.hash &&
+      /^[a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+$/.test(repository) && typeof token === 'string' && token.length > 0,
+    'Expected an HTTPS Gitea origin, repository and job token.');
+    this.origin = origin.origin;
+    this.base = `${origin.origin}/api/v1/repos/${repository}`;
+    this.token = token;
+    this.fetch = fetchArg;
+  }
+
+  async response(url, options = {}, expected = [200]) {
+    requireValue(new URL(url).origin === this.origin, 'Refusing to send a job token outside Gitea.');
+    let response;
+    try {
+      response = await this.fetch(url, { ...options, redirect: 'error',
+        signal: AbortSignal.timeout(15 * 60 * 1000),
+        headers: { ...options.headers, Authorization: `token ${this.token}` } });
+    } catch { throw new Error('Gitea request failed; retain this run and retry it.'); }
+    requireValue(expected.includes(response.status), `Unexpected Gitea HTTP status ${response.status}; retain this run and retry it.`);
+    return response;
+  }
+
+  async json(path, options = {}, expected = [200]) {
+    const response = await this.response(`${this.base}${path}`, options, expected);
+    if (response.status === 404) return null;
+    const chunks = []; let size = 0;
+    for await (const chunk of response.body) {
+      size += chunk.length;
+      requireValue(size <= 4 * 1024 * 1024, 'Gitea metadata exceeds its limit.');
+      chunks.push(chunk);
+    }
+    try { return JSON.parse(Buffer.concat(chunks).toString('utf8')); }
+    catch { throw new Error('Gitea returned invalid metadata.'); }
+  }
+
+  async findRetention({ name, runId, tag }) {
+    requireValue(/^tspack-(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(name) && identifier(runId) && /^v\d+\.\d+\.\d+$/.test(tag), 'Invalid release retention identity.');
+    const result = await this.json(`/actions/artifacts?name=${name}`);
+    requireValue(Array.isArray(result?.artifacts) && result.artifacts.every((item) => item.name === name) &&
+      result.total_count === result.artifacts.length && result.artifacts.length <= 1,
+    'Release retention is incomplete or ambiguous; inspect the original run.');
+    const artifact = result.artifacts[0];
+    if (artifact) {
+      requireValue(identifier(artifact.id) && identifier(artifact.workflow_run?.id) &&
+        artifact.workflow_run.head_sha === name.slice(7) && artifact.expired === false && artifact.size_in_bytes > 0,
+      'Retained release expired or is incomplete; recover its original bytes.');
+      requireValue(artifact.workflow_run.id === runId, `Retained release belongs to run ${artifact.workflow_run.id}; rerun that original run.`);
+      return artifact.id;
+    }
+    requireValue(await this.json(`/releases/tags/${tag}`, {}, [200, 404]) === null,
+      'A release exists without retained artifacts in this run; recover the original bytes before retrying.');
+    return null;
+  }
+
+  assertRelease(release, tag, commit) {
+    requireValue(identifier(release?.id) && release.tag_name === tag && release.target_commitish === commit &&
+      typeof release.draft === 'boolean' && release.prerelease === false,
+    'Existing release does not match this sealed source identity.');
+  }
+
+  async download(urlArg) {
+    let url = new URL(urlArg);
+    requireValue(url.origin === this.origin, 'Unexpected release attachment origin.');
+    for (let redirects = 0; redirects <= 5; redirects++) {
+      requireValue(url.protocol === 'https:' && !url.username && !url.password, 'Unsafe attachment redirect.');
+      let response;
+      try {
+        response = await this.fetch(url.href, { redirect: 'manual', signal: AbortSignal.timeout(15 * 60 * 1000),
+          headers: url.origin === this.origin ? { Authorization: `token ${this.token}` } : {} });
+      } catch { throw new Error('Gitea attachment download failed.'); }
+      if (response.status === 200) return response;
+      requireValue([301, 302, 303, 307, 308].includes(response.status) && response.headers.get('location'), 'Unexpected attachment download response.');
+      await response.body?.cancel();
+      url = new URL(response.headers.get('location'), url);
+    }
+    throw new Error('Too many attachment redirects.');
+  }
+
+  async verifyAssets(releaseId, files, complete) {
+    const assets = await this.json(`/releases/${releaseId}/assets`);
+    requireValue(Array.isArray(assets) && assets.length <= files.length, 'Unexpected release attachments.');
+    const found = new Set();
+    for (const asset of assets) {
+      const file = files.find((item) => item.name === asset.name);
+      requireValue(file && identifier(asset.id) && !found.has(asset.name) && asset.size === file.size &&
+        typeof asset.browser_download_url === 'string', 'Release attachment identity conflict.');
+      const response = await this.download(asset.browser_download_url);
+      const hash = createHash('sha256'); let size = 0;
+      for await (const chunk of response.body) {
+        size += chunk.length;
+        requireValue(size <= file.size, 'Release attachment exceeds its sealed size.');
+        hash.update(chunk);
+      }
+      requireValue(size === file.size && hash.digest('hex') === file.sha256, 'Release attachment digest conflict.');
+      found.add(file.name);
+    }
+    requireValue(!complete || found.size === files.length, 'Release attachments are incomplete.');
+    return found;
+  }
+
+  async publish({ tag, commit, manifestSha256, files }) {
+    requireValue(/^v\d+\.\d+\.\d+$/.test(tag) && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit) &&
+      /^[a-f0-9]{64}$/.test(manifestSha256) && Array.isArray(files) && files.length >= 3 && files.length <= 130 &&
+      new Set(files.map((file) => file.name)).size === files.length &&
+      files.every((file) => /^[a-zA-Z0-9_.-]+$/.test(file.name) && Number.isSafeInteger(file.size) && file.size > 0 &&
+        /^[a-f0-9]{64}$/.test(file.sha256) && typeof file.blob === 'function') &&
+      files.some((file) => file.name === 'tspack-manifest.json' && file.sha256 === manifestSha256) &&
+      files.some((file) => file.name === 'SHA256SUMS.txt'), 'Expected a verified sealed artifact set.');
+    const remoteTag = await this.json(`/tags/${tag}`);
+    requireValue(remoteTag?.name === tag && remoteTag.commit?.sha === commit, 'Remote tag does not identify the sealed source.');
+    let release = await this.json(`/releases/tags/${tag}`, {}, [200, 404]);
+    if (!release) {
+      release = await this.json('/releases', { method: 'POST', headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ tag_name: tag, target_commitish: commit, name: tag,
+          body: `Sealed TsPack release. Manifest SHA-256: ${manifestSha256}. See changelog.md at this tag.`,
+          draft: true, prerelease: false }) }, [201]);
+    }
+    this.assertRelease(release, tag, commit);
+    const found = await this.verifyAssets(release.id, files, !release.draft);
+    if (!release.draft) return { id: release.id, published: true, reused: true };
+    for (const file of files) {
+      if (found.has(file.name)) continue;
+      const form = new FormData();
+      const blob = await file.blob();
+      requireValue(blob.size === file.size, 'Local sealed attachment changed before upload.');
+      form.set('attachment', blob, file.name);
+      const asset = await this.json(`/releases/${release.id}/assets?name=${file.name}`, { method: 'POST', body: form }, [201]);
+      requireValue(identifier(asset?.id) && asset.name === file.name && asset.size === file.size, 'Invalid attachment upload acknowledgement.');
+    }
+    await this.verifyAssets(release.id, files, true);
+    const finalTag = await this.json(`/tags/${tag}`);
+    requireValue(finalTag?.commit?.sha === commit, 'Remote tag changed during publication.');
+    const published = await this.json(`/releases/${release.id}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' },
+      body: JSON.stringify({ draft: false }) });
+    this.assertRelease(published, tag, commit);
+    requireValue(published.draft === false, 'Gitea did not confirm publication.');
+    await this.verifyAssets(published.id, files, true);
+    return { id: published.id, published: true, reused: false };
+  }
+}

package/assets/templates/asset_tspack_release_gitea/scripts/gitzone-sealed-release.mjs

@@ -0,0 +1,122 @@
+// Managed by GitZone's asset_tspack_release_gitea template.
+import * as fs from 'node:fs/promises';
+import { createReadStream, openAsBlob } from 'node:fs';
+import * as path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { createHash } from 'node:crypto';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { GiteaSealedRelease } from './gitzone-release-api.mjs';
+
+const exec = promisify(execFile);
+const requireValue = (value, message) => { if (!value) throw new Error(message); };
+const readJson = async (file) => {
+  const stat = await fs.lstat(file);
+  requireValue(stat.isFile() && stat.size <= 1024 * 1024, 'Expected bounded regular release metadata.');
+  const bytes = await fs.readFile(file);
+  requireValue(bytes.length <= 1024 * 1024, 'Release metadata exceeds its limit.');
+  try { return JSON.parse(bytes.toString('utf8')); } catch { throw new Error('Invalid release metadata.'); }
+};
+const digest = async (file) => {
+  const hash = createHash('sha256'); let size = 0;
+  for await (const chunk of createReadStream(file)) { hash.update(chunk); size += chunk.length; }
+  return { size, sha256: hash.digest('hex') };
+};
+
+try {
+  const root = await fs.realpath(fileURLToPath(new URL('../', import.meta.url)));
+  const packageJson = await readJson(path.join(root, 'package.json'));
+  const cli = (await readJson(path.join(root, '.smartconfig.json')))['@git.zone/cli'];
+  const config = cli?.assets?.sealedRelease;
+  const command = process.argv[2];
+  requireValue(process.argv.length === 3 && ['discover', 'prepare', 'restore', 'publish'].includes(command), 'Select discover, prepare, restore or publish.');
+  requireValue(/^[a-zA-Z0-9_-]+$/.test(config?.outputDirectory) && config.outputDirectory.startsWith('dist_'),
+    'Sealed release outputDirectory must be a single dist_ directory.');
+  const output = path.join(root, config.outputDirectory);
+  const incoming = path.join(root, 'dist_gitzone_retained');
+  requireValue(output !== incoming, 'Release output conflicts with the retention download directory.');
+  const commit = (await exec('git', ['rev-parse', 'HEAD'], { cwd: root })).stdout.trim();
+  const tag = `v${packageJson.version}`;
+  requireValue(/^v\d+\.\d+\.\d+$/.test(tag) && /^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(commit) &&
+    process.env.GITHUB_REF === `refs/tags/${tag}` && process.env.GITHUB_SHA === commit &&
+    !(await exec('git', ['status', '--porcelain'], { cwd: root })).stdout.trim() &&
+    (await exec('git', ['rev-parse', `${tag}^{commit}`], { cwd: root })).stdout.trim() === commit,
+  'Release job requires the exact clean tagged package source.');
+  const ignoredPaths = [`${config.outputDirectory}/.probe`, 'dist_gitzone_retained/.probe'];
+  requireValue((await exec('git', ['check-ignore', ...ignoredPaths], { cwd: root })).stdout.trim().split('\n').join() === ignoredPaths.join(),
+    'Both release output directories must be Git-ignored.');
+  const artifactName = `tspack-${commit}`;
+  const repository = `${cli.module.gitscope}/${cli.module.gitrepo}`;
+  requireValue(process.env.GITHUB_REPOSITORY === repository, 'Release job repository mismatch.');
+  const api = () => new GiteaSealedRelease({ server: `https://${cli.module.githost}`, repository, token: process.env.GITHUB_TOKEN });
+  const setOutputs = async (values) => {
+    requireValue(process.env.GITHUB_OUTPUT, 'Expected the Actions step output file.');
+    await fs.appendFile(process.env.GITHUB_OUTPUT, Object.entries(values).map(([key, value]) => `${key}=${value}\n`).join(''));
+  };
+  const runAdapter = async (args) => {
+    requireValue(Array.isArray(args) && args.length > 0 && args.every((value) => typeof value === 'string' && !value.includes('\0')), 'Expected an explicit component command argument array.');
+    const environment = { ...process.env };
+    delete environment.GITHUB_TOKEN;
+    delete environment.ACTIONS_RUNTIME_TOKEN;
+    let result;
+    try { result = await exec(args[0], args.slice(1), { cwd: root, env: environment, maxBuffer: 1024 * 1024, timeout: 30 * 60 * 1000 }); }
+    catch { throw new Error('Component preparation or verification failed. Run its committed command to inspect the build.'); }
+    try { return JSON.parse(result.stdout); } catch { throw new Error('Component command must return one JSON packaging result.'); }
+  };
+  const verify = async (result) => {
+    requireValue(typeof result?.directory === 'string' && /^[a-f0-9]{64}$/.test(result.manifestSha256), 'Invalid component packaging result.');
+    const directory = path.resolve(root, result.directory);
+    requireValue(path.dirname(directory) === output && await fs.realpath(directory) === directory &&
+      await fs.realpath(output) === output, 'Sealed directory must be canonical and directly inside the configured output root.');
+    const { TsPack } = await import('@git.zone/tspack');
+    const verified = await new TsPack(root).verify(directory, { requireRelease: true,
+      expectedManifestSha256: result.manifestSha256, expectedSourceCommit: commit });
+    requireValue(verified.manifest.packageName === packageJson.name && verified.manifest.version === packageJson.version,
+      'Sealed package identity mismatch.');
+    return { directory, manifestSha256: result.manifestSha256, manifest: verified.manifest };
+  };
+  const receiptFile = path.join(output, 'gitzone-release.json');
+  if (command === 'discover') {
+    const retained = await api().findRetention({ name: artifactName, runId: Number(process.env.GITHUB_RUN_ID), tag });
+    await setOutputs({ artifact: artifactName, retained: retained ? 'true' : 'false', output: config.outputDirectory });
+  } else if (command === 'prepare') {
+    requireValue(await fs.lstat(output).then(() => false, (error) => { if (error.code === 'ENOENT') return true; throw error; }),
+      'Fresh preparation requires an absent output root; reuse retained output instead.');
+    const verified = await verify(await runAdapter(config.prepareCommand));
+    await fs.writeFile(receiptFile, `${JSON.stringify({ format: 'gitzone.sealed-release.v1', tag, commit,
+      directory: path.basename(verified.directory), manifestSha256: verified.manifestSha256 }, null, 2)}\n`, { flag: 'wx' });
+    await setOutputs({ manifest: verified.manifestSha256 });
+  } else {
+    if (command === 'restore') {
+      requireValue(await fs.realpath(incoming) === incoming, 'Expected a fresh canonical artifact download.');
+      // Only this job's ignored compiler output is replaced, after the remote artifact download succeeds.
+      const existing = await fs.lstat(output).catch((error) => { if (error.code === 'ENOENT') return null; throw error; });
+      requireValue(!existing || (existing.isDirectory() && !existing.isSymbolicLink()), 'Unsafe existing release output.');
+      if (existing) await fs.rm(output, { recursive: true });
+      await fs.rename(incoming, output);
+    }
+    const receipt = await readJson(receiptFile);
+    requireValue(receipt.format === 'gitzone.sealed-release.v1' && receipt.tag === tag && receipt.commit === commit &&
+      /^[a-zA-Z0-9_.-]+$/.test(receipt.directory) && /^[a-f0-9]{64}$/.test(receipt.manifestSha256) &&
+      (!process.env.EXPECTED_MANIFEST || process.env.EXPECTED_MANIFEST === receipt.manifestSha256), 'Retained release receipt mismatch.');
+    const verified = await verify(await runAdapter(config.verifyCommand));
+    requireValue(verified.directory === path.join(output, receipt.directory) && verified.manifestSha256 === receipt.manifestSha256,
+      'Component reuse does not match the retained release receipt.');
+    if (command === 'publish') {
+      requireValue((await exec('git', ['rev-parse', 'HEAD'], { cwd: root })).stdout.trim() === commit &&
+        !(await exec('git', ['status', '--porcelain'], { cwd: root })).stdout.trim(), 'Source changed during component verification.');
+      requireValue(await api().findRetention({ name: artifactName, runId: Number(process.env.GITHUB_RUN_ID), tag }), 'Publication requires retained artifacts.');
+      const files = [];
+      for (const name of [...verified.manifest.artifacts.map((file) => file.name), 'tspack-manifest.json', 'SHA256SUMS.txt']) {
+        const file = path.join(verified.directory, name);
+        files.push({ name, ...await digest(file), blob: () => openAsBlob(file) });
+      }
+      console.log(JSON.stringify(await api().publish({ tag, commit, manifestSha256: verified.manifestSha256, files })));
+    } else console.log(JSON.stringify({ restored: true, manifestSha256: verified.manifestSha256 }));
+  }
+} catch (error) {
+  // Deliberately omit transport errors, subprocess output, response bodies and token-bearing URLs.
+  console.error(error instanceof Error && error.message && !error.message.includes('\n') && !error.message.includes('://')
+    ? error.message : 'Sealed release operation failed. Retain the original run and its artifacts.');
+  process.exitCode = 1;
+}

package/dist_ts/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@git.zone/cli',
-    version: '6.4.0',
+    version: '6.6.0',
     description: 'A comprehensive CLI tool for enhancing and managing local development workflows with gitzone utilities, focusing on project setup, version control, code formatting, and template management.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSxlQUFlO0lBQ3JCLE9BQU8sRUFBRSxPQUFPO0lBQ2hCLFdBQVcsRUFBRSwrTEFBK0w7Q0FDN00sQ0FBQSJ9

package/dist_ts/helpers.sealedrelease.d.ts

@@ -0,0 +1,2 @@
+/** Shared validation for the formatter and config doctor. Commands are literal argv. */
+export declare const getSealedReleaseConfigError: (value: unknown) => string | undefined;

package/dist_ts/helpers.sealedrelease.js

@@ -0,0 +1,14 @@
+/** Shared validation for the formatter and config doctor. Commands are literal argv. */
+export const getSealedReleaseConfigError = (value) => {
+    const config = value;
+    if (!config || typeof config !== 'object' || Array.isArray(config) ||
+        typeof config.denoVersion !== 'string' || !/^\d+\.\d+\.\d+$/.test(config.denoVersion) ||
+        typeof config.outputDirectory !== 'string' || !/^dist_[a-zA-Z0-9_-]+$/.test(config.outputDirectory) ||
+        config.outputDirectory === 'dist_gitzone_retained' ||
+        !['prepareCommand', 'verifyCommand'].every((key) => Array.isArray(config[key]) && config[key].length > 0 &&
+            config[key].every((item) => typeof item === 'string' && item.length > 0 && !item.includes('\0')))) {
+        return 'tspackRelease requires a pinned Deno version, a dist_ output directory and explicit prepare/verify command arrays.';
+    }
+    return undefined;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaGVscGVycy5zZWFsZWRyZWxlYXNlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHMvaGVscGVycy5zZWFsZWRyZWxlYXNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLHdGQUF3RjtBQUN4RixNQUFNLENBQUMsTUFBTSwyQkFBMkIsR0FBRyxDQUFDLEtBQWMsRUFBc0IsRUFBRTtJQUNoRixNQUFNLE1BQU0sR0FBRyxLQUF1QyxDQUFDO0lBQ3ZELElBQUksQ0FBQyxNQUFNLElBQUksT0FBTyxNQUFNLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO1FBQzlELE9BQU8sTUFBTSxDQUFDLFdBQVcsS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQztRQUNyRixPQUFPLE1BQU0sQ0FBQyxlQUFlLEtBQUssUUFBUSxJQUFJLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUM7UUFDbkcsTUFBTSxDQUFDLGVBQWUsS0FBSyx1QkFBdUI7UUFDbEQsQ0FBQyxDQUFDLGdCQUFnQixFQUFFLGVBQWUsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsSUFBSSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7WUFDdEcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQWEsRUFBRSxFQUFFLENBQUMsT0FBTyxJQUFJLEtBQUssUUFBUSxJQUFJLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNqSCxPQUFPLG9IQUFvSCxDQUFDO0lBQzlILENBQUM7SUFDRCxPQUFPLFNBQVMsQ0FBQztBQUNuQixDQUFDLENBQUMifQ==