@idp.global/sdk 19.3.0 → 19.5.0

package/dist_ts_browser/classes.relyingpartybearerclient.js

@@ -0,0 +1,646 @@
+import { isPkceVerifier, RELYING_PARTY_BEARER_MESSAGE_TYPE, } from '../dist_ts_relyingparty/contract.bearer.js';
+export { RELYING_PARTY_BEARER_MESSAGE_TYPE };
+export class RelyingPartyBearerClientError extends Error {
+    code;
+    status;
+    /** the `error` the relying party answered (`TRelyingPartyBearerErrorCode`) */
+    answerError;
+    /** the `error` a delivery carried (`TRelyingPartyBearerDeliveryError`) */
+    deliveryError;
+    constructor(code, detailsArg = {}) {
+        super(code, detailsArg.cause !== undefined ? { cause: detailsArg.cause } : undefined);
+        this.code = code;
+        this.name = 'RelyingPartyBearerClientError';
+        if (detailsArg.status !== undefined)
+            this.status = detailsArg.status;
+        if (detailsArg.answerError !== undefined)
+            this.answerError = detailsArg.answerError;
+        if (detailsArg.deliveryError !== undefined)
+            this.deliveryError = detailsArg.deliveryError;
+    }
+}
+const DEFAULT_LOGIN_PATH_PREFIX = '/auth/';
+const DEFAULT_REFRESH_SKEW_MS = 60_000;
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+/** Every tab of the origin waits on the lock while a section runs: two minutes at most. */
+const MAX_REQUEST_TIMEOUT_MS = 120_000;
+/** The life of a login attempt at the relying party (`LOGIN_ATTEMPT_MAX_AGE_SECONDS`). */
+const DEFAULT_POPUP_TIMEOUT_MS = 10 * 60 * 1_000;
+const DEFAULT_POPUP_FEATURES = 'popup,width=480,height=720';
+const POPUP_CLOSED_POLL_MS = 500;
+/** A popup posts and closes at once; its message can arrive after the opener sees it closed. */
+const POPUP_CLOSED_GRACE_MS = 1_000;
+/** 32 random bytes: a 43-character verifier and state (RFC 7636 §4.1). */
+const RANDOM_BYTES = 32;
+const DELIVERY_PARAMS = ['code', 'error', 'state'];
+const base64Url = (bytesArg) => {
+    let binary = '';
+    for (const byte of bytesArg)
+        binary += String.fromCharCode(byte);
+    return globalThis.btoa(binary).replace(/\+/gu, '-').replace(/\//gu, '_').replace(/=+$/u, '');
+};
+const randomBase64Url = () => base64Url(globalThis.crypto.getRandomValues(new Uint8Array(RANDOM_BYTES)));
+/** The S256 challenge of a verifier: BASE64URL(SHA-256(ASCII(verifier))). */
+const pkceChallengeOf = async (verifierArg) => base64Url(new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new TextEncoder().encode(verifierArg))));
+const isRecord = (valueArg) => typeof valueArg === 'object' && valueArg !== null && !Array.isArray(valueArg);
+const isText = (valueArg) => typeof valueArg === 'string' && valueArg.length > 0;
+const isTime = (valueArg) => typeof valueArg === 'number' && Number.isFinite(valueArg);
+/** Throws `request_failed` once a section's deadline has fired: nothing is sent or written past it. */
+const inTime = (signalArg) => {
+    if (signalArg.aborted) {
+        throw new RelyingPartyBearerClientError('request_failed');
+    }
+};
+/** The one value of a parameter, or `undefined` when it is absent or repeated. */
+const singleParam = (paramsArg, nameArg) => {
+    const values = paramsArg.getAll(nameArg);
+    return values.length === 1 ? values[0] : undefined;
+};
+/** A token answer exactly as the bearer contract says, or `null`. */
+const tokenAnswerOf = (answerArg) => {
+    if (!isRecord(answerArg)
+        || answerArg.tokenType !== 'Bearer'
+        || !isText(answerArg.accessToken)
+        || !isText(answerArg.refreshToken)
+        || !isTime(answerArg.accessTokenExpiresAt)
+        || !isTime(answerArg.expiresIn)
+        || answerArg.expiresIn <= 0
+        || !isTime(answerArg.refreshTokenExpiresAt)
+        || !isRecord(answerArg.session)
+        || !isText(answerArg.session.sessionId)
+        || !isText(answerArg.session.principalId)
+        || !isTime(answerArg.session.expiresAt)) {
+        return null;
+    }
+    return {
+        tokenType: 'Bearer',
+        accessToken: answerArg.accessToken,
+        accessTokenExpiresAt: answerArg.accessTokenExpiresAt,
+        expiresIn: answerArg.expiresIn,
+        refreshToken: answerArg.refreshToken,
+        refreshTokenExpiresAt: answerArg.refreshTokenExpiresAt,
+        session: {
+            sessionId: answerArg.session.sessionId,
+            principalId: answerArg.session.principalId,
+            expiresAt: answerArg.session.expiresAt,
+        },
+    };
+};
+/**
+ * The browser side of bearer hand-off (`@idp.global/sdk/relyingparty`
+ * `bearer`): it starts a `web` or `popup` login with PKCE and a state,
+ * receives the delivery, claims the code once and keeps the token pair in
+ * the application's storage. Every refresh, logout and store of a claimed
+ * pair holds one Web Lock, so the tabs of an origin rotate the pair one at a
+ * time: inside the lock the pair is read from storage again, a pair another
+ * tab rotated is used as it is, and a rotated pair is stored before the lock
+ * is released and before its access token is handed out. Each claim and
+ * each section that holds the lock ends by `requestTimeoutMs`, so a hanging
+ * request or write never holds the other tabs. A login replaces the stored
+ * pair and ends that pair's session. Rotation is strict at the relying
+ * party: a refresh token spent once ends the session when it comes back, so
+ * nothing here retries a claim or a refresh. A code that reaches the client
+ * another way, such as a device pairing, is claimed through `createPkce` and
+ * `claimCode` under the same rules, without a window.
+ *
+ * It needs the Web Locks API and Web Crypto, both of them only in a secure
+ * context, and has no fallback for either.
+ */
+export class RelyingPartyBearerClient {
+    origin;
+    #paths;
+    #storage;
+    #lockName;
+    #refreshSkewMs;
+    #requestTimeoutMs;
+    #locks;
+    #fetch;
+    #window;
+    #now;
+    /** the states of the logins received here; a login is received once */
+    #receivedStates = new Set();
+    /** the challenges of the pairs `claimCode` claimed with here; a pair is claimed with once */
+    #claimedChallenges = new Set();
+    constructor(optionsArg) {
+        const origin = optionsArg?.origin;
+        let parsedOrigin = null;
+        try {
+            parsedOrigin = typeof origin === 'string' ? new URL(origin) : null;
+        }
+        catch {
+            parsedOrigin = null;
+        }
+        if (!parsedOrigin || parsedOrigin.origin !== origin || !['https:', 'http:'].includes(parsedOrigin.protocol)) {
+            throw new Error('origin must be the relying party\'s exact origin, such as https://app.example');
+        }
+        const prefix = optionsArg.loginPathPrefix ?? DEFAULT_LOGIN_PATH_PREFIX;
+        if (typeof prefix !== 'string' || !/^\/(?:[A-Za-z0-9._~-]+\/)*$/u.test(prefix)) {
+            throw new Error('loginPathPrefix must be a path that starts and ends with /');
+        }
+        const storage = optionsArg.storage;
+        if (!storage || typeof storage.get !== 'function' || typeof storage.set !== 'function' || typeof storage.clear !== 'function') {
+            throw new Error('storage must have get, set and clear');
+        }
+        const locks = optionsArg.locks ?? globalThis.navigator?.locks;
+        if (!locks || typeof locks.request !== 'function') {
+            throw new Error('RelyingPartyBearerClient needs the Web Locks API (navigator.locks)');
+        }
+        if (typeof globalThis.crypto?.subtle?.digest !== 'function' || typeof globalThis.crypto.getRandomValues !== 'function') {
+            throw new Error('RelyingPartyBearerClient needs Web Crypto (crypto.subtle), which a browser offers only in a secure context');
+        }
+        const fetchFunction = optionsArg.fetch ?? globalThis.fetch?.bind(globalThis);
+        if (typeof fetchFunction !== 'function') {
+            throw new Error('RelyingPartyBearerClient needs fetch');
+        }
+        const refreshSkewMs = optionsArg.refreshSkewMs ?? DEFAULT_REFRESH_SKEW_MS;
+        if (!Number.isInteger(refreshSkewMs) || refreshSkewMs < 0) {
+            throw new Error('refreshSkewMs must be a whole number of milliseconds');
+        }
+        // only an absent deadline takes the default: any other value that is not one throws
+        const requestTimeoutMs = optionsArg.requestTimeoutMs === undefined ? DEFAULT_REQUEST_TIMEOUT_MS : optionsArg.requestTimeoutMs;
+        if (typeof requestTimeoutMs !== 'number'
+            || !Number.isFinite(requestTimeoutMs)
+            || requestTimeoutMs <= 0
+            || requestTimeoutMs > MAX_REQUEST_TIMEOUT_MS) {
+            throw new Error(`requestTimeoutMs must be more than 0 and at most ${MAX_REQUEST_TIMEOUT_MS} milliseconds`);
+        }
+        this.origin = origin;
+        this.#paths = {
+            login: `${origin}${prefix}bearer/login`,
+            claim: `${origin}${prefix}bearer/claim`,
+            refresh: `${origin}${prefix}bearer/refresh`,
+            logout: `${origin}${prefix}bearer/logout`,
+        };
+        this.#storage = storage;
+        this.#lockName = optionsArg.lockName ?? `idp.global/relyingparty:bearer-tokens ${origin}`;
+        this.#refreshSkewMs = refreshSkewMs;
+        this.#requestTimeoutMs = requestTimeoutMs;
+        this.#locks = locks;
+        this.#fetch = fetchFunction;
+        this.#window = optionsArg.window ?? globalThis.window;
+        this.#now = optionsArg.now ?? Date.now;
+    }
+    /**
+     * A new login: a fresh verifier, its S256 challenge and a state, each from
+     * 32 random bytes, and the URL that starts it. Make a popup login before
+     * the click that opens it: this is async, and a browser opens a popup only
+     * within the user's gesture.
+     */
+    async createLogin(optionsArg) {
+        const { clientKind, returnTarget } = optionsArg ?? {};
+        if (clientKind !== 'web' && clientKind !== 'popup') {
+            throw new Error('a browser signs in as a web or popup client');
+        }
+        if (!isText(returnTarget)) {
+            throw new Error('returnTarget must name the configured return target');
+        }
+        const { codeVerifier, codeChallenge } = await this.createPkce();
+        const state = randomBase64Url();
+        const query = {
+            client_kind: clientKind,
+            return_target: returnTarget,
+            code_challenge: codeChallenge,
+            code_challenge_method: 'S256',
+            state,
+        };
+        const url = new URL(this.#paths.login);
+        for (const [name, value] of Object.entries(query)) {
+            url.searchParams.set(name, value);
+        }
+        return { clientKind, returnTarget, state, codeVerifier, url: url.href };
+    }
+    /**
+     * A fresh PKCE pair: a verifier from 32 random bytes and its S256
+     * challenge. For a code the client does not receive through its own login,
+     * such as one the application delivers to a device it pairs: the challenge
+     * goes to the application, and `claimCode` claims the code with the pair.
+     * Needs no window.
+     */
+    async createPkce() {
+        const codeVerifier = randomBase64Url();
+        return { codeVerifier, codeChallenge: await pkceChallengeOf(codeVerifier) };
+    }
+    /**
+     * Claims a hand-off code that was bound to `pkceArg`'s challenge and
+     * reached this client some other way than its own login, such as a device
+     * pairing (`openBearerHandoff` at the relying party). It is received like
+     * a login: one claim, never retried, under `requestTimeoutMs`, and the
+     * claimed pair replaces the stored one under the lock, whose session is
+     * ended then (`IRelyingPartyBearerLoginResult`). A pair is claimed with
+     * once: a second call with it, after a failed claim too, is
+     * `already_received` and sends nothing. A pair that is not one (a
+     * malformed verifier, a challenge that is not its S256) or a code that is
+     * not text is refused before anything is sent. Needs no window.
+     */
+    async claimCode(pkceArg, codeArg) {
+        const codeVerifier = pkceArg?.codeVerifier;
+        const codeChallenge = pkceArg?.codeChallenge;
+        if (!isPkceVerifier(codeVerifier) || typeof codeChallenge !== 'string' || codeChallenge !== await pkceChallengeOf(codeVerifier)) {
+            throw new Error('claimCode needs a PKCE pair: a verifier and its S256 challenge, as createPkce makes them');
+        }
+        if (!isText(codeArg)) {
+            throw new Error('claimCode needs the hand-off code as text');
+        }
+        if (this.#claimedChallenges.has(codeChallenge)) {
+            throw new RelyingPartyBearerClientError('already_received');
+        }
+        // taken before the claim is sent: a failed claim uses the pair up too
+        this.#claimedChallenges.add(codeChallenge);
+        return this.claim(codeArg, codeVerifier);
+    }
+    /**
+     * Receives a `web` login on its return target page. The delivery leaves
+     * the address first, before anything is checked, so neither a reload nor
+     * the history holds the code. A delivery whose state is not the login's is
+     * refused unclaimed; a code is claimed once, and a failed claim is not
+     * retried. The claimed pair replaces the stored one, whose session is
+     * ended then (`IRelyingPartyBearerLoginResult`). Answers `null` on a page
+     * that holds no delivery.
+     */
+    async completeRedirectLogin(loginArg) {
+        const window = this.requireWindow();
+        const url = new URL(window.location.href);
+        if (!DELIVERY_PARAMS.some((nameArg) => url.searchParams.has(nameArg))) {
+            return null;
+        }
+        const delivered = url.searchParams;
+        const code = singleParam(delivered, 'code');
+        const error = singleParam(delivered, 'error');
+        const state = singleParam(delivered, 'state');
+        const kept = new URL(url.href);
+        for (const name of DELIVERY_PARAMS) {
+            kept.searchParams.delete(name);
+        }
+        window.history.replaceState(window.history.state, '', kept.pathname + kept.search + kept.hash);
+        if (!loginArg || loginArg.clientKind !== 'web' || state === undefined || state !== loginArg.state) {
+            throw new RelyingPartyBearerClientError('state_mismatch');
+        }
+        return this.receive(loginArg, code, error);
+    }
+    /**
+     * Opens a `popup` login and receives what its page posts: a message is
+     * taken only from the relying party's origin, from this very popup, of the
+     * bearer message type and with the login's state; any other is ignored.
+     * The popup opens before this returns, so call it in the click handler
+     * itself, with a login made beforehand. The claimed pair replaces the
+     * stored one like `completeRedirectLogin`'s.
+     */
+    openPopupLogin(loginArg, optionsArg = {}) {
+        let window;
+        try {
+            window = this.requireWindow();
+            if (!loginArg || loginArg.clientKind !== 'popup') {
+                throw new Error('openPopupLogin needs a popup login');
+            }
+            if (this.#receivedStates.has(loginArg.state)) {
+                throw new RelyingPartyBearerClientError('already_received');
+            }
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        let popup;
+        try {
+            popup = window.open(loginArg.url, '_blank', optionsArg.windowFeatures ?? DEFAULT_POPUP_FEATURES);
+        }
+        catch (error) {
+            return Promise.reject(error);
+        }
+        if (!popup) {
+            return Promise.reject(new RelyingPartyBearerClientError('popup_blocked'));
+        }
+        return this.receivePopup(window, popup, loginArg, optionsArg);
+    }
+    /**
+     * An access token to send right now, or `null` when there is no session.
+     * One that is about to end is rotated first, by one tab for all of them.
+     */
+    async accessToken() {
+        const stored = await this.#storage.get();
+        if (!stored) {
+            return null;
+        }
+        if (this.isFresh(stored)) {
+            return stored.accessToken;
+        }
+        return (await this.rotate(stored.refreshToken, null))?.accessToken ?? null;
+    }
+    /**
+     * Rotates the pair now — after the relying party refused
+     * `rejectedAccessTokenArg`, say — unless another tab already did, and
+     * answers the pair to use: `null` once the session is over, which clears
+     * the storage. A relying party that cannot refresh right now
+     * (`authority_unavailable`) keeps the pair as it is; try again later.
+     */
+    async refresh(rejectedAccessTokenArg) {
+        const stored = await this.#storage.get();
+        if (!stored) {
+            return null;
+        }
+        return this.rotate(stored.refreshToken, rejectedAccessTokenArg ?? null);
+    }
+    /**
+     * Clears the storage and then ends the session at the relying party with
+     * the pair it held, and answers whether that ended a live session. When the
+     * relying party cannot be reached, refuses or gives no answer by
+     * `requestTimeoutMs`, the call throws `session_not_revoked` with that
+     * failure as its `cause`: this device is signed out, and the session may
+     * live on at the relying party until it expires, so tell the user they are
+     * signed out on this device only. A deadline that fires before the storage
+     * is cleared throws `request_failed`, and the pair stays.
+     */
+    async logout() {
+        let cleared = false;
+        const notRevoked = (errorArg) => new RelyingPartyBearerClientError('session_not_revoked', { cause: errorArg });
+        return this.#locks.request(this.#lockName, () => this.withDeadline(async (signalArg) => {
+            const current = await this.#storage.get();
+            if (!current) {
+                return false;
+            }
+            inTime(signalArg);
+            await this.#storage.clear({ signal: signalArg });
+            cleared = true;
+            try {
+                return await this.endSessionOf(current, signalArg);
+            }
+            catch (error) {
+                throw notRevoked(error);
+            }
+        }, () => {
+            // once the pair is cleared this device is signed out, whatever the request still does
+            const failure = new RelyingPartyBearerClientError('request_failed');
+            throw cleared ? notRevoked(failure) : failure;
+        }));
+    }
+    requireWindow() {
+        if (!this.#window) {
+            throw new Error('the login receivers of RelyingPartyBearerClient need a window');
+        }
+        return this.#window;
+    }
+    isFresh(storedArg) {
+        const lifetimeMs = storedArg.expiresIn * 1_000;
+        const skewMs = Math.min(this.#refreshSkewMs, lifetimeMs / 2);
+        return this.#now() < storedArg.receivedAt + lifetimeMs - skewMs;
+    }
+    /** Takes a delivery for its login, once, claims its code and stores the pair in place of the one before. */
+    async receive(loginArg, codeArg, errorArg) {
+        if (this.#receivedStates.has(loginArg.state)) {
+            throw new RelyingPartyBearerClientError('already_received');
+        }
+        this.#receivedStates.add(loginArg.state);
+        if (errorArg !== undefined) {
+            throw new RelyingPartyBearerClientError(isText(errorArg) && codeArg === undefined ? 'login_failed' : 'unexpected_answer', {
+                ...(isText(errorArg) ? { deliveryError: errorArg } : {}),
+            });
+        }
+        if (!isText(codeArg)) {
+            throw new RelyingPartyBearerClientError('unexpected_answer');
+        }
+        return this.claim(codeArg, loginArg.codeVerifier);
+    }
+    /** Claims a code once with its verifier and stores the pair in place of the one before. */
+    async claim(codeArg, codeVerifierArg) {
+        const body = { code: codeArg, codeVerifier: codeVerifierArg };
+        // the claim touches no stored pair, so it holds no lock, only its own deadline; a failed one leaves the stored pair as it was
+        const answer = tokenAnswerOf(await this.withDeadline((signalArg) => this.post(this.#paths.claim, body, {}, signalArg)));
+        if (!answer) {
+            throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+        }
+        return this.replacePair({ ...answer, receivedAt: this.#now() });
+    }
+    /**
+     * Stores a claimed pair in place of the stored one and then ends the
+     * session of that one with its tokens, held here, through the logout
+     * route. Both run under the lock a refresh holds, so no tab rotates the
+     * replaced pair meanwhile. A session that cannot be ended is the result's
+     * `previous_session_not_revoked`, neither thrown nor dropped: the new pair
+     * is stored by then.
+     */
+    replacePair(tokensArg) {
+        /** what the login answers if the deadline fires now: nothing before the pair is stored */
+        let atDeadline = null;
+        const notRevoked = (errorArg) => ({
+            tokens: tokensArg,
+            previousSession: 'previous_session_not_revoked',
+            previousSessionError: errorArg instanceof RelyingPartyBearerClientError
+                ? errorArg
+                : new RelyingPartyBearerClientError('unexpected_answer', { cause: errorArg }),
+        });
+        return this.#locks.request(this.#lockName, () => this.withDeadline(async (signalArg) => {
+            const previous = await this.#storage.get();
+            inTime(signalArg);
+            await this.#storage.set(tokensArg, { signal: signalArg });
+            if (!previous) {
+                return { tokens: tokensArg, previousSession: 'no_previous_session' };
+            }
+            if (previous.session.sessionId === tokensArg.session.sessionId) {
+                return { tokens: tokensArg, previousSession: 'same_session' };
+            }
+            atDeadline = notRevoked(new RelyingPartyBearerClientError('request_failed'));
+            try {
+                await this.endSessionOf(previous, signalArg);
+                return { tokens: tokensArg, previousSession: 'previous_session_ended' };
+            }
+            catch (error) {
+                return notRevoked(error);
+            }
+        }, () => {
+            // past its write the login stands; only the end of the previous session is cut short
+            if (!atDeadline) {
+                throw new RelyingPartyBearerClientError('request_failed');
+            }
+            return atDeadline;
+        }));
+    }
+    receivePopup(windowArg, popupArg, loginArg, optionsArg) {
+        return new Promise((resolve, reject) => {
+            const cleanups = [];
+            let settled = false;
+            const settle = (actionArg) => {
+                if (settled) {
+                    return;
+                }
+                settled = true;
+                for (const cleanup of cleanups) {
+                    cleanup();
+                }
+                actionArg();
+            };
+            const fail = (errorArg) => settle(() => reject(errorArg));
+            const onMessage = (eventArg) => {
+                const data = eventArg?.data;
+                if (eventArg?.origin !== this.origin
+                    || eventArg.source !== popupArg
+                    || !isRecord(data)
+                    || data.type !== RELYING_PARTY_BEARER_MESSAGE_TYPE
+                    || data.state !== loginArg.state) {
+                    return;
+                }
+                settle(() => {
+                    this.receive(loginArg, data.code, data.error).then(resolve, reject);
+                });
+            };
+            windowArg.addEventListener('message', onMessage);
+            cleanups.push(() => windowArg.removeEventListener('message', onMessage));
+            const timeout = setTimeout(() => fail(new RelyingPartyBearerClientError('popup_timeout')), optionsArg.timeoutMs ?? DEFAULT_POPUP_TIMEOUT_MS);
+            cleanups.push(() => clearTimeout(timeout));
+            let closedGrace;
+            const closedPoll = setInterval(() => {
+                if (popupArg.closed && closedGrace === undefined) {
+                    closedGrace = setTimeout(() => fail(new RelyingPartyBearerClientError('popup_closed')), POPUP_CLOSED_GRACE_MS);
+                }
+            }, POPUP_CLOSED_POLL_MS);
+            cleanups.push(() => {
+                clearInterval(closedPoll);
+                if (closedGrace !== undefined) {
+                    clearTimeout(closedGrace);
+                }
+            });
+            const signal = optionsArg.signal;
+            if (signal) {
+                if (signal.aborted) {
+                    fail(signal.reason);
+                    return;
+                }
+                const onAbort = () => fail(signal.reason);
+                signal.addEventListener('abort', onAbort, { once: true });
+                cleanups.push(() => signal.removeEventListener('abort', onAbort));
+            }
+        });
+    }
+    /**
+     * One rotation under the lock. The pair is read again inside it: one
+     * whose refresh token is no longer `seenRefreshTokenArg`, or whose access
+     * token is no longer `rejectedAccessTokenArg`, was rotated already and is
+     * used as it is. A rotated pair is stored before the lock is released. The
+     * whole section has one deadline: past it, the lock is released with
+     * `request_failed` and an answer that still arrives is dropped unstored.
+     */
+    rotate(seenRefreshTokenArg, rejectedAccessTokenArg) {
+        return this.#locks.request(this.#lockName, () => this.withDeadline(async (signalArg) => {
+            const current = await this.#storage.get();
+            if (!current) {
+                return null;
+            }
+            if (current.refreshToken !== seenRefreshTokenArg
+                || (rejectedAccessTokenArg !== null && current.accessToken !== rejectedAccessTokenArg)) {
+                return current;
+            }
+            let answer;
+            const body = { refreshToken: current.refreshToken };
+            try {
+                answer = tokenAnswerOf(await this.post(this.#paths.refresh, body, {}, signalArg));
+            }
+            catch (error) {
+                if (error instanceof RelyingPartyBearerClientError && error.answerError === 'invalid_bearer_grant') {
+                    // the session is over: this pair opens nothing any more
+                    inTime(signalArg);
+                    await this.#storage.clear({ signal: signalArg });
+                    return null;
+                }
+                throw error;
+            }
+            if (!answer) {
+                throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+            }
+            const stored = { ...answer, receivedAt: this.#now() };
+            inTime(signalArg);
+            await this.#storage.set(stored, { signal: signalArg });
+            return stored;
+        }));
+    }
+    /** Ends the session of a pair through the logout route and answers whether that ended a live one. */
+    async endSessionOf(pairArg, signalArg) {
+        const body = { refreshToken: pairArg.refreshToken };
+        const answer = await this.post(this.#paths.logout, body, { authorization: `Bearer ${pairArg.accessToken}` }, signalArg);
+        if (!isRecord(answer) || typeof answer.endedLiveSession !== 'boolean') {
+            throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+        }
+        return answer.endedLiveSession;
+    }
+    /**
+     * Runs one operation, a claim or a section that holds the lock, under
+     * `requestTimeoutMs`. When the deadline fires, the section's signal aborts
+     * its request and its storage write and keeps it from writing anything
+     * more (`inTime`), and the call answers `onDeadlineArg()` at once, so the
+     * lock is released whatever the request or the storage still does.
+     */
+    async withDeadline(sectionArg, onDeadlineArg = () => {
+        throw new RelyingPartyBearerClientError('request_failed');
+    }) {
+        const controller = new AbortController();
+        let timer;
+        const deadline = new Promise((resolve, reject) => {
+            timer = setTimeout(() => {
+                controller.abort(new RelyingPartyBearerClientError('request_failed'));
+                try {
+                    resolve(onDeadlineArg());
+                }
+                catch (error) {
+                    reject(error);
+                }
+            }, this.#requestTimeoutMs);
+        });
+        const section = sectionArg(controller.signal);
+        // past the deadline the section's own end, its aborted request among them, has nobody left to answer
+        section.catch(() => undefined);
+        try {
+            return await Promise.race([section, deadline]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    /**
+     * A bearer API call: JSON in, JSON out, no cookie, no cache, no redirect.
+     * With `signalArg` none is sent past the deadline and an answer that
+     * arrives after it counts as none.
+     */
+    async post(urlArg, bodyArg, headersArg = {}, signalArg) {
+        if (signalArg) {
+            inTime(signalArg);
+        }
+        let response;
+        try {
+            response = await this.#fetch(urlArg, {
+                method: 'POST',
+                headers: { 'content-type': 'application/json', ...headersArg },
+                body: JSON.stringify(bodyArg),
+                credentials: 'omit',
+                cache: 'no-store',
+                redirect: 'error',
+                referrerPolicy: 'no-referrer',
+                ...(signalArg ? { signal: signalArg } : {}),
+            });
+        }
+        catch (error) {
+            throw new RelyingPartyBearerClientError('request_failed', { cause: error });
+        }
+        let answer;
+        try {
+            answer = await response.json();
+        }
+        catch {
+            // the parse error is not kept: its message quotes the body
+            answer = undefined;
+            if (signalArg) {
+                inTime(signalArg);
+            }
+            if (response.status === 200) {
+                throw new RelyingPartyBearerClientError('unexpected_answer', { status: 200 });
+            }
+        }
+        if (signalArg) {
+            inTime(signalArg);
+        }
+        if (response.status !== 200) {
+            throw new RelyingPartyBearerClientError('request_refused', {
+                status: response.status,
+                ...(isRecord(answer) && isText(answer.error) ? { answerError: answer.error } : {}),
+            });
+        }
+        return answer;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5yZWx5aW5ncGFydHliZWFyZXJjbGllbnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19icm93c2VyL2NsYXNzZXMucmVseWluZ3BhcnR5YmVhcmVyY2xpZW50LnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFDTCxjQUFjLEVBQ2QsaUNBQWlDLEdBT2xDLE1BQU0sdUNBQXVDLENBQUM7QUFnQi9DLE9BQU8sRUFBRSxpQ0FBaUMsRUFBRSxDQUFDO0FBcUs3QyxNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQVFwQyxJQUFJO0lBUE4sTUFBTSxDQUFVO0lBQ2hDLDhFQUE4RTtJQUM5RCxXQUFXLENBQVU7SUFDckMsMEVBQTBFO0lBQzFELGFBQWEsQ0FBVTtJQUV2QyxZQUNrQixJQUF3QyxFQUN4RCxVQUFVLEdBQXVGLEVBQUU7UUFFbkcsS0FBSyxDQUFDLElBQUksRUFBRSxVQUFVLENBQUMsS0FBSyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQztvQkFIdEUsSUFBSTtRQUlwQixJQUFJLENBQUMsSUFBSSxHQUFHLCtCQUErQixDQUFDO1FBQzVDLElBQUksVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTO1lBQUUsSUFBSSxDQUFDLE1BQU0sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO1FBQ3JFLElBQUksVUFBVSxDQUFDLFdBQVcsS0FBSyxTQUFTO1lBQUUsSUFBSSxDQUFDLFdBQVcsR0FBRyxVQUFVLENBQUMsV0FBVyxDQUFDO1FBQ3BGLElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxTQUFTO1lBQUUsSUFBSSxDQUFDLGFBQWEsR0FBRyxVQUFVLENBQUMsYUFBYSxDQUFDO0lBQzVGLENBQUM7Q0FDRjtBQUVELE1BQU0seUJBQXlCLEdBQUcsUUFBUSxDQUFDO0FBQzNDLE1BQU0sdUJBQXVCLEdBQUcsTUFBTSxDQUFDO0FBQ3ZDLE1BQU0sMEJBQTBCLEdBQUcsTUFBTSxDQUFDO0FBQzFDLDJGQUEyRjtBQUMzRixNQUFNLHNCQUFzQixHQUFHLE9BQU8sQ0FBQztBQUN2QywwRkFBMEY7QUFDMUYsTUFBTSx3QkFBd0IsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLEtBQUssQ0FBQztBQUNqRCxNQUFNLHNCQUFzQixHQUFHLDRCQUE0QixDQUFDO0FBQzVELE1BQU0sb0JBQW9CLEdBQUcsR0FBRyxDQUFDO0FBQ2pDLGdHQUFnRztBQUNoRyxNQUFNLHFCQUFxQixHQUFHLEtBQUssQ0FBQztBQUNwQywwRUFBMEU7QUFDMUUsTUFBTSxZQUFZLEdBQUcsRUFBRSxDQUFDO0FBQ3hCLE1BQU0sZUFBZSxHQUFHLENBQUMsTUFBTSxFQUFFLE9BQU8sRUFBRSxPQUFPLENBQVUsQ0FBQztBQUU1RCxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQW9CLEVBQVUsRUFBRTtJQUNqRCxJQUFJLE1BQU0sR0FBRyxFQUFFLENBQUM7SUFDaEIsS0FBSyxNQUFNLElBQUksSUFBSSxRQUFRO1FBQUUsTUFBTSxJQUFJLE1BQU0sQ0FBQyxZQUFZLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDakUsT0FBTyxVQUFVLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBQy9GLENBQUMsQ0FBQztBQUVGLE1BQU0sZUFBZSxHQUFHLEdBQVcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFakgsNkVBQTZFO0FBQzdFLE1BQU0sZUFBZSxHQUFHLEtBQUssRUFBRSxXQUFtQixFQUFtQixFQUFFLENBQ3JFLFNBQVMsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxTQUFTLEVBQUUsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFckgsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQzFFLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVoRixNQUFNLE1BQU0sR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7QUFFOUcsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUM7QUFRcEgsdUdBQXVHO0FBQ3ZHLE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBc0IsRUFBUSxFQUFFO0lBQzlDLElBQUksU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3RCLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzVELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixrRkFBa0Y7QUFDbEYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxTQUEwQixFQUFFLE9BQWUsRUFBc0IsRUFBRTtJQUN0RixNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3pDLE9BQU8sTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO0FBQ3JELENBQUMsQ0FBQztBQUVGLHFFQUFxRTtBQUNyRSxNQUFNLGFBQWEsR0FBRyxDQUFDLFNBQWtCLEVBQXlDLEVBQUU7SUFDbEYsSUFDRSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDakIsU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ2hDLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxXQUFXLENBQUM7V0FDOUIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFlBQVksQ0FBQztXQUMvQixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsb0JBQW9CLENBQUM7V0FDdkMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQztXQUM1QixTQUFTLENBQUMsU0FBUyxJQUFJLENBQUM7V0FDeEIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLHFCQUFxQixDQUFDO1dBQ3hDLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUM7V0FDNUIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUM7V0FDcEMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7V0FDdEMsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsRUFDdkMsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUNELE9BQU87UUFDTCxTQUFTLEVBQUUsUUFBUTtRQUNuQixXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7UUFDbEMsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLG9CQUFvQjtRQUNwRCxTQUFTLEVBQUUsU0FBUyxDQUFDLFNBQVM7UUFDOUIsWUFBWSxFQUFFLFNBQVMsQ0FBQyxZQUFZO1FBQ3BDLHFCQUFxQixFQUFFLFNBQVMsQ0FBQyxxQkFBcUI7UUFDdEQsT0FBTyxFQUFFO1lBQ1AsU0FBUyxFQUFFLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUztZQUN0QyxXQUFXLEVBQUUsU0FBUyxDQUFDLE9BQU8sQ0FBQyxXQUFXO1lBQzFDLFNBQVMsRUFBRSxTQUFTLENBQUMsT0FBTyxDQUFDLFNBQVM7U0FDdkM7S0FDRixDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7R0FtQkc7QUFDSCxNQUFNLE9BQU8sd0JBQXdCO0lBQ25CLE1BQU0sQ0FBUztJQUN0QixNQUFNLENBQW9FO0lBQzFFLFFBQVEsQ0FBa0M7SUFDMUMsU0FBUyxDQUFTO0lBQ2xCLGNBQWMsQ0FBUztJQUN2QixpQkFBaUIsQ0FBUztJQUMxQixNQUFNLENBQWM7SUFDcEIsTUFBTSxDQUEwQjtJQUNoQyxPQUFPLENBQThDO0lBQ3JELElBQUksQ0FBZTtJQUM1Qix1RUFBdUU7SUFDOUQsZUFBZSxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDN0MsNkZBQTZGO0lBQ3BGLGtCQUFrQixHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFFaEQsWUFBWSxVQUE0QztRQUN0RCxNQUFNLE1BQU0sR0FBRyxVQUFVLEVBQUUsTUFBTSxDQUFDO1FBQ2xDLElBQUksWUFBWSxHQUFlLElBQUksQ0FBQztRQUNwQyxJQUFJLENBQUM7WUFDSCxZQUFZLEdBQUcsT0FBTyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ3JFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxZQUFZLEdBQUcsSUFBSSxDQUFDO1FBQ3RCLENBQUM7UUFDRCxJQUFJLENBQUMsWUFBWSxJQUFJLFlBQVksQ0FBQyxNQUFNLEtBQUssTUFBTSxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzVHLE1BQU0sSUFBSSxLQUFLLENBQUMsK0VBQStFLENBQUMsQ0FBQztRQUNuRyxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsVUFBVSxDQUFDLGVBQWUsSUFBSSx5QkFBeUIsQ0FBQztRQUN2RSxJQUFJLE9BQU8sTUFBTSxLQUFLLFFBQVEsSUFBSSxDQUFDLDhCQUE4QixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQy9FLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLE9BQU8sQ0FBQztRQUNuQyxJQUFJLENBQUMsT0FBTyxJQUFJLE9BQU8sT0FBTyxDQUFDLEdBQUcsS0FBSyxVQUFVLElBQUksT0FBTyxPQUFPLENBQUMsR0FBRyxLQUFLLFVBQVUsSUFBSSxPQUFPLE9BQU8sQ0FBQyxLQUFLLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDOUgsTUFBTSxJQUFJLEtBQUssQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO1FBQzFELENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxVQUFVLENBQUMsS0FBSyxJQUFJLFVBQVUsQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDO1FBQzlELElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLENBQUMsT0FBTyxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsb0VBQW9FLENBQUMsQ0FBQztRQUN4RixDQUFDO1FBQ0QsSUFBSSxPQUFPLFVBQVUsQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sS0FBSyxVQUFVLElBQUksT0FBTyxVQUFVLENBQUMsTUFBTSxDQUFDLGVBQWUsS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUN2SCxNQUFNLElBQUksS0FBSyxDQUFDLDRHQUE0RyxDQUFDLENBQUM7UUFDaEksQ0FBQztRQUNELE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxLQUFLLElBQUksVUFBVSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDN0UsSUFBSSxPQUFPLGFBQWEsS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUN4QyxNQUFNLElBQUksS0FBSyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7UUFDMUQsQ0FBQztRQUNELE1BQU0sYUFBYSxHQUFHLFVBQVUsQ0FBQyxhQUFhLElBQUksdUJBQXVCLENBQUM7UUFDMUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLElBQUksYUFBYSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzFELE1BQU0sSUFBSSxLQUFLLENBQUMsc0RBQXNELENBQUMsQ0FBQztRQUMxRSxDQUFDO1FBQ0Qsb0ZBQW9GO1FBQ3BGLE1BQU0sZ0JBQWdCLEdBQUcsVUFBVSxDQUFDLGdCQUFnQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsMEJBQTBCLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxnQkFBZ0IsQ0FBQztRQUM5SCxJQUNFLE9BQU8sZ0JBQWdCLEtBQUssUUFBUTtlQUNqQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUM7ZUFDbEMsZ0JBQWdCLElBQUksQ0FBQztlQUNyQixnQkFBZ0IsR0FBRyxzQkFBc0IsRUFDNUMsQ0FBQztZQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsb0RBQW9ELHNCQUFzQixlQUFlLENBQUMsQ0FBQztRQUM3RyxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUM7UUFDckIsSUFBSSxDQUFDLE1BQU0sR0FBRztZQUNaLEtBQUssRUFBRSxHQUFHLE1BQU0sR0FBRyxNQUFNLGNBQWM7WUFDdkMsS0FBSyxFQUFFLEdBQUcsTUFBTSxHQUFHLE1BQU0sY0FBYztZQUN2QyxPQUFPLEVBQUUsR0FBRyxNQUFNLEdBQUcsTUFBTSxnQkFBZ0I7WUFDM0MsTUFBTSxFQUFFLEdBQUcsTUFBTSxHQUFHLE1BQU0sZUFBZTtTQUMxQyxDQUFDO1FBQ0YsSUFBSSxDQUFDLFFBQVEsR0FBRyxPQUFPLENBQUM7UUFDeEIsSUFBSSxDQUFDLFNBQVMsR0FBRyxVQUFVLENBQUMsUUFBUSxJQUFJLHlDQUF5QyxNQUFNLEVBQUUsQ0FBQztRQUMxRixJQUFJLENBQUMsY0FBYyxHQUFHLGFBQWEsQ0FBQztRQUNwQyxJQUFJLENBQUMsaUJBQWlCLEdBQUcsZ0JBQWdCLENBQUM7UUFDMUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxLQUFLLENBQUM7UUFDcEIsSUFBSSxDQUFDLE1BQU0sR0FBRyxhQUFhLENBQUM7UUFDNUIsSUFBSSxDQUFDLE9BQU8sR0FBRyxVQUFVLENBQUMsTUFBTSxJQUFLLFVBQTJELENBQUMsTUFBTSxDQUFDO1FBQ3hHLElBQUksQ0FBQyxJQUFJLEdBQUcsVUFBVSxDQUFDLEdBQUcsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDO0lBQ3pDLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxXQUFXLENBQUMsVUFHeEI7UUFDQyxNQUFNLEVBQUUsVUFBVSxFQUFFLFlBQVksRUFBRSxHQUFHLFVBQVUsSUFBSyxFQUF3QixDQUFDO1FBQzdFLElBQUksVUFBVSxLQUFLLEtBQUssSUFBSSxVQUFVLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDbkQsTUFBTSxJQUFJLEtBQUssQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFDRCxNQUFNLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxHQUFHLE1BQU0sSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sS0FBSyxHQUFHLGVBQWUsRUFBRSxDQUFDO1FBQ2hDLE1BQU0sS0FBSyxHQUE0QztZQUNyRCxXQUFXLEVBQUUsVUFBVTtZQUN2QixhQUFhLEVBQUUsWUFBWTtZQUMzQixjQUFjLEVBQUUsYUFBYTtZQUM3QixxQkFBcUIsRUFBRSxNQUFNO1lBQzdCLEtBQUs7U0FDTixDQUFDO1FBQ0YsTUFBTSxHQUFHLEdBQUcsSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN2QyxLQUFLLE1BQU0sQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2xELEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLElBQUksRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNwQyxDQUFDO1FBQ0QsT0FBTyxFQUFFLFVBQVUsRUFBRSxZQUFZLEVBQUUsS0FBSyxFQUFFLFlBQVksRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzFFLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSSxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLFlBQVksR0FBRyxlQUFlLEVBQUUsQ0FBQztRQUN2QyxPQUFPLEVBQUUsWUFBWSxFQUFFLGFBQWEsRUFBRSxNQUFNLGVBQWUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO0lBQzlFLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7T0FXRztJQUNJLEtBQUssQ0FBQyxTQUFTLENBQUMsT0FBZ0MsRUFBRSxPQUFlO1FBQ3RFLE1BQU0sWUFBWSxHQUFZLE9BQU8sRUFBRSxZQUFZLENBQUM7UUFDcEQsTUFBTSxhQUFhLEdBQVksT0FBTyxFQUFFLGFBQWEsQ0FBQztRQUN0RCxJQUFJLENBQUMsY0FBYyxDQUFDLFlBQVksQ0FBQyxJQUFJLE9BQU8sYUFBYSxLQUFLLFFBQVEsSUFBSSxhQUFhLEtBQUssTUFBTSxlQUFlLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNoSSxNQUFNLElBQUksS0FBSyxDQUFDLDBGQUEwRixDQUFDLENBQUM7UUFDOUcsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUNyQixNQUFNLElBQUksS0FBSyxDQUFDLDJDQUEyQyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsRUFBRSxDQUFDO1lBQy9DLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxzRUFBc0U7UUFDdEUsSUFBSSxDQUFDLGtCQUFrQixDQUFDLEdBQUcsQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUMzQyxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLFlBQVksQ0FBQyxDQUFDO0lBQzNDLENBQUM7SUFFRDs7Ozs7Ozs7T0FRRztJQUNJLEtBQUssQ0FBQyxxQkFBcUIsQ0FDaEMsUUFBMkQ7UUFFM0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3BDLE1BQU0sR0FBRyxHQUFHLElBQUksR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDMUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RSxPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxHQUFHLENBQUMsWUFBWSxDQUFDO1FBQ25DLE1BQU0sSUFBSSxHQUFHLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDNUMsTUFBTSxLQUFLLEdBQUcsV0FBVyxDQUFDLFNBQVMsRUFBRSxPQUFPLENBQUMsQ0FBQztRQUM5QyxNQUFNLEtBQUssR0FBRyxXQUFXLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxDQUFDO1FBQzlDLE1BQU0sSUFBSSxHQUFHLElBQUksR0FBRyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMvQixLQUFLLE1BQU0sSUFBSSxJQUFJLGVBQWUsRUFBRSxDQUFDO1lBQ25DLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQ2pDLENBQUM7UUFDRCxNQUFNLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLEVBQUUsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxHQUFHLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMvRixJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssS0FBSyxJQUFJLEtBQUssS0FBSyxTQUFTLElBQUksS0FBSyxLQUFLLFFBQVEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUNsRyxNQUFNLElBQUksNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDN0MsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSSxjQUFjLENBQ25CLFFBQXdDLEVBQ3hDLFVBQVUsR0FBb0MsRUFBRTtRQUVoRCxJQUFJLE1BQXVDLENBQUM7UUFDNUMsSUFBSSxDQUFDO1lBQ0gsTUFBTSxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUM5QixJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssT0FBTyxFQUFFLENBQUM7Z0JBQ2pELE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztZQUN4RCxDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7WUFDOUQsQ0FBQztRQUNILENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQy9CLENBQUM7UUFDRCxJQUFJLEtBQXNDLENBQUM7UUFDM0MsSUFBSSxDQUFDO1lBQ0gsS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLGNBQWMsSUFBSSxzQkFBc0IsQ0FBQyxDQUFDO1FBQ25HLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQy9CLENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDWCxPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsSUFBSSw2QkFBNkIsQ0FBQyxlQUFlLENBQUMsQ0FBQyxDQUFDO1FBQzVFLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsVUFBVSxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxXQUFXO1FBQ3RCLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUN6QixPQUFPLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDNUIsQ0FBQztRQUNELE9BQU8sQ0FBQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxJQUFJLENBQUMsQ0FBQyxFQUFFLFdBQVcsSUFBSSxJQUFJLENBQUM7SUFDN0UsQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxPQUFPLENBQUMsc0JBQStCO1FBQ2xELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN6QyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixPQUFPLElBQUksQ0FBQztRQUNkLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFlBQVksRUFBRSxzQkFBc0IsSUFBSSxJQUFJLENBQUMsQ0FBQztJQUMxRSxDQUFDO0lBRUQ7Ozs7Ozs7OztPQVNHO0lBQ0ksS0FBSyxDQUFDLE1BQU07UUFDakIsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ3BCLE1BQU0sVUFBVSxHQUFHLENBQUMsUUFBaUIsRUFBRSxFQUFFLENBQUMsSUFBSSw2QkFBNkIsQ0FBQyxxQkFBcUIsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQ3hILE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtZQUNyRixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDMUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNiLE9BQU8sS0FBSyxDQUFDO1lBQ2YsQ0FBQztZQUNELE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUNsQixNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFDakQsT0FBTyxHQUFHLElBQUksQ0FBQztZQUNmLElBQUksQ0FBQztnQkFDSCxPQUFPLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7WUFDckQsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsTUFBTSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDMUIsQ0FBQztRQUNILENBQUMsRUFBRSxHQUFHLEVBQUU7WUFDTixzRkFBc0Y7WUFDdEYsTUFBTSxPQUFPLEdBQUcsSUFBSSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3BFLE1BQU0sT0FBTyxDQUFDLENBQUMsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUNoRCxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVPLGFBQWE7UUFDbkIsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNsQixNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDbkYsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLE9BQU8sQ0FBQztJQUN0QixDQUFDO0lBRU8sT0FBTyxDQUFDLFNBQTBDO1FBQ3hELE1BQU0sVUFBVSxHQUFHLFNBQVMsQ0FBQyxTQUFTLEdBQUcsS0FBSyxDQUFDO1FBQy9DLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxVQUFVLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDN0QsT0FBTyxJQUFJLENBQUMsSUFBSSxFQUFFLEdBQUcsU0FBUyxDQUFDLFVBQVUsR0FBRyxVQUFVLEdBQUcsTUFBTSxDQUFDO0lBQ2xFLENBQUM7SUFFRCw0R0FBNEc7SUFDcEcsS0FBSyxDQUFDLE9BQU8sQ0FDbkIsUUFBd0MsRUFDeEMsT0FBZ0IsRUFDaEIsUUFBaUI7UUFFakIsSUFBSSxJQUFJLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxNQUFNLElBQUksNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUM5RCxDQUFDO1FBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3pDLElBQUksUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzNCLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxtQkFBbUIsRUFBRTtnQkFDeEgsR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxhQUFhLEVBQUUsUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQzthQUN6RCxDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxZQUFZLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQsMkZBQTJGO0lBQ25GLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBZSxFQUFFLGVBQXVCO1FBQzFELE1BQU0sSUFBSSxHQUFvQyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsWUFBWSxFQUFFLGVBQWUsRUFBRSxDQUFDO1FBQy9GLDhIQUE4SDtRQUM5SCxNQUFNLE1BQU0sR0FBRyxhQUFhLENBQUMsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hILElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxtQkFBbUIsRUFBRSxFQUFFLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxHQUFHLE1BQU0sRUFBRSxVQUFVLEVBQUUsSUFBSSxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBRUQ7Ozs7Ozs7T0FPRztJQUNLLFdBQVcsQ0FBQyxTQUEwQztRQUM1RCwwRkFBMEY7UUFDMUYsSUFBSSxVQUFVLEdBQTBDLElBQUksQ0FBQztRQUM3RCxNQUFNLFVBQVUsR0FBRyxDQUFDLFFBQWlCLEVBQWtDLEVBQUUsQ0FBQyxDQUFDO1lBQ3pFLE1BQU0sRUFBRSxTQUFTO1lBQ2pCLGVBQWUsRUFBRSw4QkFBOEI7WUFDL0Msb0JBQW9CLEVBQUUsUUFBUSxZQUFZLDZCQUE2QjtnQkFDckUsQ0FBQyxDQUFDLFFBQVE7Z0JBQ1YsQ0FBQyxDQUFDLElBQUksNkJBQTZCLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUM7U0FDaEYsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQWlDLEtBQUssRUFBRSxTQUFTLEVBQUUsRUFBRTtZQUNySCxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDM0MsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2xCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFDMUQsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNkLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLGVBQWUsRUFBRSxxQkFBcUIsRUFBRSxDQUFDO1lBQ3ZFLENBQUM7WUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsU0FBUyxLQUFLLFNBQVMsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLENBQUM7Z0JBQy9ELE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLGVBQWUsRUFBRSxjQUFjLEVBQUUsQ0FBQztZQUNoRSxDQUFDO1lBQ0QsVUFBVSxHQUFHLFVBQVUsQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztZQUM3RSxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxTQUFTLENBQUMsQ0FBQztnQkFDN0MsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsZUFBZSxFQUFFLHdCQUF3QixFQUFFLENBQUM7WUFDMUUsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsT0FBTyxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDM0IsQ0FBQztRQUNILENBQUMsRUFBRSxHQUFHLEVBQUU7WUFDTixxRkFBcUY7WUFDckYsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO2dCQUNoQixNQUFNLElBQUksNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUM1RCxDQUFDO1lBQ0QsT0FBTyxVQUFVLENBQUM7UUFDcEIsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7SUFFTyxZQUFZLENBQ2xCLFNBQTBDLEVBQzFDLFFBQWtDLEVBQ2xDLFFBQXdDLEVBQ3hDLFVBQTJDO1FBRTNDLE9BQU8sSUFBSSxPQUFPLENBQWlDLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxFQUFFO1lBQ3JFLE1BQU0sUUFBUSxHQUFzQixFQUFFLENBQUM7WUFDdkMsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1lBQ3BCLE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBcUIsRUFBRSxFQUFFO2dCQUN2QyxJQUFJLE9BQU8sRUFBRSxDQUFDO29CQUNaLE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxPQUFPLEdBQUcsSUFBSSxDQUFDO2dCQUNmLEtBQUssTUFBTSxPQUFPLElBQUksUUFBUSxFQUFFLENBQUM7b0JBQy9CLE9BQU8sRUFBRSxDQUFDO2dCQUNaLENBQUM7Z0JBQ0QsU0FBUyxFQUFFLENBQUM7WUFDZCxDQUFDLENBQUM7WUFDRixNQUFNLElBQUksR0FBRyxDQUFDLFFBQWlCLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLEVBQUUsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUVuRSxNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQXlDLEVBQUUsRUFBRTtnQkFDOUQsTUFBTSxJQUFJLEdBQVksUUFBUSxFQUFFLElBQUksQ0FBQztnQkFDckMsSUFDRSxRQUFRLEVBQUUsTUFBTSxLQUFLLElBQUksQ0FBQyxNQUFNO3VCQUM3QixRQUFRLENBQUMsTUFBTSxLQUFLLFFBQVE7dUJBQzVCLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQzt1QkFDZixJQUFJLENBQUMsSUFBSSxLQUFLLGlDQUFpQzt1QkFDL0MsSUFBSSxDQUFDLEtBQUssS0FBSyxRQUFRLENBQUMsS0FBSyxFQUNoQyxDQUFDO29CQUNELE9BQU87Z0JBQ1QsQ0FBQztnQkFDRCxNQUFNLENBQUMsR0FBRyxFQUFFO29CQUNWLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLENBQUMsQ0FBQyxDQUFDO1lBQ0wsQ0FBQyxDQUFDO1lBQ0YsU0FBUyxDQUFDLGdCQUFnQixDQUFDLFNBQVMsRUFBRSxTQUFTLENBQUMsQ0FBQztZQUNqRCxRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxtQkFBbUIsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQztZQUV6RSxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQ3hCLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGVBQWUsQ0FBQyxDQUFDLEVBQzlELFVBQVUsQ0FBQyxTQUFTLElBQUksd0JBQXdCLENBQ2pELENBQUM7WUFDRixRQUFRLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLFlBQVksQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQzNDLElBQUksV0FBc0QsQ0FBQztZQUMzRCxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsR0FBRyxFQUFFO2dCQUNsQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUNqRCxXQUFXLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUscUJBQXFCLENBQUMsQ0FBQztnQkFDakgsQ0FBQztZQUNILENBQUMsRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO1lBQ3pCLFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO2dCQUNqQixhQUFhLENBQUMsVUFBVSxDQUFDLENBQUM7Z0JBQzFCLElBQUksV0FBVyxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUM5QixZQUFZLENBQUMsV0FBVyxDQUFDLENBQUM7Z0JBQzVCLENBQUM7WUFDSCxDQUFDLENBQUMsQ0FBQztZQUVILE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7WUFDakMsSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDWCxJQUFJLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztvQkFDbkIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztvQkFDcEIsT0FBTztnQkFDVCxDQUFDO2dCQUNELE1BQU0sT0FBTyxHQUFHLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQzFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7Z0JBQzFELFFBQVEsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1lBQ3BFLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0ssTUFBTSxDQUNaLG1CQUEyQixFQUMzQixzQkFBcUM7UUFFckMsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxFQUFFLFNBQVMsRUFBRSxFQUFFO1lBQ3JGLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMxQyxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsT0FBTyxJQUFJLENBQUM7WUFDZCxDQUFDO1lBQ0QsSUFDRSxPQUFPLENBQUMsWUFBWSxLQUFLLG1CQUFtQjttQkFDekMsQ0FBQyxzQkFBc0IsS0FBSyxJQUFJLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxzQkFBc0IsQ0FBQyxFQUN0RixDQUFDO2dCQUNELE9BQU8sT0FBTyxDQUFDO1lBQ2pCLENBQUM7WUFDRCxJQUFJLE1BQTZDLENBQUM7WUFDbEQsTUFBTSxJQUFJLEdBQXNDLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN2RixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxHQUFHLGFBQWEsQ0FBQyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3BGLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUNmLElBQUksS0FBSyxZQUFZLDZCQUE2QixJQUFJLEtBQUssQ0FBQyxXQUFXLEtBQUssc0JBQXNCLEVBQUUsQ0FBQztvQkFDbkcsd0RBQXdEO29CQUN4RCxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7b0JBQ2xCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztvQkFDakQsT0FBTyxJQUFJLENBQUM7Z0JBQ2QsQ0FBQztnQkFDRCxNQUFNLEtBQUssQ0FBQztZQUNkLENBQUM7WUFDRCxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ1osTUFBTSxJQUFJLDZCQUE2QixDQUFDLG1CQUFtQixFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFDaEYsQ0FBQztZQUNELE1BQU0sTUFBTSxHQUFvQyxFQUFFLEdBQUcsTUFBTSxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUN2RixNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDbEIsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztZQUN2RCxPQUFPLE1BQU0sQ0FBQztRQUNoQixDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVELHFHQUFxRztJQUM3RixLQUFLLENBQUMsWUFBWSxDQUFDLE9BQXdDLEVBQUUsU0FBc0I7UUFDekYsTUFBTSxJQUFJLEdBQXFDLEVBQUUsWUFBWSxFQUFFLE9BQU8sQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUN0RixNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUFFLEVBQUUsYUFBYSxFQUFFLFVBQVUsT0FBTyxDQUFDLFdBQVcsRUFBRSxFQUFFLEVBQUUsU0FBUyxDQUFDLENBQUM7UUFDeEgsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxPQUFPLE1BQU0sQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0RSxNQUFNLElBQUksNkJBQTZCLENBQUMsbUJBQW1CLEVBQUUsRUFBRSxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsT0FBUSxNQUFxRCxDQUFDLGdCQUFnQixDQUFDO0lBQ2pGLENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSyxLQUFLLENBQUMsWUFBWSxDQUN4QixVQUFrRCxFQUNsRCxhQUFhLEdBQVksR0FBRyxFQUFFO1FBQzVCLE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzVELENBQUM7UUFFRCxNQUFNLFVBQVUsR0FBRyxJQUFJLGVBQWUsRUFBRSxDQUFDO1FBQ3pDLElBQUksS0FBZ0QsQ0FBQztRQUNyRCxNQUFNLFFBQVEsR0FBRyxJQUFJLE9BQU8sQ0FBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRTtZQUNsRCxLQUFLLEdBQUcsVUFBVSxDQUFDLEdBQUcsRUFBRTtnQkFDdEIsVUFBVSxDQUFDLEtBQUssQ0FBQyxJQUFJLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUMsQ0FBQztnQkFDdEUsSUFBSSxDQUFDO29CQUNILE9BQU8sQ0FBQyxhQUFhLEVBQUUsQ0FBQyxDQUFDO2dCQUMzQixDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQ2YsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO2dCQUNoQixDQUFDO1lBQ0gsQ0FBQyxFQUFFLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBQzdCLENBQUMsQ0FBQyxDQUFDO1FBQ0gsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5QyxxR0FBcUc7UUFDckcsT0FBTyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMvQixJQUFJLENBQUM7WUFDSCxPQUFPLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE9BQU8sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ2pELENBQUM7Z0JBQVMsQ0FBQztZQUNULFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUN0QixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7O09BSUc7SUFDSyxLQUFLLENBQUMsSUFBSSxDQUNoQixNQUFjLEVBQ2QsT0FBdUMsRUFDdkMsVUFBVSxHQUEyQixFQUFFLEVBQ3ZDLFNBQXVCO1FBRXZCLElBQUksU0FBUyxFQUFFLENBQUM7WUFDZCxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDcEIsQ0FBQztRQUNELElBQUksUUFBa0IsQ0FBQztRQUN2QixJQUFJLENBQUM7WUFDSCxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRTtnQkFDbkMsTUFBTSxFQUFFLE1BQU07Z0JBQ2QsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsVUFBVSxFQUFFO2dCQUM5RCxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUM7Z0JBQzdCLFdBQVcsRUFBRSxNQUFNO2dCQUNuQixLQUFLLEVBQUUsVUFBVTtnQkFDakIsUUFBUSxFQUFFLE9BQU87Z0JBQ2pCLGNBQWMsRUFBRSxhQUFhO2dCQUM3QixHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQzVDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGdCQUFnQixFQUFFLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksTUFBZSxDQUFDO1FBQ3BCLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNqQyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsMkRBQTJEO1lBQzNELE1BQU0sR0FBRyxTQUFTLENBQUM7WUFDbkIsSUFBSSxTQUFTLEVBQUUsQ0FBQztnQkFDZCxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDcEIsQ0FBQztZQUNELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQztnQkFDNUIsTUFBTSxJQUFJLDZCQUE2QixDQUFDLG1CQUFtQixFQUFFLEVBQUUsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7WUFDaEYsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ2QsTUFBTSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3BCLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssR0FBRyxFQUFFLENBQUM7WUFDNUIsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGlCQUFpQixFQUFFO2dCQUN6RCxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU07Z0JBQ3ZCLEdBQUcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxXQUFXLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDbkYsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7Q0FDRiJ9