@idp.global/sdk 18.0.0 → 18.1.0

package/dist_ts_relyingparty/classes.relyingpartysessions.js

@@ -0,0 +1,786 @@
+import { SecretBox } from './classes.secretbox.js';
+import { AuthorityTokenError, LoginCallbackError, RelyingPartyError, RelyingPartyRefusal, } from './classes.errors.js';
+import { OidcCompletionError, OidcRefreshRefusedError, } from './classes.idpoidcprovider.js';
+import { parseCookies, serializeClearedCookie, serializeCookie } from './helpers.cookies.js';
+import { deriveCsrfToken, randomToken, sha256, timingSafeEqualString } from './helpers.crypto.js';
+import { sanitizeReturnPath } from './helpers.returnpath.js';
+export const RELYING_PARTY_DEFAULT_SESSION_MAX_AGE_SECONDS = 12 * 60 * 60;
+export const RELYING_PARTY_DEFAULT_LOGIN_PATH_PREFIX = '/auth/';
+/** The label the CSRF HMAC starts with unless the application names its own. */
+export const RELYING_PARTY_DEFAULT_CSRF_LABEL = 'idp.global/sdk relyingparty csrf' + String.fromCharCode(0);
+const MAX_COOKIE_TOKEN_LENGTH = 256;
+const SESSION_TOUCH_INTERVAL_MS = 60_000;
+/** A sign-in transaction has to survive an interactive login at the provider, not a working day. */
+export const LOGIN_ATTEMPT_MAX_AGE_SECONDS = 10 * 60;
+/** Attempts are swept once they are this much older than their expiry. */
+const LOGIN_ATTEMPT_SWEEP_GRACE_MS = 60 * 60 * 1_000;
+/** How many of them one sign-in removes; the next sign-in takes the following page. */
+const LOGIN_ATTEMPT_SWEEP_BATCH = 100;
+/**
+ * How long ending a session waits for the provider to take its tokens back.
+ * The local session is already revoked when that call runs.
+ */
+export const TOKEN_REVOCATION_BUDGET_MS = 3_000;
+/** How long before its expiry the provider access token is rotated. */
+export const ACCESS_TOKEN_REFRESH_SKEW_MS = 60_000;
+/**
+ * What the refresh lock adds on top of the provider request it has to cover:
+ * the claim and the store around it, and clock disagreement between replicas.
+ */
+export const REFRESH_LOCK_MARGIN_MS = 20_000;
+const REVOKED_TOKEN_FIELDS = { sealedAccessToken: '', sealedRefreshToken: '', refreshLockUntil: 0 };
+const errorMessage = (errorArg) => (errorArg instanceof Error ? errorArg.message : String(errorArg));
+/** Browsers store a cookie with one of these prefixes only when it is set `Secure`; they match it case-insensitively. */
+const SECURE_COOKIE_NAME_PREFIX = /^__(host|secure)-/i;
+const cookieNameFor = (configuredArg, defaultArg, secureArg, labelArg) => {
+    if (configuredArg === undefined) {
+        return defaultArg;
+    }
+    if (!secureArg && SECURE_COOKIE_NAME_PREFIX.test(configuredArg)) {
+        throw new Error(`cookieNames.${labelArg} "${configuredArg}" needs an https publicOrigin: `
+            + 'browsers drop a __Host- or __Secure- cookie that is not set Secure');
+    }
+    return configuredArg;
+};
+/**
+ * The relying-party session layer: provider logins through the authorization
+ * code flow with PKCE, HttpOnly cookie sessions with a session-bound CSRF
+ * token, provider tokens sealed at rest and rotated under a cross-replica
+ * lock, and session ends that hand the tokens back.
+ *
+ * Nothing here runs on a timer: expired login attempts are swept when the next
+ * login starts, and the only timer — the revocation budget — is unreferenced
+ * and cleared on every path.
+ */
+export class RelyingPartySessions {
+    publicOrigin;
+    secureCookies;
+    sessionCookieName;
+    intentCookieName;
+    loginPathPrefix;
+    sessionMaxAgeSeconds;
+    #models;
+    #principals;
+    #provider;
+    #secretBox;
+    #csrfKey;
+    #csrfLabel;
+    #hooks;
+    #now;
+    /** one rotation per session in this process, however many requests need it at once */
+    #refreshesInFlight = new Map();
+    constructor(optionsArg) {
+        const origin = new URL(optionsArg.publicOrigin);
+        if (origin.origin !== optionsArg.publicOrigin) {
+            throw new Error('publicOrigin must be a bare origin such as https://app.example');
+        }
+        if (!Buffer.isBuffer(optionsArg.csrfKey) || optionsArg.csrfKey.length !== 32) {
+            throw new Error('csrfKey must be 32 bytes');
+        }
+        const maxAge = optionsArg.sessionMaxAgeSeconds ?? RELYING_PARTY_DEFAULT_SESSION_MAX_AGE_SECONDS;
+        if (!Number.isSafeInteger(maxAge) || maxAge < 1) {
+            throw new Error('sessionMaxAgeSeconds must be a positive integer');
+        }
+        this.publicOrigin = origin.origin;
+        this.secureCookies = origin.protocol === 'https:';
+        const prefix = this.secureCookies ? '__Host-' : '';
+        this.sessionCookieName = cookieNameFor(optionsArg.cookieNames?.session, prefix + 'idp_rp_session', this.secureCookies, 'session');
+        this.intentCookieName = cookieNameFor(optionsArg.cookieNames?.intent, prefix + 'idp_rp_intent', this.secureCookies, 'intent');
+        this.loginPathPrefix = optionsArg.loginPathPrefix ?? RELYING_PARTY_DEFAULT_LOGIN_PATH_PREFIX;
+        if (!this.loginPathPrefix.startsWith('/') || !this.loginPathPrefix.endsWith('/')) {
+            throw new Error('loginPathPrefix must start and end with a slash');
+        }
+        this.sessionMaxAgeSeconds = maxAge;
+        this.#models = optionsArg.models;
+        this.#principals = optionsArg.principals;
+        this.#provider = optionsArg.provider;
+        this.#secretBox = new SecretBox(optionsArg.sessionEncryptionKey);
+        this.#csrfKey = Buffer.from(optionsArg.csrfKey);
+        this.#csrfLabel = optionsArg.csrfLabel ?? RELYING_PARTY_DEFAULT_CSRF_LABEL;
+        this.#hooks = optionsArg.hooks ?? {};
+        this.#now = optionsArg.now ?? (() => Date.now());
+    }
+    /** Whether provider logins are offered at all. */
+    get providerLoginEnabled() {
+        return this.#provider !== undefined;
+    }
+    /**
+     * How long one replica holds the right to rotate a session's tokens. The
+     * provider detects reuse of a superseded refresh token and kills the family,
+     * so the lock strictly outlives its longest possible holder: one provider
+     * request at its full deadline plus the margin.
+     */
+    get refreshLockMs() {
+        return (this.#provider?.requestTimeoutSeconds ?? 0) * 1_000 + REFRESH_LOCK_MARGIN_MS;
+    }
+    // ==========================================================================
+    // sessions
+    // ==========================================================================
+    /**
+     * Opens a session the application authenticated itself (a local password
+     * login). It carries no provider tokens.
+     */
+    async openSession(optionsArg) {
+        if (typeof optionsArg?.principalId !== 'string' || optionsArg.principalId.length === 0) {
+            throw new Error('openSession needs a principal id');
+        }
+        const token = randomToken(32);
+        const session = this.newSessionDoc(token, optionsArg.principalId);
+        await session.save();
+        return this.opening(session, token);
+    }
+    /** The live session behind the session cookie, or `null`. A read touches it at most once a minute. */
+    async resolveCookieSession(cookieHeaderArg) {
+        const token = parseCookies(cookieHeaderArg).get(this.sessionCookieName);
+        if (!token || token.length > MAX_COOKIE_TOKEN_LENGTH) {
+            return null;
+        }
+        const session = await this.#models.Session.getInstance({ tokenHash: sha256(token) });
+        const live = await this.liveSession(session);
+        if (!live) {
+            return null;
+        }
+        return { session: this.snapshot(live), csrfToken: this.csrfTokenOf(token) };
+    }
+    /**
+     * Re-checks a session by its id with the same strength as a cookie request:
+     * live, its principal active, and touched under the liveness it was read
+     * with. What a pinned socket connection runs per request.
+     */
+    async revalidateSession(sessionIdArg) {
+        if (typeof sessionIdArg !== 'string' || sessionIdArg.length === 0) {
+            return null;
+        }
+        const live = await this.liveSession(await this.#models.Session.getInstance({ id: sessionIdArg }));
+        return live ? this.snapshot(live) : null;
+    }
+    /** Whether a session is live right now, without touching it; what a sweep asks. */
+    async isSessionLive(sessionIdArg) {
+        if (typeof sessionIdArg !== 'string' || sessionIdArg.length === 0) {
+            return false;
+        }
+        const session = await this.#models.Session.getInstance({ id: sessionIdArg });
+        if (!session || session.revokedAt !== undefined || session.expiresAt <= this.#now()) {
+            return false;
+        }
+        return this.#principals.isActive(session.userId);
+    }
+    validateCsrf(resolvedArg, candidateArg) {
+        return typeof candidateArg === 'string' && timingSafeEqualString(resolvedArg.csrfToken, candidateArg);
+    }
+    /** Ends one session; see `endSession`. */
+    async logout(sessionIdArg) {
+        return this.endSession(sessionIdArg);
+    }
+    /**
+     * Revokes a session once, with one conditional update: a touch running
+     * beside it cannot write the revocation away, and a second call finds
+     * nothing. Its provider tokens go back within `TOKEN_REVOCATION_BUDGET_MS`,
+     * after the local revocation, which never depends on the provider. Answers
+     * whether this call ended it.
+     */
+    async endSession(sessionIdArg, reasonArg = 'logout') {
+        const ended = await this.revokeSession(sessionIdArg, reasonArg);
+        if (ended) {
+            await this.revokeSealedTokens(ended);
+        }
+        return ended !== null;
+    }
+    /**
+     * Ends every live session of a principal but `keepSessionId` (a password
+     * change keeps the session that asked for it) and answers how many ended.
+     */
+    async endSessionsOfPrincipal(principalIdArg, optionsArg = {}) {
+        let ended = 0;
+        const sessions = await this.#models.Session.getInstances({
+            userId: principalIdArg,
+            revokedAt: { $exists: false },
+        });
+        for (const session of sessions) {
+            if (session.id === optionsArg.keepSessionId) {
+                continue;
+            }
+            if (await this.endSession(session.id)) {
+                ended += 1;
+            }
+        }
+        return ended;
+    }
+    clearSessionCookie() {
+        return serializeClearedCookie(this.sessionCookieName, {
+            httpOnly: true,
+            secure: this.secureCookies,
+            sameSite: 'Lax',
+        });
+    }
+    clearIntentCookie() {
+        return serializeClearedCookie(this.intentCookieName, {
+            httpOnly: true,
+            secure: this.secureCookies,
+            sameSite: 'Lax',
+        });
+    }
+    // ==========================================================================
+    // provider login
+    // ==========================================================================
+    /**
+     * Starts a sign-in transaction: one attempt document with the PKCE verifier
+     * sealed next to it, and an intent cookie that binds the callback to this
+     * browser.
+     */
+    async startLogin(returnPathArg) {
+        const provider = this.requireProvider();
+        await this.sweepExpiredAttempts();
+        const state = randomToken(32);
+        const nonce = randomToken(32);
+        const pkceVerifier = randomToken(32);
+        const bindingToken = randomToken(32);
+        const now = this.#now();
+        const attempt = new this.#models.LoginAttempt();
+        attempt.id = 'lga_' + randomToken(18);
+        attempt.stateHash = sha256(state);
+        attempt.bindingTokenHash = sha256(bindingToken);
+        attempt.sealedPkceVerifier = this.#secretBox.seal(pkceVerifier);
+        attempt.nonce = nonce;
+        attempt.returnPath = sanitizeReturnPath(returnPathArg, this.publicOrigin, this.loginPathPrefix);
+        attempt.createdAt = now;
+        attempt.expiresAt = now + LOGIN_ATTEMPT_MAX_AGE_SECONDS * 1_000;
+        await attempt.save();
+        return {
+            authorizationUrl: await provider.buildAuthorizationUrl({ state, nonce, pkceVerifier }),
+            intentCookie: serializeCookie(this.intentCookieName, bindingToken, {
+                httpOnly: true,
+                secure: this.secureCookies,
+                sameSite: 'Lax',
+                maxAgeSeconds: LOGIN_ATTEMPT_MAX_AGE_SECONDS,
+            }),
+        };
+    }
+    /**
+     * Consumes the attempt exactly once, exchanges the code, admits the
+     * principal and opens a session. A replayed callback, a foreign intent
+     * cookie and an expired attempt all find nothing to consume. Nothing of a
+     * failed login survives: its tokens are handed back before the failure
+     * leaves.
+     */
+    async completeLogin(callbackUrlArg, cookieHeaderArg) {
+        const provider = this.requireProvider();
+        const states = callbackUrlArg.searchParams.getAll('state');
+        if (states.length !== 1 || !states[0]) {
+            throw new RelyingPartyError('invalid_login_callback');
+        }
+        const bindingToken = parseCookies(cookieHeaderArg).get(this.intentCookieName);
+        if (!bindingToken || bindingToken.length > MAX_COOKIE_TOKEN_LENGTH) {
+            throw new RelyingPartyError('missing_login_intent');
+        }
+        const now = this.#now();
+        const claimed = await this.#models.LoginAttempt.atomicFindOneAndUpdate({
+            stateHash: sha256(states[0]),
+            bindingTokenHash: sha256(bindingToken),
+            consumedAt: null,
+            expiresAt: { $gt: now },
+        }, { $set: { consumedAt: now } }, { returnDocument: 'after' });
+        if (claimed.status !== 'matched' || !claimed.document) {
+            throw new RelyingPartyError('invalid_or_replayed_login');
+        }
+        const attempt = claimed.document;
+        let completion;
+        let stage = 'token_exchange';
+        try {
+            completion = await provider.completeAuthorization({
+                callbackUrl: callbackUrlArg,
+                state: states[0],
+                nonce: attempt.nonce,
+                pkceVerifier: this.#secretBox.open(attempt.sealedPkceVerifier),
+            });
+            stage = 'principal_admission';
+            const { principalId } = await this.#principals.admit(completion);
+            stage = 'session_persistence';
+            return await this.createProviderSession(attempt, principalId, completion);
+        }
+        catch (error) {
+            if (completion) {
+                await this.revokeCompletionTokens(completion);
+            }
+            if (error instanceof RelyingPartyError || error instanceof RelyingPartyRefusal) {
+                throw error;
+            }
+            if (error instanceof OidcCompletionError) {
+                throw new LoginCallbackError(error.stage, error);
+            }
+            throw new LoginCallbackError(stage, error);
+        }
+    }
+    /**
+     * The provider sent the browser back without a code. The attempt is
+     * consumed so its state can never complete afterwards; a callback that
+     * matches no open attempt leaves nothing to do.
+     */
+    async abandonLogin(callbackUrlArg, cookieHeaderArg) {
+        const states = callbackUrlArg.searchParams.getAll('state');
+        const bindingToken = parseCookies(cookieHeaderArg).get(this.intentCookieName);
+        if (states.length !== 1
+            || !states[0]
+            || !bindingToken
+            || bindingToken.length > MAX_COOKIE_TOKEN_LENGTH) {
+            return;
+        }
+        await this.#models.LoginAttempt.atomicUpdate({ stateHash: sha256(states[0]), bindingTokenHash: sha256(bindingToken), consumedAt: null }, { $set: { consumedAt: this.#now() } });
+    }
+    /**
+     * The last step of a login: the browser arrives with both cookies, and the
+     * return path is released only when the session cookie belongs to the
+     * session this very attempt created.
+     */
+    async finalizeLogin(cookieHeaderArg) {
+        this.requireProvider();
+        const bindingToken = parseCookies(cookieHeaderArg).get(this.intentCookieName);
+        if (!bindingToken || bindingToken.length > MAX_COOKIE_TOKEN_LENGTH) {
+            throw new RelyingPartyError('invalid_login_finalize');
+        }
+        const attempt = await this.#models.LoginAttempt.getInstance({ bindingTokenHash: sha256(bindingToken) });
+        if (!attempt
+            || attempt.consumedAt === undefined
+            || attempt.consumedAt === null
+            || !attempt.createdSessionId
+            || attempt.expiresAt <= this.#now()) {
+            throw new RelyingPartyError('invalid_login_finalize');
+        }
+        const resolved = await this.resolveCookieSession(cookieHeaderArg);
+        if (!resolved
+            || resolved.session.id !== attempt.createdSessionId
+            || resolved.session.loginAttemptId !== attempt.id) {
+            throw new RelyingPartyError('invalid_login_finalize');
+        }
+        return sanitizeReturnPath(attempt.returnPath, this.publicOrigin, this.loginPathPrefix);
+    }
+    // ==========================================================================
+    // provider tokens
+    // ==========================================================================
+    /**
+     * An access token of this login session that is usable right now. A token
+     * within `ACCESS_TOKEN_REFRESH_SKEW_MS` of its expiry — or one whose expiry
+     * is unknown — is rotated first. The session has to belong to
+     * `expectedPrincipalIdArg`, so a credential is never evaluated with another
+     * person's tokens.
+     */
+    async liveProviderToken(sessionIdArg, expectedPrincipalIdArg) {
+        const session = await this.#models.Session.getInstance({ id: sessionIdArg });
+        const now = this.#now();
+        if (!session
+            || session.revokedAt !== undefined
+            || session.expiresAt <= now
+            || !session.idpSubject
+            || session.userId !== expectedPrincipalIdArg) {
+            throw new AuthorityTokenError('authority_login_required');
+        }
+        const subject = session.idpSubject;
+        const expiresAt = typeof session.accessTokenExpiresAt === 'number' ? session.accessTokenExpiresAt : 0;
+        const accessToken = this.openSealed(session.sealedAccessToken);
+        // an unknown expiry is rotated too: afterwards the lifetime is known
+        const due = accessToken === undefined || expiresAt === 0 || expiresAt <= now + ACCESS_TOKEN_REFRESH_SKEW_MS;
+        if (!due && accessToken !== undefined) {
+            return { accessToken, subject, expiresAt };
+        }
+        if (!session.sealedRefreshToken) {
+            if (accessToken !== undefined && (expiresAt === 0 || expiresAt > now)) {
+                // nothing to rotate with, and the token is not known to be dead
+                return { accessToken, subject, expiresAt };
+            }
+            await this.endProviderSession(sessionIdArg, 'access_token_unusable');
+            throw new AuthorityTokenError('authority_login_required');
+        }
+        return this.refreshProviderToken(sessionIdArg, subject);
+    }
+    async refreshProviderToken(sessionIdArg, subjectArg) {
+        const running = this.#refreshesInFlight.get(sessionIdArg);
+        if (running) {
+            return running;
+        }
+        const pending = this.runProviderRefresh(sessionIdArg, subjectArg).finally(() => {
+            this.#refreshesInFlight.delete(sessionIdArg);
+        });
+        this.#refreshesInFlight.set(sessionIdArg, pending);
+        return pending;
+    }
+    async runProviderRefresh(sessionIdArg, subjectArg) {
+        const provider = this.#provider;
+        if (!provider) {
+            throw new AuthorityTokenError('authority_unavailable');
+        }
+        const now = this.#now();
+        const lockUntil = now + this.refreshLockMs;
+        const claimed = await this.#models.Session.atomicFindOneAndUpdate({
+            id: sessionIdArg,
+            revokedAt: { $exists: false },
+            expiresAt: { $gt: now },
+            // a lock another replica holds is left alone until it expires
+            $or: [{ refreshLockUntil: { $lt: now } }, { refreshLockUntil: { $exists: false } }],
+        }, { $set: { refreshLockUntil: lockUntil } }, { returnDocument: 'after' });
+        if (claimed.status !== 'matched' || !claimed.document) {
+            return this.tokenAfterForeignRefresh(sessionIdArg, subjectArg);
+        }
+        const session = claimed.document;
+        // the lock holder decides on the state it just read: a rotation that
+        // landed in between is used as it stands, because spending a superseded
+        // refresh token would be reuse and would kill the family
+        const claimedExpiry = typeof session.accessTokenExpiresAt === 'number' ? session.accessTokenExpiresAt : 0;
+        const claimedToken = this.openSealed(session.sealedAccessToken);
+        if (claimedToken !== undefined && claimedExpiry > this.#now() + ACCESS_TOKEN_REFRESH_SKEW_MS) {
+            await this.#models.Session.atomicUpdate({ id: sessionIdArg, revokedAt: { $exists: false }, refreshLockUntil: lockUntil }, { $set: { refreshLockUntil: 0 } });
+            return { accessToken: claimedToken, subject: subjectArg, expiresAt: claimedExpiry };
+        }
+        const refreshToken = this.openSealed(session.sealedRefreshToken);
+        if (refreshToken === undefined) {
+            await this.endProviderSession(sessionIdArg, 'sealed_refresh_token_unreadable');
+            throw new AuthorityTokenError('authority_login_required');
+        }
+        let rotated;
+        try {
+            rotated = await provider.refreshTokens(refreshToken);
+        }
+        catch (error) {
+            if (error instanceof OidcRefreshRefusedError) {
+                await this.endProviderSession(sessionIdArg, 'refresh_token_refused');
+                throw new AuthorityTokenError('authority_login_required', error);
+            }
+            this.emit({ event: 'idp_token_refresh_failed', sessionId: sessionIdArg, message: errorMessage(error) });
+            throw new AuthorityTokenError('authority_unavailable', error);
+        }
+        // the rotated pair replaces the old one under this lock, and only while
+        // the session is live: a logout in between leaves the update unmatched
+        let matched;
+        try {
+            const written = await this.#models.Session.atomicUpdate({ id: sessionIdArg, revokedAt: { $exists: false }, refreshLockUntil: lockUntil }, {
+                $set: {
+                    sealedAccessToken: this.#secretBox.seal(rotated.accessToken),
+                    ...(rotated.refreshToken ? { sealedRefreshToken: this.#secretBox.seal(rotated.refreshToken) } : {}),
+                    accessTokenExpiresAt: rotated.accessTokenExpiresAt,
+                    refreshLockUntil: 0,
+                },
+            });
+            matched = written.matchedCount;
+        }
+        catch (error) {
+            // the provider has superseded the old pair and nothing here can name the
+            // new one: it goes back at once, the lock expires on its own, and the
+            // request fails closed
+            await this.revokeRotatedTokens(rotated);
+            this.emit({ event: 'idp_token_store_failed', sessionId: sessionIdArg, message: errorMessage(error) });
+            throw new AuthorityTokenError('authority_unavailable', error);
+        }
+        if (matched === 0) {
+            await this.revokeRotatedTokens(rotated);
+            this.notifySessionEnded({ sessionId: sessionIdArg, reason: 'revoked_elsewhere', revokedHere: false });
+            throw new AuthorityTokenError('authority_login_required');
+        }
+        return { accessToken: rotated.accessToken, subject: subjectArg, expiresAt: rotated.accessTokenExpiresAt };
+    }
+    /**
+     * Another replica is rotating this session right now. Whatever it has
+     * written by the time this request looks again is used; otherwise the
+     * request fails closed and the next one finds the rotated pair.
+     */
+    async tokenAfterForeignRefresh(sessionIdArg, subjectArg) {
+        const session = await this.#models.Session.getInstance({ id: sessionIdArg });
+        const now = this.#now();
+        const expiresAt = typeof session?.accessTokenExpiresAt === 'number' ? session.accessTokenExpiresAt : 0;
+        const accessToken = session ? this.openSealed(session.sealedAccessToken) : undefined;
+        if (session
+            && session.revokedAt === undefined
+            && session.expiresAt > now
+            && accessToken !== undefined
+            && expiresAt > now + ACCESS_TOKEN_REFRESH_SKEW_MS) {
+            return { accessToken, subject: subjectArg, expiresAt };
+        }
+        throw new AuthorityTokenError('authority_unavailable');
+    }
+    // ==========================================================================
+    // internals
+    // ==========================================================================
+    requireProvider() {
+        if (!this.#provider) {
+            throw new RelyingPartyError('login_method_unavailable');
+        }
+        return this.#provider;
+    }
+    newSessionDoc(tokenArg, principalIdArg) {
+        const now = this.#now();
+        const session = new this.#models.Session();
+        session.id = 'ses_' + randomToken(18);
+        session.tokenHash = sha256(tokenArg);
+        session.userId = principalIdArg;
+        session.createdAt = now;
+        session.lastSeenAt = now;
+        session.expiresAt = now + this.sessionMaxAgeSeconds * 1_000;
+        return session;
+    }
+    csrfTokenOf(tokenArg) {
+        return deriveCsrfToken(tokenArg, this.#csrfKey, this.#csrfLabel);
+    }
+    opening(sessionArg, tokenArg) {
+        return {
+            session: this.snapshot(sessionArg),
+            csrfToken: this.csrfTokenOf(tokenArg),
+            sessionCookie: serializeCookie(this.sessionCookieName, tokenArg, {
+                httpOnly: true,
+                secure: this.secureCookies,
+                sameSite: 'Lax',
+                maxAgeSeconds: this.sessionMaxAgeSeconds,
+            }),
+        };
+    }
+    snapshot(sessionArg) {
+        return {
+            id: sessionArg.id,
+            principalId: sessionArg.userId,
+            createdAt: sessionArg.createdAt,
+            lastSeenAt: sessionArg.lastSeenAt,
+            expiresAt: sessionArg.expiresAt,
+            ...(sessionArg.idpSubject ? { idpSubject: sessionArg.idpSubject } : {}),
+            ...(sessionArg.loginAttemptId ? { loginAttemptId: sessionArg.loginAttemptId } : {}),
+        };
+    }
+    /** A session document that is live right now with an active principal, touched at most once a minute. */
+    async liveSession(sessionArg) {
+        const now = this.#now();
+        if (!sessionArg || sessionArg.revokedAt !== undefined || sessionArg.expiresAt <= now) {
+            return null;
+        }
+        if (!(await this.#principals.isActive(sessionArg.userId))) {
+            return null;
+        }
+        if (now - sessionArg.lastSeenAt > SESSION_TOUCH_INTERVAL_MS) {
+            // the touch carries the liveness it was read under into the write: a
+            // revocation that landed in between leaves it unmatched
+            const touched = await this.#models.Session.atomicUpdate({ id: sessionArg.id, revokedAt: { $exists: false }, expiresAt: { $gt: now } }, { $set: { lastSeenAt: now } });
+            if (touched.matchedCount === 0) {
+                return null;
+            }
+            sessionArg.lastSeenAt = now;
+        }
+        return sessionArg;
+    }
+    async createProviderSession(attemptArg, principalIdArg, completionArg) {
+        const token = randomToken(32);
+        const session = this.newSessionDoc(token, principalIdArg);
+        session.idpSubject = completionArg.subject;
+        session.loginAttemptId = attemptArg.id;
+        session.sealedAccessToken = this.#secretBox.seal(completionArg.accessToken);
+        session.sealedRefreshToken = completionArg.refreshToken ? this.#secretBox.seal(completionArg.refreshToken) : '';
+        session.accessTokenExpiresAt = completionArg.accessTokenExpiresAt;
+        session.refreshLockUntil = 0;
+        await session.save();
+        const linked = await this.#models.LoginAttempt.atomicUpdate({ id: attemptArg.id, createdSessionId: null }, { $set: { createdSessionId: session.id } });
+        if (linked.matchedCount !== 1) {
+            // the attempt was consumed by another callback in the meantime
+            await this.discardUnopenedSession(session.id);
+            throw new RelyingPartyError('invalid_or_replayed_login');
+        }
+        const opening = this.opening(session, token);
+        try {
+            await this.#hooks.onProviderSessionOpened?.({ session: opening.session });
+        }
+        catch (error) {
+            // the cookie never leaves, so the session is unreachable: it is revoked
+            // and its sealed tokens erased before the application's error goes on;
+            // the caller hands the provider tokens back
+            try {
+                await this.discardUnopenedSession(session.id);
+            }
+            catch (discardError) {
+                this.emit({ event: 'session_discard_failed', sessionId: session.id, message: errorMessage(discardError) });
+            }
+            throw error;
+        }
+        return opening;
+    }
+    /** Revokes a session that was never handed out and erases its sealed tokens. */
+    async discardUnopenedSession(sessionIdArg) {
+        await this.#models.Session.atomicUpdate({ id: sessionIdArg, revokedAt: { $exists: false } }, { $set: { revokedAt: this.#now(), ...REVOKED_TOKEN_FIELDS } });
+    }
+    /**
+     * Tells the application a session ended. Its hook never stands between the
+     * local revocation and the provider revocation: a throw or a rejection is
+     * reported as `hook_failed` and the end runs on.
+     */
+    notifySessionEnded(eventArg) {
+        const hook = this.#hooks.onSessionEnded;
+        if (!hook) {
+            return;
+        }
+        const reportFailure = (errorArg) => {
+            this.emit({ event: 'hook_failed', hook: 'onSessionEnded', sessionId: eventArg.sessionId, message: errorMessage(errorArg) });
+        };
+        try {
+            const result = hook.call(this.#hooks, eventArg);
+            if (result instanceof Promise) {
+                result.catch(reportFailure);
+            }
+        }
+        catch (error) {
+            reportFailure(error);
+        }
+    }
+    /**
+     * The conditional revocation every end of a session runs. Answers the
+     * sealed tokens it took off the session when this call revoked it, `null`
+     * when the session was already over.
+     */
+    async revokeSession(sessionIdArg, reasonArg) {
+        if (typeof sessionIdArg !== 'string' || sessionIdArg.length === 0) {
+            return null;
+        }
+        const revoked = await this.#models.Session.atomicFindOneAndUpdate({ id: sessionIdArg, revokedAt: { $exists: false } }, { $set: { revokedAt: this.#now(), ...REVOKED_TOKEN_FIELDS } }, { returnDocument: 'before' });
+        const revokedHere = revoked.status === 'matched' && revoked.document !== null;
+        this.notifySessionEnded({ sessionId: sessionIdArg, reason: reasonArg, revokedHere });
+        if (!revokedHere) {
+            return null;
+        }
+        const before = revoked.document;
+        return { sealedAccessToken: before.sealedAccessToken, sealedRefreshToken: before.sealedRefreshToken };
+    }
+    /** The provider says the login is over: the session ends here without asking it anything more. */
+    async endProviderSession(sessionIdArg, reasonArg) {
+        if (await this.revokeSession(sessionIdArg, reasonArg)) {
+            this.emit({ event: 'idp_session_ended', sessionId: sessionIdArg, reason: reasonArg });
+        }
+    }
+    /**
+     * Hands the tokens of an ended session back, best-effort and within the
+     * budget. A sealed value this deployment can no longer open is skipped.
+     */
+    async revokeSealedTokens(sealedArg) {
+        if (!this.#provider || (!sealedArg.sealedAccessToken && !sealedArg.sealedRefreshToken)) {
+            return;
+        }
+        await this.withinRevocationBudget(async () => {
+            for (const [sealed, hint] of [
+                [sealedArg.sealedRefreshToken, 'refresh_token'],
+                [sealedArg.sealedAccessToken, 'access_token'],
+            ]) {
+                if (!sealed) {
+                    continue;
+                }
+                const token = this.openSealed(sealed);
+                if (token === undefined) {
+                    this.emit({ event: 'oidc_sealed_token_unreadable', hint, message: 'The sealed provider token could not be opened' });
+                    continue;
+                }
+                await this.revokeToken(token, hint);
+            }
+        });
+    }
+    async revokeRotatedTokens(rotatedArg) {
+        await this.withinRevocationBudget(async () => {
+            if (rotatedArg.refreshToken) {
+                await this.revokeToken(rotatedArg.refreshToken, 'refresh_token');
+            }
+            await this.revokeToken(rotatedArg.accessToken, 'access_token');
+        });
+    }
+    async revokeCompletionTokens(completionArg) {
+        await this.withinRevocationBudget(async () => {
+            if (completionArg.refreshToken) {
+                await this.revokeToken(completionArg.refreshToken, 'refresh_token');
+            }
+            await this.revokeToken(completionArg.accessToken, 'access_token');
+        });
+    }
+    async revokeToken(tokenArg, hintArg) {
+        try {
+            await this.#provider?.revokeToken(tokenArg, hintArg);
+        }
+        catch (error) {
+            // the local session is gone either way; the provider expires the token
+            this.emit({ event: 'oidc_token_revocation_failed', hint: hintArg, message: errorMessage(error) });
+        }
+    }
+    /**
+     * Runs a best-effort provider step under `TOKEN_REVOCATION_BUDGET_MS`. What
+     * is still in flight at the deadline keeps running and ends on the provider
+     * client's own request timeout; only the waiting stops. The timer is cleared
+     * on every path and unreferenced.
+     */
+    async withinRevocationBudget(workArg) {
+        let timer;
+        const work = workArg().then(() => 'done', (errorArg) => {
+            this.emit({ event: 'oidc_token_revocation_failed', message: errorMessage(errorArg) });
+            return 'done';
+        });
+        const deadline = new Promise((resolveArg) => {
+            timer = setTimeout(() => resolveArg('deadline'), TOKEN_REVOCATION_BUDGET_MS);
+            timer.unref();
+        });
+        try {
+            if ((await Promise.race([work, deadline])) === 'deadline') {
+                this.emit({
+                    event: 'oidc_token_revocation_timed_out',
+                    message: 'The provider did not answer within the revocation budget',
+                });
+            }
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /** A sealed value this deployment can still open, or `undefined`. */
+    openSealed(sealedArg) {
+        if (!sealedArg) {
+            return undefined;
+        }
+        try {
+            return this.#secretBox.open(sealedArg);
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * Removes attempts an hour past their expiry, one bounded page per login
+     * start. A sweep that cannot run never blocks a sign-in.
+     */
+    async sweepExpiredAttempts() {
+        try {
+            const page = await this.#models.LoginAttempt.getPagedInstances({
+                filter: { expiresAt: { $lt: this.#now() - LOGIN_ATTEMPT_SWEEP_GRACE_MS } },
+                sortField: 'expiresAt',
+                sortDirection: 'asc',
+                limit: LOGIN_ATTEMPT_SWEEP_BATCH,
+            });
+            for (const attempt of page.documents) {
+                await this.#models.LoginAttempt.atomicDelete({ id: attempt.id });
+            }
+        }
+        catch (error) {
+            this.emit({ event: 'login_attempt_sweep_failed', message: errorMessage(error) });
+        }
+    }
+    /**
+     * Reports one diagnostic. Every cleanup step reports through here, so a
+     * throwing sink must not end it: the event and the sink's failure go to
+     * `console.error` instead.
+     */
+    emit(eventArg) {
+        const sink = this.#hooks.onEvent;
+        if (!sink) {
+            console.error(JSON.stringify(eventArg));
+            return;
+        }
+        const reportFailure = (errorArg) => {
+            const failure = { event: 'hook_failed', hook: 'onEvent', message: errorMessage(errorArg) };
+            console.error(JSON.stringify(failure));
+            console.error(JSON.stringify(eventArg));
+        };
+        try {
+            const result = sink.call(this.#hooks, eventArg);
+            if (result instanceof Promise) {
+                result.catch(reportFailure);
+            }
+        }
+        catch (error) {
+            reportFailure(error);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yZWx5aW5ncGFydHlzZXNzaW9ucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzX3JlbHlpbmdwYXJ0eS9jbGFzc2VzLnJlbHlpbmdwYXJ0eXNlc3Npb25zLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxTQUFTLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNuRCxPQUFPLEVBQ0wsbUJBQW1CLEVBQ25CLGtCQUFrQixFQUNsQixpQkFBaUIsRUFDakIsbUJBQW1CLEdBQ3BCLE1BQU0scUJBQXFCLENBQUM7QUFDN0IsT0FBTyxFQUNMLG1CQUFtQixFQUNuQix1QkFBdUIsR0FLeEIsTUFBTSw4QkFBOEIsQ0FBQztBQUV0QyxPQUFPLEVBQUUsWUFBWSxFQUFFLHNCQUFzQixFQUFFLGVBQWUsRUFBRSxNQUFNLHNCQUFzQixDQUFDO0FBQzdGLE9BQU8sRUFBRSxlQUFlLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxxQkFBcUIsRUFBRSxNQUFNLHFCQUFxQixDQUFDO0FBQ2xHLE9BQU8sRUFBRSxrQkFBa0IsRUFBRSxNQUFNLHlCQUF5QixDQUFDO0FBZTdELE1BQU0sQ0FBQyxNQUFNLDZDQUE2QyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDO0FBQzFFLE1BQU0sQ0FBQyxNQUFNLHVDQUF1QyxHQUFHLFFBQVEsQ0FBQztBQUNoRSxnRkFBZ0Y7QUFDaEYsTUFBTSxDQUFDLE1BQU0sZ0NBQWdDLEdBQUcsa0NBQWtDLEdBQUcsTUFBTSxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUU1RyxNQUFNLHVCQUF1QixHQUFHLEdBQUcsQ0FBQztBQUNwQyxNQUFNLHlCQUF5QixHQUFHLE1BQU0sQ0FBQztBQUN6QyxvR0FBb0c7QUFDcEcsTUFBTSxDQUFDLE1BQU0sNkJBQTZCLEdBQUcsRUFBRSxHQUFHLEVBQUUsQ0FBQztBQUNyRCwwRUFBMEU7QUFDMUUsTUFBTSw0QkFBNEIsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztBQUNyRCx1RkFBdUY7QUFDdkYsTUFBTSx5QkFBeUIsR0FBRyxHQUFHLENBQUM7QUFDdEM7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sMEJBQTBCLEdBQUcsS0FBSyxDQUFDO0FBQ2hELHVFQUF1RTtBQUN2RSxNQUFNLENBQUMsTUFBTSw0QkFBNEIsR0FBRyxNQUFNLENBQUM7QUFDbkQ7OztHQUdHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsTUFBTSxDQUFDO0FBa0M3QyxNQUFNLG9CQUFvQixHQUFHLEVBQUUsaUJBQWlCLEVBQUUsRUFBRSxFQUFFLGtCQUFrQixFQUFFLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxDQUFDLEVBQUUsQ0FBQztBQUVwRyxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRSxDQUFDLENBQUMsUUFBUSxZQUFZLEtBQUssQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFFdEgseUhBQXlIO0FBQ3pILE1BQU0seUJBQXlCLEdBQUcsb0JBQW9CLENBQUM7QUFFdkQsTUFBTSxhQUFhLEdBQUcsQ0FDcEIsYUFBaUMsRUFDakMsVUFBa0IsRUFDbEIsU0FBa0IsRUFDbEIsUUFBOEIsRUFDdEIsRUFBRTtJQUNWLElBQUksYUFBYSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ2hDLE9BQU8sVUFBVSxDQUFDO0lBQ3BCLENBQUM7SUFDRCxJQUFJLENBQUMsU0FBUyxJQUFJLHlCQUF5QixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sSUFBSSxLQUFLLENBQ2IsZUFBZSxRQUFRLEtBQUssYUFBYSxpQ0FBaUM7Y0FDdEUsb0VBQW9FLENBQ3pFLENBQUM7SUFDSixDQUFDO0lBQ0QsT0FBTyxhQUFhLENBQUM7QUFDdkIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7OztHQVNHO0FBQ0gsTUFBTSxPQUFPLG9CQUFvQjtJQUNmLFlBQVksQ0FBUztJQUNyQixhQUFhLENBQVU7SUFDdkIsaUJBQWlCLENBQVM7SUFDMUIsZ0JBQWdCLENBQVM7SUFDekIsZUFBZSxDQUFTO0lBQ3hCLG9CQUFvQixDQUFTO0lBQ3BDLE9BQU8sQ0FBc0I7SUFDN0IsV0FBVyxDQUEwQjtJQUNyQyxTQUFTLENBQWlCO0lBQzFCLFVBQVUsQ0FBWTtJQUN0QixRQUFRLENBQVM7SUFDakIsVUFBVSxDQUFTO0lBQ25CLE1BQU0sQ0FBcUI7SUFDM0IsSUFBSSxDQUFlO0lBQzVCLHNGQUFzRjtJQUM3RSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsRUFBbUMsQ0FBQztJQUV6RSxZQUFZLFVBQXdDO1FBQ2xELE1BQU0sTUFBTSxHQUFHLElBQUksR0FBRyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNoRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQzlDLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUNwRixDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxJQUFJLFVBQVUsQ0FBQyxPQUFPLENBQUMsTUFBTSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQzdFLE1BQU0sSUFBSSxLQUFLLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUM5QyxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLG9CQUFvQixJQUFJLDZDQUE2QyxDQUFDO1FBQ2hHLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxJQUFJLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUNELElBQUksQ0FBQyxZQUFZLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztRQUNsQyxJQUFJLENBQUMsYUFBYSxHQUFHLE1BQU0sQ0FBQyxRQUFRLEtBQUssUUFBUSxDQUFDO1FBQ2xELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ25ELElBQUksQ0FBQyxpQkFBaUIsR0FBRyxhQUFhLENBQ3BDLFVBQVUsQ0FBQyxXQUFXLEVBQUUsT0FBTyxFQUMvQixNQUFNLEdBQUcsZ0JBQWdCLEVBQ3pCLElBQUksQ0FBQyxhQUFhLEVBQ2xCLFNBQVMsQ0FDVixDQUFDO1FBQ0YsSUFBSSxDQUFDLGdCQUFnQixHQUFHLGFBQWEsQ0FDbkMsVUFBVSxDQUFDLFdBQVcsRUFBRSxNQUFNLEVBQzlCLE1BQU0sR0FBRyxlQUFlLEVBQ3hCLElBQUksQ0FBQyxhQUFhLEVBQ2xCLFFBQVEsQ0FDVCxDQUFDO1FBQ0YsSUFBSSxDQUFDLGVBQWUsR0FBRyxVQUFVLENBQUMsZUFBZSxJQUFJLHVDQUF1QyxDQUFDO1FBQzdGLElBQUksQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDakYsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFDRCxJQUFJLENBQUMsb0JBQW9CLEdBQUcsTUFBTSxDQUFDO1FBQ25DLElBQUksQ0FBQyxPQUFPLEdBQUcsVUFBVSxDQUFDLE1BQU0sQ0FBQztRQUNqQyxJQUFJLENBQUMsV0FBVyxHQUFHLFVBQVUsQ0FBQyxVQUFVLENBQUM7UUFDekMsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxTQUFTLENBQUMsVUFBVSxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDakUsSUFBSSxDQUFDLFFBQVEsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNoRCxJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQyxTQUFTLElBQUksZ0NBQWdDLENBQUM7UUFDM0UsSUFBSSxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQztRQUNyQyxJQUFJLENBQUMsSUFBSSxHQUFHLFVBQVUsQ0FBQyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztJQUNuRCxDQUFDO0lBRUQsa0RBQWtEO0lBQ2xELElBQVcsb0JBQW9CO1FBQzdCLE9BQU8sSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUM7SUFDdEMsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0gsSUFBVyxhQUFhO1FBQ3RCLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLHFCQUFxQixJQUFJLENBQUMsQ0FBQyxHQUFHLEtBQUssR0FBRyxzQkFBc0IsQ0FBQztJQUN2RixDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLFdBQVc7SUFDWCw2RUFBNkU7SUFFN0U7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxVQUFtQztRQUMxRCxJQUFJLE9BQU8sVUFBVSxFQUFFLFdBQVcsS0FBSyxRQUFRLElBQUksVUFBVSxDQUFDLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDdkYsTUFBTSxJQUFJLEtBQUssQ0FBQyxrQ0FBa0MsQ0FBQyxDQUFDO1FBQ3RELENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ2xFLE1BQU0sT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3JCLE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDdEMsQ0FBQztJQUVELHNHQUFzRztJQUMvRixLQUFLLENBQUMsb0JBQW9CLENBQy9CLGVBQTBDO1FBRTFDLE1BQU0sS0FBSyxHQUFHLFlBQVksQ0FBQyxlQUFlLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLEtBQUssSUFBSSxLQUFLLENBQUMsTUFBTSxHQUFHLHVCQUF1QixFQUFFLENBQUM7WUFDckQsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxTQUFTLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNyRixNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDN0MsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ1YsT0FBTyxJQUFJLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7SUFDOUUsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsaUJBQWlCLENBQUMsWUFBb0I7UUFDakQsSUFBSSxPQUFPLFlBQVksS0FBSyxRQUFRLElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNsRSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQyxDQUFDO1FBQ2xHLE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUM7SUFDM0MsQ0FBQztJQUVELG1GQUFtRjtJQUM1RSxLQUFLLENBQUMsYUFBYSxDQUFDLFlBQW9CO1FBQzdDLElBQUksT0FBTyxZQUFZLEtBQUssUUFBUSxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbEUsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxFQUFFLEVBQUUsWUFBWSxFQUFFLENBQUMsQ0FBQztRQUM3RSxJQUFJLENBQUMsT0FBTyxJQUFJLE9BQU8sQ0FBQyxTQUFTLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxTQUFTLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUM7WUFDcEYsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVNLFlBQVksQ0FBQyxXQUF5QyxFQUFFLFlBQXFCO1FBQ2xGLE9BQU8sT0FBTyxZQUFZLEtBQUssUUFBUSxJQUFJLHFCQUFxQixDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsWUFBWSxDQUFDLENBQUM7SUFDeEcsQ0FBQztJQUVELDBDQUEwQztJQUNuQyxLQUFLLENBQUMsTUFBTSxDQUFDLFlBQW9CO1FBQ3RDLE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUN2QyxDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksS0FBSyxDQUFDLFVBQVUsQ0FDckIsWUFBb0IsRUFDcEIsWUFBMkMsUUFBUTtRQUVuRCxNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ2hFLElBQUksS0FBSyxFQUFFLENBQUM7WUFDVixNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QyxDQUFDO1FBQ0QsT0FBTyxLQUFLLEtBQUssSUFBSSxDQUFDO0lBQ3hCLENBQUM7SUFFRDs7O09BR0c7SUFDSSxLQUFLLENBQUMsc0JBQXNCLENBQ2pDLGNBQXNCLEVBQ3RCLGFBQXlDLEVBQUU7UUFFM0MsSUFBSSxLQUFLLEdBQUcsQ0FBQyxDQUFDO1FBQ2QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7WUFDdkQsTUFBTSxFQUFFLGNBQWM7WUFDdEIsU0FBUyxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRTtTQUM5QixDQUFDLENBQUM7UUFDSCxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLElBQUksT0FBTyxDQUFDLEVBQUUsS0FBSyxVQUFVLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQzVDLFNBQVM7WUFDWCxDQUFDO1lBQ0QsSUFBSSxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RDLEtBQUssSUFBSSxDQUFDLENBQUM7WUFDYixDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUVNLGtCQUFrQjtRQUN2QixPQUFPLHNCQUFzQixDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRTtZQUNwRCxRQUFRLEVBQUUsSUFBSTtZQUNkLE1BQU0sRUFBRSxJQUFJLENBQUMsYUFBYTtZQUMxQixRQUFRLEVBQUUsS0FBSztTQUNoQixDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0saUJBQWlCO1FBQ3RCLE9BQU8sc0JBQXNCLENBQUMsSUFBSSxDQUFDLGdCQUFnQixFQUFFO1lBQ25ELFFBQVEsRUFBRSxJQUFJO1lBQ2QsTUFBTSxFQUFFLElBQUksQ0FBQyxhQUFhO1lBQzFCLFFBQVEsRUFBRSxLQUFLO1NBQ2hCLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCw2RUFBNkU7SUFDN0UsaUJBQWlCO0lBQ2pCLDZFQUE2RTtJQUU3RTs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLFVBQVUsQ0FBQyxhQUFzQjtRQUM1QyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7UUFDeEMsTUFBTSxJQUFJLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztRQUNsQyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUIsTUFBTSxLQUFLLEdBQUcsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzlCLE1BQU0sWUFBWSxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNyQyxNQUFNLFlBQVksR0FBRyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDckMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBRXhCLE1BQU0sT0FBTyxHQUFHLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNoRCxPQUFPLENBQUMsRUFBRSxHQUFHLE1BQU0sR0FBRyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdEMsT0FBTyxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDbEMsT0FBTyxDQUFDLGdCQUFnQixHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNoRCxPQUFPLENBQUMsa0JBQWtCLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDaEUsT0FBTyxDQUFDLEtBQUssR0FBRyxLQUFLLENBQUM7UUFDdEIsT0FBTyxDQUFDLFVBQVUsR0FBRyxrQkFBa0IsQ0FBQyxhQUFhLEVBQUUsSUFBSSxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDaEcsT0FBTyxDQUFDLFNBQVMsR0FBRyxHQUFHLENBQUM7UUFDeEIsT0FBTyxDQUFDLFNBQVMsR0FBRyxHQUFHLEdBQUcsNkJBQTZCLEdBQUcsS0FBSyxDQUFDO1FBQ2hFLE1BQU0sT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDO1FBRXJCLE9BQU87WUFDTCxnQkFBZ0IsRUFBRSxNQUFNLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsWUFBWSxFQUFFLENBQUM7WUFDdEYsWUFBWSxFQUFFLGVBQWUsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsWUFBWSxFQUFFO2dCQUNqRSxRQUFRLEVBQUUsSUFBSTtnQkFDZCxNQUFNLEVBQUUsSUFBSSxDQUFDLGFBQWE7Z0JBQzFCLFFBQVEsRUFBRSxLQUFLO2dCQUNmLGFBQWEsRUFBRSw2QkFBNkI7YUFDN0MsQ0FBQztTQUNILENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7OztPQU1HO0lBQ0ksS0FBSyxDQUFDLGFBQWEsQ0FDeEIsY0FBbUIsRUFDbkIsZUFBMEM7UUFFMUMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLGVBQWUsRUFBRSxDQUFDO1FBQ3hDLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0QyxNQUFNLElBQUksaUJBQWlCLENBQUMsd0JBQXdCLENBQUMsQ0FBQztRQUN4RCxDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsWUFBWSxDQUFDLGVBQWUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUM5RSxJQUFJLENBQUMsWUFBWSxJQUFJLFlBQVksQ0FBQyxNQUFNLEdBQUcsdUJBQXVCLEVBQUUsQ0FBQztZQUNuRSxNQUFNLElBQUksaUJBQWlCLENBQUMsc0JBQXNCLENBQUMsQ0FBQztRQUN0RCxDQUFDO1FBRUQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3hCLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsc0JBQXNCLENBQ3BFO1lBQ0UsU0FBUyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDNUIsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLFlBQVksQ0FBQztZQUN0QyxVQUFVLEVBQUUsSUFBSTtZQUNoQixTQUFTLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFO1NBQ3hCLEVBQ0QsRUFBRSxJQUFJLEVBQUUsRUFBRSxVQUFVLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFDN0IsRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLENBQzVCLENBQUM7UUFDRixJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ3RELE1BQU0sSUFBSSxpQkFBaUIsQ0FBQywyQkFBMkIsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsUUFBdUMsQ0FBQztRQUVoRSxJQUFJLFVBQXVDLENBQUM7UUFDNUMsSUFBSSxLQUFLLEdBQXdCLGdCQUFnQixDQUFDO1FBQ2xELElBQUksQ0FBQztZQUNILFVBQVUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQztnQkFDaEQsV0FBVyxFQUFFLGNBQWM7Z0JBQzNCLEtBQUssRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO2dCQUNoQixLQUFLLEVBQUUsT0FBTyxDQUFDLEtBQUs7Z0JBQ3BCLFlBQVksRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUM7YUFDL0QsQ0FBQyxDQUFDO1lBQ0gsS0FBSyxHQUFHLHFCQUFxQixDQUFDO1lBQzlCLE1BQU0sRUFBRSxXQUFXLEVBQUUsR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2pFLEtBQUssR0FBRyxxQkFBcUIsQ0FBQztZQUM5QixPQUFPLE1BQU0sSUFBSSxDQUFDLHFCQUFxQixDQUFDLE9BQU8sRUFBRSxXQUFXLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLFVBQVUsRUFBRSxDQUFDO2dCQUNmLE1BQU0sSUFBSSxDQUFDLHNCQUFzQixDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2hELENBQUM7WUFDRCxJQUFJLEtBQUssWUFBWSxpQkFBaUIsSUFBSSxLQUFLLFlBQVksbUJBQW1CLEVBQUUsQ0FBQztnQkFDL0UsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1lBQ0QsSUFBSSxLQUFLLFlBQVksbUJBQW1CLEVBQUUsQ0FBQztnQkFDekMsTUFBTSxJQUFJLGtCQUFrQixDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDbkQsQ0FBQztZQUNELE1BQU0sSUFBSSxrQkFBa0IsQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDN0MsQ0FBQztJQUNILENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLFlBQVksQ0FBQyxjQUFtQixFQUFFLGVBQTBDO1FBQ3ZGLE1BQU0sTUFBTSxHQUFHLGNBQWMsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzNELE1BQU0sWUFBWSxHQUFHLFlBQVksQ0FBQyxlQUFlLENBQUMsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDOUUsSUFDRSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDaEIsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO2VBQ1YsQ0FBQyxZQUFZO2VBQ2IsWUFBWSxDQUFDLE1BQU0sR0FBRyx1QkFBdUIsRUFDaEQsQ0FBQztZQUNELE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQzFDLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsVUFBVSxFQUFFLElBQUksRUFBRSxFQUMxRixFQUFFLElBQUksRUFBRSxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsRUFBRSxDQUN0QyxDQUFDO0lBQ0osQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsYUFBYSxDQUFDLGVBQTBDO1FBQ25FLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztRQUN2QixNQUFNLFlBQVksR0FBRyxZQUFZLENBQUMsZUFBZSxDQUFDLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQzlFLElBQUksQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyx1QkFBdUIsRUFBRSxDQUFDO1lBQ25FLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDeEcsSUFDRSxDQUFDLE9BQU87ZUFDTCxPQUFPLENBQUMsVUFBVSxLQUFLLFNBQVM7ZUFDaEMsT0FBTyxDQUFDLFVBQVUsS0FBSyxJQUFJO2VBQzNCLENBQUMsT0FBTyxDQUFDLGdCQUFnQjtlQUN6QixPQUFPLENBQUMsU0FBUyxJQUFJLElBQUksQ0FBQyxJQUFJLEVBQUUsRUFDbkMsQ0FBQztZQUNELE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNsRSxJQUNFLENBQUMsUUFBUTtlQUNOLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxLQUFLLE9BQU8sQ0FBQyxnQkFBZ0I7ZUFDaEQsUUFBUSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEtBQUssT0FBTyxDQUFDLEVBQUUsRUFDakQsQ0FBQztZQUNELE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxPQUFPLGtCQUFrQixDQUFDLE9BQU8sQ0FBQyxVQUFVLEVBQUUsSUFBSSxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDekYsQ0FBQztJQUVELDZFQUE2RTtJQUM3RSxrQkFBa0I7SUFDbEIsNkVBQTZFO0lBRTdFOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxZQUFvQixFQUFFLHNCQUE4QjtRQUNqRixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzdFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixJQUNFLENBQUMsT0FBTztlQUNMLE9BQU8sQ0FBQyxTQUFTLEtBQUssU0FBUztlQUMvQixPQUFPLENBQUMsU0FBUyxJQUFJLEdBQUc7ZUFDeEIsQ0FBQyxPQUFPLENBQUMsVUFBVTtlQUNuQixPQUFPLENBQUMsTUFBTSxLQUFLLHNCQUFzQixFQUM1QyxDQUFDO1lBQ0QsTUFBTSxJQUFJLG1CQUFtQixDQUFDLDBCQUEwQixDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxVQUFVLENBQUM7UUFDbkMsTUFBTSxTQUFTLEdBQUcsT0FBTyxPQUFPLENBQUMsb0JBQW9CLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsb0JBQW9CLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0RyxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQy9ELHFFQUFxRTtRQUNyRSxNQUFNLEdBQUcsR0FBRyxXQUFXLEtBQUssU0FBUyxJQUFJLFNBQVMsS0FBSyxDQUFDLElBQUksU0FBUyxJQUFJLEdBQUcsR0FBRyw0QkFBNEIsQ0FBQztRQUM1RyxJQUFJLENBQUMsR0FBRyxJQUFJLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0QyxPQUFPLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUM3QyxDQUFDO1FBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ2hDLElBQUksV0FBVyxLQUFLLFNBQVMsSUFBSSxDQUFDLFNBQVMsS0FBSyxDQUFDLElBQUksU0FBUyxHQUFHLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3RFLGdFQUFnRTtnQkFDaEUsT0FBTyxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLENBQUM7WUFDN0MsQ0FBQztZQUNELE1BQU0sSUFBSSxDQUFDLGtCQUFrQixDQUFDLFlBQVksRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO1lBQ3JFLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUM7SUFDMUQsQ0FBQztJQUVPLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQyxZQUFvQixFQUFFLFVBQWtCO1FBQ3pFLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDMUQsSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUNaLE9BQU8sT0FBTyxDQUFDO1FBQ2pCLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxHQUFHLEVBQUU7WUFDN0UsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUMvQyxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsWUFBWSxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQ25ELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxLQUFLLENBQUMsa0JBQWtCLENBQUMsWUFBb0IsRUFBRSxVQUFrQjtRQUN2RSxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ2hDLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNkLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEIsTUFBTSxTQUFTLEdBQUcsR0FBRyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDM0MsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FDL0Q7WUFDRSxFQUFFLEVBQUUsWUFBWTtZQUNoQixTQUFTLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFO1lBQzdCLFNBQVMsRUFBRSxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUU7WUFDdkIsOERBQThEO1lBQzlELEdBQUcsRUFBRSxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLEVBQUUsRUFBRSxFQUFFLGdCQUFnQixFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7U0FDcEYsRUFDRCxFQUFFLElBQUksRUFBRSxFQUFFLGdCQUFnQixFQUFFLFNBQVMsRUFBRSxFQUFFLEVBQ3pDLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxDQUM1QixDQUFDO1FBQ0YsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN0RCxPQUFPLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxZQUFZLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxRQUFrQyxDQUFDO1FBQzNELHFFQUFxRTtRQUNyRSx3RUFBd0U7UUFDeEUseURBQXlEO1FBQ3pELE1BQU0sYUFBYSxHQUFHLE9BQU8sT0FBTyxDQUFDLG9CQUFvQixLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUcsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNoRSxJQUFJLFlBQVksS0FBSyxTQUFTLElBQUksYUFBYSxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsR0FBRyw0QkFBNEIsRUFBRSxDQUFDO1lBQzdGLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUNyQyxFQUFFLEVBQUUsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLGdCQUFnQixFQUFFLFNBQVMsRUFBRSxFQUNoRixFQUFFLElBQUksRUFBRSxFQUFFLGdCQUFnQixFQUFFLENBQUMsRUFBRSxFQUFFLENBQ2xDLENBQUM7WUFDRixPQUFPLEVBQUUsV0FBVyxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxhQUFhLEVBQUUsQ0FBQztRQUN0RixDQUFDO1FBQ0QsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNqRSxJQUFJLFlBQVksS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUMvQixNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZLEVBQUUsaUNBQWlDLENBQUMsQ0FBQztZQUMvRSxNQUFNLElBQUksbUJBQW1CLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsSUFBSSxPQUE2QixDQUFDO1FBQ2xDLElBQUksQ0FBQztZQUNILE9BQU8sR0FBRyxNQUFNLFFBQVEsQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDdkQsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSx1QkFBdUIsRUFBRSxDQUFDO2dCQUM3QyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxZQUFZLEVBQUUsdUJBQXVCLENBQUMsQ0FBQztnQkFDckUsTUFBTSxJQUFJLG1CQUFtQixDQUFDLDBCQUEwQixFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQ25FLENBQUM7WUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLDBCQUEwQixFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDeEcsTUFBTSxJQUFJLG1CQUFtQixDQUFDLHVCQUF1QixFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCx3RUFBd0U7UUFDeEUsdUVBQXVFO1FBQ3ZFLElBQUksT0FBZSxDQUFDO1FBQ3BCLElBQUksQ0FBQztZQUNILE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUNyRCxFQUFFLEVBQUUsRUFBRSxZQUFZLEVBQUUsU0FBUyxFQUFFLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLGdCQUFnQixFQUFFLFNBQVMsRUFBRSxFQUNoRjtnQkFDRSxJQUFJLEVBQUU7b0JBQ0osaUJBQWlCLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQztvQkFDNUQsR0FBRyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztvQkFDbkcsb0JBQW9CLEVBQUUsT0FBTyxDQUFDLG9CQUFvQjtvQkFDbEQsZ0JBQWdCLEVBQUUsQ0FBQztpQkFDcEI7YUFDRixDQUNGLENBQUM7WUFDRixPQUFPLEdBQUcsT0FBTyxDQUFDLFlBQVksQ0FBQztRQUNqQyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLHlFQUF5RTtZQUN6RSxzRUFBc0U7WUFDdEUsdUJBQXVCO1lBQ3ZCLE1BQU0sSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3hDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLEVBQUUsd0JBQXdCLEVBQUUsU0FBUyxFQUFFLFlBQVksRUFBRSxPQUFPLEVBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUN0RyxNQUFNLElBQUksbUJBQW1CLENBQUMsdUJBQXVCLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELElBQUksT0FBTyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3hDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLG1CQUFtQixFQUFFLFdBQVcsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO1lBQ3RHLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1FBQzVELENBQUM7UUFDRCxPQUFPLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxXQUFXLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLG9CQUFvQixFQUFFLENBQUM7SUFDNUcsQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxLQUFLLENBQUMsd0JBQXdCLENBQUMsWUFBb0IsRUFBRSxVQUFrQjtRQUM3RSxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFdBQVcsQ0FBQyxFQUFFLEVBQUUsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzdFLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixNQUFNLFNBQVMsR0FBRyxPQUFPLE9BQU8sRUFBRSxvQkFBb0IsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZHLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ3JGLElBQ0UsT0FBTztlQUNKLE9BQU8sQ0FBQyxTQUFTLEtBQUssU0FBUztlQUMvQixPQUFPLENBQUMsU0FBUyxHQUFHLEdBQUc7ZUFDdkIsV0FBVyxLQUFLLFNBQVM7ZUFDekIsU0FBUyxHQUFHLEdBQUcsR0FBRyw0QkFBNEIsRUFDakQsQ0FBQztZQUNELE9BQU8sRUFBRSxXQUFXLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUN6RCxDQUFDO1FBQ0QsTUFBTSxJQUFJLG1CQUFtQixDQUFDLHVCQUF1QixDQUFDLENBQUM7SUFDekQsQ0FBQztJQUVELDZFQUE2RTtJQUM3RSxZQUFZO0lBQ1osNkVBQTZFO0lBRXJFLGVBQWU7UUFDckIsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNwQixNQUFNLElBQUksaUJBQWlCLENBQUMsMEJBQTBCLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQ3hCLENBQUM7SUFFTyxhQUFhLENBQUMsUUFBZ0IsRUFBRSxjQUFzQjtRQUM1RCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEIsTUFBTSxPQUFPLEdBQUcsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzNDLE9BQU8sQ0FBQyxFQUFFLEdBQUcsTUFBTSxHQUFHLFdBQVcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN0QyxPQUFPLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyQyxPQUFPLENBQUMsTUFBTSxHQUFHLGNBQWMsQ0FBQztRQUNoQyxPQUFPLENBQUMsU0FBUyxHQUFHLEdBQUcsQ0FBQztRQUN4QixPQUFPLENBQUMsVUFBVSxHQUFHLEdBQUcsQ0FBQztRQUN6QixPQUFPLENBQUMsU0FBUyxHQUFHLEdBQUcsR0FBRyxJQUFJLENBQUMsb0JBQW9CLEdBQUcsS0FBSyxDQUFDO1FBQzVELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFTyxXQUFXLENBQUMsUUFBZ0I7UUFDbEMsT0FBTyxlQUFlLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFFTyxPQUFPLENBQUMsVUFBa0MsRUFBRSxRQUFnQjtRQUNsRSxPQUFPO1lBQ0wsT0FBTyxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1lBQ2xDLFNBQVMsRUFBRSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQztZQUNyQyxhQUFhLEVBQUUsZUFBZSxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxRQUFRLEVBQUU7Z0JBQy9ELFFBQVEsRUFBRSxJQUFJO2dCQUNkLE1BQU0sRUFBRSxJQUFJLENBQUMsYUFBYTtnQkFDMUIsUUFBUSxFQUFFLEtBQUs7Z0JBQ2YsYUFBYSxFQUFFLElBQUksQ0FBQyxvQkFBb0I7YUFDekMsQ0FBQztTQUNILENBQUM7SUFDSixDQUFDO0lBRU8sUUFBUSxDQUFDLFVBQWtDO1FBQ2pELE9BQU87WUFDTCxFQUFFLEVBQUUsVUFBVSxDQUFDLEVBQUU7WUFDakIsV0FBVyxFQUFFLFVBQVUsQ0FBQyxNQUFNO1lBQzlCLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztZQUMvQixVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7WUFDakMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxTQUFTO1lBQy9CLEdBQUcsQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RSxHQUFHLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDcEYsQ0FBQztJQUNKLENBQUM7SUFFRCx5R0FBeUc7SUFDakcsS0FBSyxDQUFDLFdBQVcsQ0FBQyxVQUF5QztRQUNqRSxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLFVBQVUsSUFBSSxVQUFVLENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxVQUFVLENBQUMsU0FBUyxJQUFJLEdBQUcsRUFBRSxDQUFDO1lBQ3JGLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELElBQUksQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMxRCxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLEdBQUcsR0FBRyxVQUFVLENBQUMsVUFBVSxHQUFHLHlCQUF5QixFQUFFLENBQUM7WUFDNUQscUVBQXFFO1lBQ3JFLHdEQUF3RDtZQUN4RCxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FDckQsRUFBRSxFQUFFLEVBQUUsVUFBVSxDQUFDLEVBQUUsRUFBRSxTQUFTLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsU0FBUyxFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxFQUFFLEVBQzdFLEVBQUUsSUFBSSxFQUFFLEVBQUUsVUFBVSxFQUFFLEdBQUcsRUFBRSxFQUFFLENBQzlCLENBQUM7WUFDRixJQUFJLE9BQU8sQ0FBQyxZQUFZLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQy9CLE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztZQUNELFVBQVUsQ0FBQyxVQUFVLEdBQUcsR0FBRyxDQUFDO1FBQzlCLENBQUM7UUFDRCxPQUFPLFVBQVUsQ0FBQztJQUNwQixDQUFDO0lBRU8sS0FBSyxDQUFDLHFCQUFxQixDQUNqQyxVQUF1QyxFQUN2QyxjQUFzQixFQUN0QixhQUE4QjtRQUU5QixNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUIsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsY0FBYyxDQUFDLENBQUM7UUFDMUQsT0FBTyxDQUFDLFVBQVUsR0FBRyxhQUFhLENBQUMsT0FBTyxDQUFDO1FBQzNDLE9BQU8sQ0FBQyxjQUFjLEdBQUcsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUN2QyxPQUFPLENBQUMsaUJBQWlCLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQzVFLE9BQU8sQ0FBQyxrQkFBa0IsR0FBRyxhQUFhLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNoSCxPQUFPLENBQUMsb0JBQW9CLEdBQUcsYUFBYSxDQUFDLG9CQUFvQixDQUFDO1FBQ2xFLE9BQU8sQ0FBQyxnQkFBZ0IsR0FBRyxDQUFDLENBQUM7UUFDN0IsTUFBTSxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7UUFFckIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pELEVBQUUsRUFBRSxFQUFFLFVBQVUsQ0FBQyxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsSUFBSSxFQUFFLEVBQzdDLEVBQUUsSUFBSSxFQUFFLEVBQUUsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLEVBQUUsRUFBRSxFQUFFLENBQzNDLENBQUM7UUFDRixJQUFJLE1BQU0sQ0FBQyxZQUFZLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDOUIsK0RBQStEO1lBQy9ELE1BQU0sSUFBSSxDQUFDLHNCQUFzQixDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUM5QyxNQUFNLElBQUksaUJBQWlCLENBQUMsMkJBQTJCLENBQUMsQ0FBQztRQUMzRCxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDN0MsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLHVCQUF1QixFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZix3RUFBd0U7WUFDeEUsdUVBQXVFO1lBQ3ZFLDRDQUE0QztZQUM1QyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLENBQUMsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ2hELENBQUM7WUFBQyxPQUFPLFlBQVksRUFBRSxDQUFDO2dCQUN0QixJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLHdCQUF3QixFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsRUFBRSxFQUFFLE9BQU8sRUFBRSxZQUFZLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzdHLENBQUM7WUFDRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsZ0ZBQWdGO0lBQ3hFLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxZQUFvQjtRQUN2RCxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FDckMsRUFBRSxFQUFFLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxFQUNuRCxFQUFFLElBQUksRUFBRSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsR0FBRyxvQkFBb0IsRUFBRSxFQUFFLENBQzlELENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLGtCQUFrQixDQUFDLFFBSTFCO1FBQ0MsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUM7UUFDeEMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ1YsT0FBTztRQUNULENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxDQUFDLFFBQWlCLEVBQUUsRUFBRTtZQUMxQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLGFBQWEsRUFBRSxJQUFJLEVBQUUsZ0JBQWdCLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDOUgsQ0FBQyxDQUFDO1FBQ0YsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQVksSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQ3pELElBQUksTUFBTSxZQUFZLE9BQU8sRUFBRSxDQUFDO2dCQUM5QixNQUFNLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1lBQzlCLENBQUM7UUFDSCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLGFBQWEsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxLQUFLLENBQUMsYUFBYSxDQUN6QixZQUFvQixFQUNwQixTQUF3QztRQUV4QyxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2xFLE9BQU8sSUFBSSxDQUFDO1FBQ2QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsc0JBQXNCLENBQy9ELEVBQUUsRUFBRSxFQUFFLFlBQVksRUFBRSxTQUFTLEVBQUUsRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUUsRUFDbkQsRUFBRSxJQUFJLEVBQUUsRUFBRSxTQUFTLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLEdBQUcsb0JBQW9CLEVBQUUsRUFBRSxFQUM3RCxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsQ0FDN0IsQ0FBQztRQUNGLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLE9BQU8sQ0FBQyxRQUFRLEtBQUssSUFBSSxDQUFDO1FBQzlFLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ3JGLElBQUksQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNqQixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsUUFBa0MsQ0FBQztRQUMxRCxPQUFPLEVBQUUsaUJBQWlCLEVBQUUsTUFBTSxDQUFDLGlCQUFpQixFQUFFLGtCQUFrQixFQUFFLE1BQU0sQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO0lBQ3hHLENBQUM7SUFFRCxrR0FBa0c7SUFDMUYsS0FBSyxDQUFDLGtCQUFrQixDQUFDLFlBQW9CLEVBQUUsU0FBd0M7UUFDN0YsSUFBSSxNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsWUFBWSxFQUFFLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDdEQsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSxtQkFBbUIsRUFBRSxTQUFTLEVBQUUsWUFBWSxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ssS0FBSyxDQUFDLGtCQUFrQixDQUFDLFNBQXdCO1FBQ3ZELElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxJQUFJLENBQUMsQ0FBQyxTQUFTLENBQUMsaUJBQWlCLElBQUksQ0FBQyxTQUFTLENBQUMsa0JBQWtCLENBQUMsRUFBRSxDQUFDO1lBQ3ZGLE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsc0JBQXNCLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDM0MsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxJQUFJO2dCQUMzQixDQUFDLFNBQVMsQ0FBQyxrQkFBa0IsRUFBRSxlQUFlLENBQUM7Z0JBQy9DLENBQUMsU0FBUyxDQUFDLGlCQUFpQixFQUFFLGNBQWMsQ0FBQzthQUNyQyxFQUFFLENBQUM7Z0JBQ1gsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO29CQUNaLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN0QyxJQUFJLEtBQUssS0FBSyxTQUFTLEVBQUUsQ0FBQztvQkFDeEIsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSw4QkFBOEIsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLCtDQUErQyxFQUFFLENBQUMsQ0FBQztvQkFDckgsU0FBUztnQkFDWCxDQUFDO2dCQUNELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7WUFDdEMsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxVQUFnQztRQUNoRSxNQUFNLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLElBQUksRUFBRTtZQUMzQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxZQUFZLEVBQUUsZUFBZSxDQUFDLENBQUM7WUFDbkUsQ0FBQztZQUNELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQ2pFLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxhQUE4QjtRQUNqRSxNQUFNLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLElBQUksRUFBRTtZQUMzQyxJQUFJLGFBQWEsQ0FBQyxZQUFZLEVBQUUsQ0FBQztnQkFDL0IsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQyxZQUFZLEVBQUUsZUFBZSxDQUFDLENBQUM7WUFDdEUsQ0FBQztZQUNELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQ3BFLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssQ0FBQyxXQUFXLENBQUMsUUFBZ0IsRUFBRSxPQUF1QjtRQUNqRSxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxTQUFTLEVBQUUsV0FBVyxDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLHVFQUF1RTtZQUN2RSxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsS0FBSyxFQUFFLDhCQUE4QixFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDcEcsQ0FBQztJQUNILENBQUM7SUFFRDs7Ozs7T0FLRztJQUNLLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxPQUE0QjtRQUMvRCxJQUFJLEtBQWdELENBQUM7UUFDckQsTUFBTSxJQUFJLEdBQUcsT0FBTyxFQUFFLENBQUMsSUFBSSxDQUN6QixHQUFHLEVBQUUsQ0FBQyxNQUFlLEVBQ3JCLENBQUMsUUFBaUIsRUFBRSxFQUFFO1lBQ3BCLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRSxLQUFLLEVBQUUsOEJBQThCLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7WUFDdEYsT0FBTyxNQUFlLENBQUM7UUFDekIsQ0FBQyxDQUNGLENBQUM7UUFDRixNQUFNLFFBQVEsR0FBRyxJQUFJLE9BQU8sQ0FBYSxDQUFDLFVBQVUsRUFBRSxFQUFFO1lBQ3RELEtBQUssR0FBRyxVQUFVLENBQUMsR0FBRyxFQUFFLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxFQUFFLDBCQUEwQixDQUFDLENBQUM7WUFDN0UsS0FBSyxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQ2hCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQzFELElBQUksQ0FBQyxJQUFJLENBQUM7b0JBQ1IsS0FBSyxFQUFFLGlDQUFpQztvQkFDeEMsT0FBTyxFQUFFLDBEQUEwRDtpQkFDcEUsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztRQUNILENBQUM7Z0JBQVMsQ0FBQztZQUNULFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN0QixDQUFDO0lBQ0gsQ0FBQztJQUVELHFFQUFxRTtJQUM3RCxVQUFVLENBQUMsU0FBNkI7UUFDOUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztRQUNELElBQUksQ0FBQztZQUNILE9BQU8sSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDekMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7SUFDSCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ssS0FBSyxDQUFDLG9CQUFvQjtRQUNoQyxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixDQUFDO2dCQUM3RCxNQUFNLEVBQUUsRUFBRSxTQUFTLEVBQUUsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxHQUFHLDRCQUE0QixFQUFFLEVBQUU7Z0JBQzFFLFNBQVMsRUFBRSxXQUFXO2dCQUN0QixhQUFhLEVBQUUsS0FBSztnQkFDcEIsS0FBSyxFQUFFLHlCQUF5QjthQUNqQyxDQUFDLENBQUM7WUFDSCxLQUFLLE1BQU0sT0FBTyxJQUFJLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDckMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQUMsRUFBRSxFQUFFLEVBQUUsT0FBTyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDbkUsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLEtBQUssRUFBRSw0QkFBNEIsRUFBRSxPQUFPLEVBQUUsWUFBWSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNuRixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxJQUFJLENBQUMsUUFBNEI7UUFDdkMsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDakMsSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ1YsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7WUFDeEMsT0FBTztRQUNULENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyxDQUFDLFFBQWlCLEVBQUUsRUFBRTtZQUMxQyxNQUFNLE9BQU8sR0FBdUIsRUFBRSxLQUFLLEVBQUUsYUFBYSxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQy9HLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQ3ZDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQzFDLENBQUMsQ0FBQztRQUNGLElBQUksQ0FBQztZQUNILE1BQU0sTUFBTSxHQUFZLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztZQUN6RCxJQUFJLE1BQU0sWUFBWSxPQUFPLEVBQUUsQ0FBQztnQkFDOUIsTUFBTSxDQUFDLEtBQUssQ0FBQyxhQUFhLENBQUMsQ0FBQztZQUM5QixDQUFDO1FBQ0gsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixhQUFhLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDdkIsQ0FBQztJQUNILENBQUM7Q0FDRiJ9