@idp.global/sdk 19.4.0 → 19.6.0

package/dist_ts_relyingparty/classes.idpoidcprovider.js

@@ -2,26 +2,123 @@ import * as plugins from './plugins.js';
 import { OidcIntrospectionClient, OidcIntrospectionError, } from '../dist_ts_server/classes.oidc-introspection-client.js';
 import { createTrustedCaFetch } from '../dist_ts_server/helpers.trusted-ca-fetch.js';
 export const OIDC_PROMPTS = ['none', 'login', 'consent'];
-/** The provider could not be asked, or did not answer in its own contract. The caller fails closed on it. */
-export class OidcAuthorityUnavailableError extends Error {
+export const OIDC_PROVIDER_ERROR_CODES = [
+    'token_exchange_refused',
+    'login_mismatch',
+    'invalid_response',
+    'provider_unreachable',
+    'refresh_refused',
+];
+/** An OAuth error code is a short token; anything else a provider sends there is dropped, never kept. */
+const OAUTH_ERROR_PATTERN = /^[A-Za-z0-9_.-]{1,64}$/;
+const oauthErrorOf = (valueArg) => typeof valueArg === 'string' && OAUTH_ERROR_PATTERN.test(valueArg) ? valueArg : undefined;
+/** The OAuth error and HTTP status of an openid-client failure that is the provider's own answer; `null` for any other failure. */
+const providerAnswerOf = (errorArg) => {
+    const openidClient = plugins.openidClient;
+    if (errorArg instanceof openidClient.ResponseBodyError) {
+        return { oauthError: oauthErrorOf(errorArg.error), status: errorArg.status };
+    }
+    if (errorArg instanceof openidClient.AuthorizationResponseError) {
+        return { oauthError: oauthErrorOf(errorArg.error) };
+    }
+    if (errorArg instanceof openidClient.WWWAuthenticateChallengeError) {
+        return { oauthError: oauthErrorOf(errorArg.cause[0]?.parameters.error), status: errorArg.status };
+    }
+    return null;
+};
+/** openid-client's codes (`ClientError.code`) for a provider that did not answer in time or within HTTP's own contract. */
+const UNREACHABLE_CLIENT_ERROR_CODES = ['OAUTH_TIMEOUT', 'OAUTH_ABORT', 'OAUTH_RESPONSE_IS_NOT_CONFORM'];
+/** openid-client's code for a JWT claim that is not the expected one: the nonce, the issuer, the audience or the authorized party. */
+const JWT_CLAIM_COMPARISON_CODE = 'OAUTH_JWT_CLAIM_COMPARISON_FAILED';
+/**
+ * The class of an openid-client failure of the code exchange or of UserInfo.
+ * The provider's own OAuth error answer is a refusal, or unreachable on a 5xx;
+ * a claim that does not match is not this login's; every other failure of
+ * openid-client's checks is an invalid response; and anything else (a
+ * transport failure is fetch's `TypeError`) is an unreachable provider.
+ */
+const classifyCompletionFailure = (errorArg) => {
+    if (errorArg instanceof OidcProviderError) {
+        return { code: errorArg.code, oauthError: errorArg.oauthError };
+    }
+    const answer = providerAnswerOf(errorArg);
+    if (answer) {
+        const code = answer.status !== undefined && answer.status >= 500
+            ? 'provider_unreachable'
+            : 'token_exchange_refused';
+        return { code, oauthError: answer.oauthError };
+    }
+    if (errorArg instanceof plugins.openidClient.ClientError) {
+        if (errorArg.code === JWT_CLAIM_COMPARISON_CODE) {
+            return { code: 'login_mismatch' };
+        }
+        return { code: errorArg.code !== undefined && UNREACHABLE_CLIENT_ERROR_CODES.includes(errorArg.code) ? 'provider_unreachable' : 'invalid_response' };
+    }
+    return { code: 'provider_unreachable' };
+};
+/** Why a refresh could not be made: openid-client's checks failed on the answer, or the provider could not be asked. */
+const refreshFailureReasonOf = (errorArg) => errorArg instanceof plugins.openidClient.ClientError
+    && !(errorArg.code !== undefined && UNREACHABLE_CLIENT_ERROR_CODES.includes(errorArg.code))
+    ? 'invalid_response'
+    : 'unavailable';
+/**
+ * Every failure of the provider this module throws: its `code` says which
+ * case it is, `oauthError` the provider's own OAuth error code where it sent
+ * one (a short token, never its description). An application classifies a
+ * failure by these and never by openid-client's classes; `cause` keeps the
+ * original for a debugger, not for a log line.
+ */
+export class OidcProviderError extends Error {
+    code;
+    oauthError;
+    constructor(messageArg, detailArg, causeArg) {
+        super(messageArg, { cause: causeArg });
+        this.name = 'OidcProviderError';
+        if (!OIDC_PROVIDER_ERROR_CODES.includes(detailArg?.code)) {
+            throw new TypeError('OidcProviderError needs one of OIDC_PROVIDER_ERROR_CODES');
+        }
+        this.code = detailArg.code;
+        const oauthError = oauthErrorOf(detailArg.oauthError);
+        if (oauthError !== undefined) {
+            this.oauthError = oauthError;
+        }
+    }
+}
+/**
+ * The provider could not be asked, or did not answer in its own contract. The
+ * caller fails closed on it. `code` is `provider_unreachable` or
+ * `invalid_response`, after `reason`.
+ */
+export class OidcAuthorityUnavailableError extends OidcProviderError {
     reason;
     constructor(reason, causeArg) {
-        super('The identity provider could not be observed', { cause: causeArg });
+        super('The identity provider could not be observed', {
+            code: reason === 'invalid_response' ? 'invalid_response' : 'provider_unreachable',
+            oauthError: providerAnswerOf(causeArg)?.oauthError,
+        }, causeArg);
         this.reason = reason;
         this.name = 'OidcAuthorityUnavailableError';
     }
 }
-/** The provider refused the refresh with `invalid_grant`: the refresh family is revoked, expired or was reused. */
-export class OidcRefreshRefusedError extends Error {
+/**
+ * The provider refused the refresh with `invalid_grant`: the refresh family is
+ * revoked, expired or was reused. `code` is `refresh_refused`.
+ */
+export class OidcRefreshRefusedError extends OidcProviderError {
     constructor(causeArg) {
-        super('The identity provider refused the refresh', { cause: causeArg });
+        super('The identity provider refused the refresh', { code: 'refresh_refused', oauthError: 'invalid_grant' }, causeArg);
         this.name = 'OidcRefreshRefusedError';
     }
 }
-export class OidcCompletionError extends Error {
+/**
+ * A login the provider half could not complete. `stage` says where it
+ * stopped, `code` what it was; without a `detailArg` the code is read from
+ * the cause, an openid-client failure.
+ */
+export class OidcCompletionError extends OidcProviderError {
     stage;
-    constructor(stage, causeArg) {
-        super('OIDC completion failed', { cause: causeArg });
+    constructor(stage, causeArg, detailArg) {
+        super('OIDC completion failed', detailArg ?? classifyCompletionFailure(causeArg), causeArg);
         this.stage = stage;
         this.name = 'OidcCompletionError';
     }
@@ -68,9 +165,9 @@ export const readOrganizationClaims = (valueArg) => {
 /**
  * The relying-party side of the authorization code flow with S256 PKCE on
  * `openid-client`, in the profile idp.global supports: code responses, S256
- * challenges, RS256 ID tokens and `client_secret_basic` for a confidential
- * client. Live organization authority is observed with the sdk's
- * `OidcIntrospectionClient`.
+ * challenges, RS256 ID tokens whose signature is verified against the
+ * issuer's JWKS, and `client_secret_basic` for a confidential client. Live
+ * organization authority is observed with the sdk's `OidcIntrospectionClient`.
  */
 export class IdpOidcProvider {
     requestTimeoutSeconds;
@@ -114,13 +211,18 @@ export class IdpOidcProvider {
         }
         const options = this.#options;
         // the timeout and the fetch given to discovery apply to discovery itself
-        // and stay on the resolved configuration for every later request
+        // and stay on the resolved configuration for every later request.
+        // `enableNonRepudiationChecks` verifies the signature of every ID token the
+        // code grant and the refresh grant answer against the issuer's JWKS
+        // (`jwks_uri`, fetched through the same fetch), so an ID token is never
+        // accepted on the trust of the TLS connection alone
         const configuration = await plugins.openidClient.discovery(options.issuer, options.clientId, {
             client_secret: options.clientSecret,
             token_endpoint_auth_method: 'client_secret_basic',
             id_token_signed_response_alg: 'RS256',
         }, plugins.openidClient.ClientSecretBasic(options.clientSecret), {
             timeout: this.requestTimeoutSeconds,
+            execute: [plugins.openidClient.enableNonRepudiationChecks],
             ...(this.#fetch ? { [plugins.openidClient.customFetch]: this.#fetch } : {}),
         });
         const metadata = configuration.serverMetadata();
@@ -164,6 +266,11 @@ export class IdpOidcProvider {
         });
     }
     async completeAuthorization(optionsArg) {
+        // the one state of the callback is the login's, or nothing is exchanged
+        const states = optionsArg.callbackUrl.searchParams.getAll('state');
+        if (states.length !== 1 || states[0] !== optionsArg.state) {
+            throw new OidcCompletionError('token_exchange', new Error('The callback state is not the state of this login'), { code: 'login_mismatch' });
+        }
         let tokens;
         try {
             tokens = await plugins.openidClient.authorizationCodeGrant(this.configuration, optionsArg.callbackUrl, {
@@ -185,7 +292,7 @@ export class IdpOidcProvider {
             subject = claims.sub;
         }
         catch (error) {
-            throw new OidcCompletionError('token_validation', error);
+            throw new OidcCompletionError('token_validation', error, { code: 'invalid_response' });
         }
         // UserInfo is the current view of profile and organization claims; the ID
         // token proves the login. Both are read, and the subjects must agree.
@@ -197,7 +304,7 @@ export class IdpOidcProvider {
             throw new OidcCompletionError('userinfo', error);
         }
         if (userInfo.sub !== subject) {
-            throw new OidcCompletionError('token_validation', new Error('The UserInfo subject does not match the ID token'));
+            throw new OidcCompletionError('token_validation', new Error('The UserInfo subject does not match the ID token'), { code: 'invalid_response' });
         }
         return {
             subject,
@@ -263,7 +370,10 @@ export class IdpOidcProvider {
             if (error instanceof plugins.openidClient.ResponseBodyError && error.error === 'invalid_grant') {
                 throw new OidcRefreshRefusedError(error);
             }
-            throw new OidcAuthorityUnavailableError('unavailable', error);
+            // everything else fails closed: another OAuth error (`invalid_client` for a
+            // deactivated app) or a transport failure is unreachable, an answer that
+            // fails openid-client's checks (an ID token that does not verify) is invalid
+            throw new OidcAuthorityUnavailableError(refreshFailureReasonOf(error), error);
         }
         return {
             accessToken: tokens.access_token,
@@ -272,4 +382,4 @@ export class IdpOidcProvider {
         };
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixzQkFBc0IsR0FDdkIsTUFBTSxtREFBbUQsQ0FBQztBQUMzRCxPQUFPLEVBQUUsb0JBQW9CLEVBQW1CLE1BQU0sMENBQTBDLENBQUM7QUFLakcsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUEyQixDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFpRWpGLDZHQUE2RztBQUM3RyxNQUFNLE9BQU8sNkJBQThCLFNBQVEsS0FBSztJQUVwQyxNQUFNO0lBRHhCLFlBQ2tCLE1BQTZCLEVBQzdDLFFBQWtCO1FBRWxCLEtBQUssQ0FBQyw2Q0FBNkMsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO3NCQUgxRCxNQUFNO1FBSXRCLElBQUksQ0FBQyxJQUFJLEdBQUcsK0JBQStCLENBQUM7SUFDOUMsQ0FBQztDQUNGO0FBRUQsbUhBQW1IO0FBQ25ILE1BQU0sT0FBTyx1QkFBd0IsU0FBUSxLQUFLO0lBQ2hELFlBQVksUUFBa0I7UUFDNUIsS0FBSyxDQUFDLDJDQUEyQyxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDeEUsSUFBSSxDQUFDLElBQUksR0FBRyx5QkFBeUIsQ0FBQztJQUN4QyxDQUFDO0NBQ0Y7QUFNRCxNQUFNLE9BQU8sbUJBQW9CLFNBQVEsS0FBSztJQUUxQixLQUFLO0lBRHZCLFlBQ2tCLEtBQWtDLEVBQ2xELFFBQWlCO1FBRWpCLEtBQUssQ0FBQyx3QkFBd0IsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO3FCQUhyQyxLQUFLO1FBSXJCLElBQUksQ0FBQyxJQUFJLEdBQUcscUJBQXFCLENBQUM7SUFDcEMsQ0FBQztDQUNGO0FBK0JEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLDBDQUEwQyxDQUFDO0FBRWxGLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEVBQUUsQ0FBQztBQStCM0QsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQy9ELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFM0Ysb0dBQW9HO0FBQ3BHLE1BQU0sUUFBUSxHQUFHLENBQUMsWUFBZ0MsRUFBVSxFQUFFLENBQzVELE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLFlBQVksR0FBRyxDQUFDO0lBQ25GLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxLQUFLO0lBQy9DLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFUjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQ3BGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDN0IsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQTZCLEVBQUUsQ0FBQztJQUNuRCxLQUFLLE1BQU0sS0FBSyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzdCLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLEtBQWdDLENBQUM7UUFDbkQsTUFBTSxFQUFFLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QyxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzFCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDO1lBQzFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBcUIsRUFBRSxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsQ0FBQztZQUNyRixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ1AsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE9BQU8sYUFBYSxDQUFDO0FBQ3ZCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBQ1YscUJBQXFCLENBQVM7SUFDckMsUUFBUSxDQUEwQjtJQUMzQyxxRUFBcUU7SUFDNUQsTUFBTSxDQUFjO0lBQzdCLGNBQWMsQ0FBc0M7SUFDcEQsY0FBYyxDQUEyQjtJQUV6QyxZQUFZLFVBQW1DO1FBQzdDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxNQUFNLFlBQVksR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsQ0FBQyxXQUFXLFlBQVksR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyRixNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDbkYsQ0FBQztRQUNELElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3JGLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLHFCQUFxQixJQUFJLHdDQUF3QyxDQUFDO1FBQzdGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksT0FBTyxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxDQUFDLHFCQUFxQixHQUFHLE9BQU8sQ0FBQztRQUNyQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sVUFBVSxDQUFDLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDLFlBQVksS0FBSyxTQUFTO1lBQ2pELENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQy9DLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDO0lBQzdCLENBQUM7SUFFRCxJQUFZLGFBQWE7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQztJQUM3QixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDOUIseUVBQXlFO1FBQ3pFLGlFQUFpRTtRQUNqRSxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUN4RCxPQUFPLENBQUMsTUFBTSxFQUNkLE9BQU8sQ0FBQyxRQUFRLEVBQ2hCO1lBQ0UsYUFBYSxFQUFFLE9BQU8sQ0FBQyxZQUFZO1lBQ25DLDBCQUEwQixFQUFFLHFCQUFxQjtZQUNqRCw0QkFBNEIsRUFBRSxPQUFPO1NBQ3RDLEVBQ0QsT0FBTyxDQUFDLFlBQVksQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQzVEO1lBQ0UsT0FBTyxFQUFFLElBQUksQ0FBQyxxQkFBcUI7WUFDbkMsR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVFLENBQ0YsQ0FBQztRQUNGLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsUUFBUSxDQUFDLHNCQUFzQixJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2RixNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsZ0NBQWdDLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUNFLFFBQVEsQ0FBQyxxQ0FBcUM7ZUFDM0MsQ0FBQyxRQUFRLENBQUMscUNBQXFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUNwRSxDQUFDO1lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQ3JHLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMscUJBQXFCLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDaEcsc0VBQXNFO1lBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLHVCQUF1QixDQUFDO1lBQ2hELE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU07WUFDN0IsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQzFCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNsQyxHQUFHLENBQUMsT0FBTyxDQUFDLHNCQUFzQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLGNBQWMsR0FBRyxhQUFhLENBQUM7SUFDdEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFxQztRQUN0RSxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsMEJBQTBCLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3JHLE9BQU8sT0FBTyxDQUFDLFlBQVksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFO1lBQ3BFLFlBQVksRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJO1lBQzVDLGFBQWEsRUFBRSxNQUFNO1lBQ3JCLEtBQUssRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSx1QkFBdUI7WUFDdEQsY0FBYyxFQUFFLGFBQWE7WUFDN0IscUJBQXFCLEVBQUUsTUFBTTtZQUM3QixLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDdkIsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQ3ZCLEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUM1RCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQWtDO1FBQ25FLElBQUksTUFBK0UsQ0FBQztRQUNwRixJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsVUFBVSxDQUFDLFdBQVcsRUFBRTtnQkFDckcsZ0JBQWdCLEVBQUUsVUFBVSxDQUFDLFlBQVk7Z0JBQ3pDLGFBQWEsRUFBRSxVQUFVLENBQUMsS0FBSztnQkFDL0IsYUFBYSxFQUFFLFVBQVUsQ0FBQyxLQUFLO2dCQUMvQixlQUFlLEVBQUUsSUFBSTthQUN0QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxnQkFBZ0IsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBRUQsSUFBSSxPQUFlLENBQUM7UUFDcEIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQy9CLElBQUksQ0FBQyxNQUFNLEVBQUUsR0FBRyxFQUFFLENBQUM7Z0JBQ2pCLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztZQUMzRCxDQUFDO1lBQ0QsT0FBTyxHQUFHLE1BQU0sQ0FBQyxHQUFHLENBQUM7UUFDdkIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksbUJBQW1CLENBQUMsa0JBQWtCLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUVELDBFQUEwRTtRQUMxRSxzRUFBc0U7UUFDdEUsSUFBSSxRQUF3RSxDQUFDO1FBQzdFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN4RyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDbkQsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLEdBQUcsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUM3QixNQUFNLElBQUksbUJBQW1CLENBQUMsa0JBQWtCLEVBQUUsSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsQ0FBQyxDQUFDO1FBQ25ILENBQUM7UUFFRCxPQUFPO1lBQ0wsT0FBTztZQUNQLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7WUFDakQsS0FBSyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ3JDLGFBQWEsRUFBRSxRQUFRLENBQUMsY0FBYyxLQUFLLElBQUk7WUFDL0MsV0FBVyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksY0FBYyxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztZQUN6RixhQUFhLEVBQUUsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7U0FDOUUsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQWdCLEVBQUUsT0FBdUI7UUFDaEUsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLFFBQVEsRUFBRSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxVQUluQztRQUNDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDekIsNERBQTREO1lBQzVELDBEQUEwRDtZQUMxRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUMsQ0FBQztRQUNoSCxDQUFDO1FBQ0QsSUFBSSxRQUFvRSxDQUFDO1FBQ3pFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDO2dCQUM5QyxLQUFLLEVBQUUsVUFBVSxDQUFDLFdBQVc7Z0JBQzdCLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztnQkFDM0IsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO2FBQzFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksc0JBQXNCLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUFFLENBQUM7b0JBQ3JDLGlFQUFpRTtvQkFDakUsdUNBQXVDO29CQUN2QyxNQUFNLEtBQUssQ0FBQztnQkFDZCxDQUFDO2dCQUNELE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3JCLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3BELENBQUM7UUFDRCxPQUFPO1lBQ0wsTUFBTSxFQUFFLElBQUk7WUFDWixLQUFLLEVBQUUsUUFBUSxDQUFDLG9CQUFvQixDQUFDLEtBQUs7WUFDMUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxHQUFHLEdBQUcsS0FBSztTQUNoQyxDQUFDO0lBQ0osQ0FBQztJQUVELCtGQUErRjtJQUN4RixLQUFLLENBQUMsYUFBYSxDQUFDLGVBQXVCO1FBQ2hELElBQUksTUFBMEUsQ0FBQztRQUMvRSxJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsZUFBZSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQy9GLE1BQU0sSUFBSSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMzQyxDQUFDO1lBQ0QsTUFBTSxJQUFJLDZCQUE2QixDQUFDLGFBQWEsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsT0FBTztZQUNMLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7U0FDbEQsQ0FBQztJQUNKLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90c19yZWx5aW5ncGFydHkvY2xhc3Nlcy5pZHBvaWRjcHJvdmlkZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFDeEMsT0FBTyxFQUNMLHVCQUF1QixFQUN2QixzQkFBc0IsR0FDdkIsTUFBTSxtREFBbUQsQ0FBQztBQUMzRCxPQUFPLEVBQUUsb0JBQW9CLEVBQW1CLE1BQU0sMENBQTBDLENBQUM7QUFLakcsTUFBTSxDQUFDLE1BQU0sWUFBWSxHQUEyQixDQUFDLE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxDQUFDLENBQUM7QUEwRmpGLE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFzQztJQUMxRSx3QkFBd0I7SUFDeEIsZ0JBQWdCO0lBQ2hCLGtCQUFrQjtJQUNsQixzQkFBc0I7SUFDdEIsaUJBQWlCO0NBQ2xCLENBQUM7QUFFRix5R0FBeUc7QUFDekcsTUFBTSxtQkFBbUIsR0FBRyx3QkFBd0IsQ0FBQztBQUVyRCxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FDN0QsT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLG1CQUFtQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFNUYsbUlBQW1JO0FBQ25JLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxRQUFpQixFQUFtRCxFQUFFO0lBQzlGLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUM7SUFDMUMsSUFBSSxRQUFRLFlBQVksWUFBWSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDdkQsT0FBTyxFQUFFLFVBQVUsRUFBRSxZQUFZLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUM7SUFDL0UsQ0FBQztJQUNELElBQUksUUFBUSxZQUFZLFlBQVksQ0FBQywwQkFBMEIsRUFBRSxDQUFDO1FBQ2hFLE9BQU8sRUFBRSxVQUFVLEVBQUUsWUFBWSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO0lBQ3RELENBQUM7SUFDRCxJQUFJLFFBQVEsWUFBWSxZQUFZLENBQUMsNkJBQTZCLEVBQUUsQ0FBQztRQUNuRSxPQUFPLEVBQUUsVUFBVSxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO0lBQ3BHLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQUVGLDJIQUEySDtBQUMzSCxNQUFNLDhCQUE4QixHQUFzQixDQUFDLGVBQWUsRUFBRSxhQUFhLEVBQUUsK0JBQStCLENBQUMsQ0FBQztBQUM1SCxzSUFBc0k7QUFDdEksTUFBTSx5QkFBeUIsR0FBRyxtQ0FBbUMsQ0FBQztBQUV0RTs7Ozs7O0dBTUc7QUFDSCxNQUFNLHlCQUF5QixHQUFHLENBQUMsUUFBaUIsRUFBeUQsRUFBRTtJQUM3RyxJQUFJLFFBQVEsWUFBWSxpQkFBaUIsRUFBRSxDQUFDO1FBQzFDLE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxDQUFDLElBQUksRUFBRSxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsRUFBRSxDQUFDO0lBQ2xFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUMxQyxJQUFJLE1BQU0sRUFBRSxDQUFDO1FBQ1gsTUFBTSxJQUFJLEdBQTJCLE1BQU0sQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLE1BQU0sQ0FBQyxNQUFNLElBQUksR0FBRztZQUN0RixDQUFDLENBQUMsc0JBQXNCO1lBQ3hCLENBQUMsQ0FBQyx3QkFBd0IsQ0FBQztRQUM3QixPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDakQsQ0FBQztJQUNELElBQUksUUFBUSxZQUFZLE9BQU8sQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDekQsSUFBSSxRQUFRLENBQUMsSUFBSSxLQUFLLHlCQUF5QixFQUFFLENBQUM7WUFDaEQsT0FBTyxFQUFFLElBQUksRUFBRSxnQkFBZ0IsRUFBRSxDQUFDO1FBQ3BDLENBQUM7UUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDLHNCQUFzQixDQUFDLENBQUMsQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO0lBQ3ZKLENBQUM7SUFDRCxPQUFPLEVBQUUsSUFBSSxFQUFFLHNCQUFzQixFQUFFLENBQUM7QUFDMUMsQ0FBQyxDQUFDO0FBRUYsd0hBQXdIO0FBQ3hILE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUF5QixFQUFFLENBQzFFLFFBQVEsWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVc7T0FDL0MsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLEtBQUssU0FBUyxJQUFJLDhCQUE4QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0YsQ0FBQyxDQUFDLGtCQUFrQjtJQUNwQixDQUFDLENBQUMsYUFBYSxDQUFDO0FBRXBCOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxpQkFBa0IsU0FBUSxLQUFLO0lBQzFCLElBQUksQ0FBeUI7SUFDN0IsVUFBVSxDQUFVO0lBRXBDLFlBQ0UsVUFBa0IsRUFDbEIsU0FBZ0UsRUFDaEUsUUFBa0I7UUFFbEIsS0FBSyxDQUFDLFVBQVUsRUFBRSxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxJQUFJLEdBQUcsbUJBQW1CLENBQUM7UUFDaEMsSUFBSSxDQUFDLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUN6RCxNQUFNLElBQUksU0FBUyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLEdBQUcsU0FBUyxDQUFDLElBQUksQ0FBQztRQUMzQixNQUFNLFVBQVUsR0FBRyxZQUFZLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ3RELElBQUksVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQzdCLElBQUksQ0FBQyxVQUFVLEdBQUcsVUFBVSxDQUFDO1FBQy9CLENBQUM7SUFDSCxDQUFDO0NBQ0Y7QUFLRDs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLDZCQUE4QixTQUFRLGlCQUFpQjtJQUVoRCxNQUFNO0lBRHhCLFlBQ2tCLE1BQTZCLEVBQzdDLFFBQWtCO1FBRWxCLEtBQUssQ0FDSCw2Q0FBNkMsRUFDN0M7WUFDRSxJQUFJLEVBQUUsTUFBTSxLQUFLLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsc0JBQXNCO1lBQ2pGLFVBQVUsRUFBRSxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsRUFBRSxVQUFVO1NBQ25ELEVBQ0QsUUFBUSxDQUNULENBQUM7c0JBVmMsTUFBTTtRQVd0QixJQUFJLENBQUMsSUFBSSxHQUFHLCtCQUErQixDQUFDO0lBQzlDLENBQUM7Q0FDRjtBQUVEOzs7R0FHRztBQUNILE1BQU0sT0FBTyx1QkFBd0IsU0FBUSxpQkFBaUI7SUFDNUQsWUFBWSxRQUFrQjtRQUM1QixLQUFLLENBQUMsMkNBQTJDLEVBQUUsRUFBRSxJQUFJLEVBQUUsaUJBQWlCLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3ZILElBQUksQ0FBQyxJQUFJLEdBQUcseUJBQXlCLENBQUM7SUFDeEMsQ0FBQztDQUNGO0FBTUQ7Ozs7R0FJRztBQUNILE1BQU0sT0FBTyxtQkFBb0IsU0FBUSxpQkFBaUI7SUFFdEMsS0FBSztJQUR2QixZQUNrQixLQUFrQyxFQUNsRCxRQUFpQixFQUNqQixTQUFpRTtRQUVqRSxLQUFLLENBQUMsd0JBQXdCLEVBQUUsU0FBUyxJQUFJLHlCQUF5QixDQUFDLFFBQVEsQ0FBQyxFQUFFLFFBQVEsQ0FBQyxDQUFDO3FCQUo1RSxLQUFLO1FBS3JCLElBQUksQ0FBQyxJQUFJLEdBQUcscUJBQXFCLENBQUM7SUFDcEMsQ0FBQztDQUNGO0FBK0JEOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLDBDQUEwQyxDQUFDO0FBRWxGLE1BQU0sQ0FBQyxNQUFNLHdDQUF3QyxHQUFHLEVBQUUsQ0FBQztBQStCM0QsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQy9ELE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFM0Ysb0dBQW9HO0FBQ3BHLE1BQU0sUUFBUSxHQUFHLENBQUMsWUFBZ0MsRUFBVSxFQUFFLENBQzVELE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxJQUFJLFlBQVksR0FBRyxDQUFDO0lBQ25GLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsR0FBRyxLQUFLO0lBQy9DLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFUjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFpQixFQUE0QixFQUFFO0lBQ3BGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDN0IsT0FBTyxFQUFFLENBQUM7SUFDWixDQUFDO0lBQ0QsTUFBTSxhQUFhLEdBQTZCLEVBQUUsQ0FBQztJQUNuRCxLQUFLLE1BQU0sS0FBSyxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQzdCLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sU0FBUyxHQUFHLEtBQWdDLENBQUM7UUFDbkQsTUFBTSxFQUFFLEdBQUcsY0FBYyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUN4QyxNQUFNLElBQUksR0FBRyxjQUFjLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxHQUFHLGNBQWMsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLEVBQUUsSUFBSSxDQUFDLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzFCLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDO1lBQzFDLENBQUMsQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE9BQU8sRUFBcUIsRUFBRSxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsQ0FBQztZQUNyRixDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ1AsYUFBYSxDQUFDLElBQUksQ0FBQyxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUNELE9BQU8sYUFBYSxDQUFDO0FBQ3ZCLENBQUMsQ0FBQztBQUVGOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBQ1YscUJBQXFCLENBQVM7SUFDckMsUUFBUSxDQUEwQjtJQUMzQyxxRUFBcUU7SUFDNUQsTUFBTSxDQUFjO0lBQzdCLGNBQWMsQ0FBc0M7SUFDcEQsY0FBYyxDQUEyQjtJQUV6QyxZQUFZLFVBQW1DO1FBQzdDLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxNQUFNLFlBQVksR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLFVBQVUsQ0FBQyxXQUFXLFlBQVksR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUNyRixNQUFNLElBQUksS0FBSyxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDbkYsQ0FBQztRQUNELElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsY0FBYyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQ3JGLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBVSxDQUFDLHFCQUFxQixJQUFJLHdDQUF3QyxDQUFDO1FBQzdGLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxJQUFJLE9BQU8sR0FBRyxDQUFDLElBQUksT0FBTyxHQUFHLEVBQUUsRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsSUFBSSxDQUFDLHFCQUFxQixHQUFHLE9BQU8sQ0FBQztRQUNyQyxJQUFJLFVBQVUsQ0FBQyxZQUFZLEtBQUssU0FBUyxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDNUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxJQUFJLFVBQVUsQ0FBQyxLQUFLLEtBQUssU0FBUyxJQUFJLE9BQU8sVUFBVSxDQUFDLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUM3RSxNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUcsVUFBVSxDQUFDLFlBQVksS0FBSyxTQUFTO1lBQ2pELENBQUMsQ0FBQyxvQkFBb0IsQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1lBQy9DLENBQUMsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxRQUFRLEdBQUcsVUFBVSxDQUFDO0lBQzdCLENBQUM7SUFFRCxJQUFZLGFBQWE7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDLGNBQWMsQ0FBQztJQUM3QixDQUFDO0lBRU0sS0FBSyxDQUFDLElBQUk7UUFDZixJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxRQUFRLENBQUM7UUFDOUIseUVBQXlFO1FBQ3pFLGtFQUFrRTtRQUNsRSw0RUFBNEU7UUFDNUUsb0VBQW9FO1FBQ3BFLHdFQUF3RTtRQUN4RSxvREFBb0Q7UUFDcEQsTUFBTSxhQUFhLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FDeEQsT0FBTyxDQUFDLE1BQU0sRUFDZCxPQUFPLENBQUMsUUFBUSxFQUNoQjtZQUNFLGFBQWEsRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNuQywwQkFBMEIsRUFBRSxxQkFBcUI7WUFDakQsNEJBQTRCLEVBQUUsT0FBTztTQUN0QyxFQUNELE9BQU8sQ0FBQyxZQUFZLENBQUMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUM1RDtZQUNFLE9BQU8sRUFBRSxJQUFJLENBQUMscUJBQXFCO1lBQ25DLE9BQU8sRUFBRSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsMEJBQTBCLENBQUM7WUFDMUQsR0FBRyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxFQUFFLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVFLENBQ0YsQ0FBQztRQUNGLE1BQU0sUUFBUSxHQUFHLGFBQWEsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNoRCxJQUFJLENBQUMsUUFBUSxDQUFDLHNCQUFzQixJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUN2RixNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELElBQUksQ0FBQyxRQUFRLENBQUMsZ0NBQWdDLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDakUsTUFBTSxJQUFJLEtBQUssQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUNFLFFBQVEsQ0FBQyxxQ0FBcUM7ZUFDM0MsQ0FBQyxRQUFRLENBQUMscUNBQXFDLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUNwRSxDQUFDO1lBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxxQkFBcUIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQ3JHLE1BQU0sSUFBSSxLQUFLLENBQUMsaUVBQWlFLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMscUJBQXFCLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7WUFDaEcsc0VBQXNFO1lBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUNoRixDQUFDO1FBQ0QsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLHVCQUF1QixDQUFDO1lBQ2hELE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU07WUFDN0IsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRO1lBQzFCLFlBQVksRUFBRSxPQUFPLENBQUMsWUFBWTtZQUNsQyxHQUFHLENBQUMsT0FBTyxDQUFDLHNCQUFzQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsT0FBTyxDQUFDLHNCQUFzQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN0RyxHQUFHLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLGNBQWMsR0FBRyxhQUFhLENBQUM7SUFDdEMsQ0FBQztJQUVNLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxVQUFxQztRQUN0RSxNQUFNLGFBQWEsR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsMEJBQTBCLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3JHLE9BQU8sT0FBTyxDQUFDLFlBQVksQ0FBQyxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFO1lBQ3BFLFlBQVksRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJO1lBQzVDLGFBQWEsRUFBRSxNQUFNO1lBQ3JCLEtBQUssRUFBRSxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSx1QkFBdUI7WUFDdEQsY0FBYyxFQUFFLGFBQWE7WUFDN0IscUJBQXFCLEVBQUUsTUFBTTtZQUM3QixLQUFLLEVBQUUsVUFBVSxDQUFDLEtBQUs7WUFDdkIsS0FBSyxFQUFFLFVBQVUsQ0FBQyxLQUFLO1lBQ3ZCLEdBQUcsQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztTQUM1RCxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLHFCQUFxQixDQUFDLFVBQWtDO1FBQ25FLHdFQUF3RTtRQUN4RSxNQUFNLE1BQU0sR0FBRyxVQUFVLENBQUMsV0FBVyxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbkUsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxNQUFNLENBQUMsQ0FBQyxDQUFDLEtBQUssVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQzFELE1BQU0sSUFBSSxtQkFBbUIsQ0FDM0IsZ0JBQWdCLEVBQ2hCLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLEVBQzlELEVBQUUsSUFBSSxFQUFFLGdCQUFnQixFQUFFLENBQzNCLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxNQUErRSxDQUFDO1FBQ3BGLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxZQUFZLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxVQUFVLENBQUMsV0FBVyxFQUFFO2dCQUNyRyxnQkFBZ0IsRUFBRSxVQUFVLENBQUMsWUFBWTtnQkFDekMsYUFBYSxFQUFFLFVBQVUsQ0FBQyxLQUFLO2dCQUMvQixhQUFhLEVBQUUsVUFBVSxDQUFDLEtBQUs7Z0JBQy9CLGVBQWUsRUFBRSxJQUFJO2FBQ3RCLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLG1CQUFtQixDQUFDLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCxJQUFJLE9BQWUsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDL0IsSUFBSSxDQUFDLE1BQU0sRUFBRSxHQUFHLEVBQUUsQ0FBQztnQkFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1lBQzNELENBQUM7WUFDRCxPQUFPLEdBQUcsTUFBTSxDQUFDLEdBQUcsQ0FBQztRQUN2QixDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUNmLE1BQU0sSUFBSSxtQkFBbUIsQ0FBQyxrQkFBa0IsRUFBRSxLQUFLLEVBQUUsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDO1FBQ3pGLENBQUM7UUFFRCwwRUFBMEU7UUFDMUUsc0VBQXNFO1FBQ3RFLElBQUksUUFBd0UsQ0FBQztRQUM3RSxJQUFJLENBQUM7WUFDSCxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGFBQWEsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxZQUFZLEVBQUUsT0FBTyxDQUFDLENBQUM7UUFDeEcsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixNQUFNLElBQUksbUJBQW1CLENBQUMsVUFBVSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxHQUFHLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDN0IsTUFBTSxJQUFJLG1CQUFtQixDQUMzQixrQkFBa0IsRUFDbEIsSUFBSSxLQUFLLENBQUMsa0RBQWtELENBQUMsRUFDN0QsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsQ0FDN0IsQ0FBQztRQUNKLENBQUM7UUFFRCxPQUFPO1lBQ0wsT0FBTztZQUNQLFdBQVcsRUFBRSxNQUFNLENBQUMsWUFBWTtZQUNoQyxHQUFHLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDdkUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUM7WUFDakQsS0FBSyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDO1lBQ3JDLGFBQWEsRUFBRSxRQUFRLENBQUMsY0FBYyxLQUFLLElBQUk7WUFDL0MsV0FBVyxFQUFFLGNBQWMsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksY0FBYyxDQUFDLFFBQVEsQ0FBQyxrQkFBa0IsQ0FBQztZQUN6RixhQUFhLEVBQUUsc0JBQXNCLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsZUFBZSxDQUFDLENBQUM7U0FDOUUsQ0FBQztJQUNKLENBQUM7SUFFTSxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQWdCLEVBQUUsT0FBdUI7UUFDaEUsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsYUFBYSxFQUFFLFFBQVEsRUFBRSxFQUFFLGVBQWUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDO0lBQ3pHLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNJLEtBQUssQ0FBQyxzQkFBc0IsQ0FBQyxVQUluQztRQUNDLElBQUksQ0FBQyxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDekIsNERBQTREO1lBQzVELDBEQUEwRDtZQUMxRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLElBQUksS0FBSyxDQUFDLDBDQUEwQyxDQUFDLENBQUMsQ0FBQztRQUNoSCxDQUFDO1FBQ0QsSUFBSSxRQUFvRSxDQUFDO1FBQ3pFLElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDO2dCQUM5QyxLQUFLLEVBQUUsVUFBVSxDQUFDLFdBQVc7Z0JBQzdCLE9BQU8sRUFBRSxVQUFVLENBQUMsT0FBTztnQkFDM0IsY0FBYyxFQUFFLFVBQVUsQ0FBQyxjQUFjO2FBQzFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2YsSUFBSSxLQUFLLFlBQVksc0JBQXNCLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxLQUFLLENBQUMsSUFBSSxLQUFLLGlCQUFpQixFQUFFLENBQUM7b0JBQ3JDLGlFQUFpRTtvQkFDakUsdUNBQXVDO29CQUN2QyxNQUFNLEtBQUssQ0FBQztnQkFDZCxDQUFDO2dCQUNELE1BQU0sSUFBSSw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLElBQUksNkJBQTZCLENBQUMsYUFBYSxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3JCLE9BQU8sRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLEVBQUUsU0FBUyxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3BELENBQUM7UUFDRCxPQUFPO1lBQ0wsTUFBTSxFQUFFLElBQUk7WUFDWixLQUFLLEVBQUUsUUFBUSxDQUFDLG9CQUFvQixDQUFDLEtBQUs7WUFDMUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxHQUFHLEdBQUcsS0FBSztTQUNoQyxDQUFDO0lBQ0osQ0FBQztJQUVELCtGQUErRjtJQUN4RixLQUFLLENBQUMsYUFBYSxDQUFDLGVBQXVCO1FBQ2hELElBQUksTUFBMEUsQ0FBQztRQUMvRSxJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsZUFBZSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLEtBQUssWUFBWSxPQUFPLENBQUMsWUFBWSxDQUFDLGlCQUFpQixJQUFJLEtBQUssQ0FBQyxLQUFLLEtBQUssZUFBZSxFQUFFLENBQUM7Z0JBQy9GLE1BQU0sSUFBSSx1QkFBdUIsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUMzQyxDQUFDO1lBQ0QsNEVBQTRFO1lBQzVFLHlFQUF5RTtZQUN6RSw2RUFBNkU7WUFDN0UsTUFBTSxJQUFJLDZCQUE2QixDQUFDLHNCQUFzQixDQUFDLEtBQUssQ0FBQyxFQUFFLEtBQUssQ0FBQyxDQUFDO1FBQ2hGLENBQUM7UUFDRCxPQUFPO1lBQ0wsV0FBVyxFQUFFLE1BQU0sQ0FBQyxZQUFZO1lBQ2hDLEdBQUcsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsYUFBYSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUN2RSxvQkFBb0IsRUFBRSxRQUFRLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQztTQUNsRCxDQUFDO0lBQ0osQ0FBQztDQUNGIn0=

package/dist_ts_relyingparty/classes.relyingpartysessions.d.ts

@@ -1,6 +1,6 @@
 import { type IOidcProvider } from './classes.idpoidcprovider.js';
 import type { IRelyingPartyModels } from './classes.rpmodels.js';
-import type { IAuthorityTokenSource, IProviderToken, IRelyingPartyBearerDelivery, IRelyingPartyBearerHandoff, IRelyingPartyBearerLoginRequest, IRelyingPartyBearerLoginStart, IRelyingPartyBearerOptions, IRelyingPartyBearerReturnTargets, IRelyingPartyBearerTokens, IRelyingPartyHooks, IRelyingPartyLiveSession, IRelyingPartyLoginOptions, IRelyingPartyLoginStart, IRelyingPartySession, IRelyingPartySessionOpening, IRelyingPartySessionsPage, IRelyingPartySessionsPageOptions, IResolvedRelyingPartySession, TRelyingPartyPrincipals, TRelyingPartySessionEndReason } from './interfaces.js';
+import type { IAuthorityTokenSource, IProviderToken, IRelyingPartyBearerDelivery, IRelyingPartyBearerHandoff, IRelyingPartyBearerHandoffOpening, IRelyingPartyBearerLoginRequest, IRelyingPartyBearerLoginStart, IRelyingPartyBearerOptions, IRelyingPartyBearerReturnTargets, IRelyingPartyBearerTokens, IRelyingPartyCookiePolicy, IRelyingPartyHooks, IRelyingPartyLiveSession, IRelyingPartyLoginOptions, IRelyingPartyLoginStart, IRelyingPartySession, IRelyingPartySessionOpening, IRelyingPartySessionsErasure, IRelyingPartySessionsPage, IRelyingPartySessionsPageOptions, IResolvedRelyingPartySession, TRelyingPartyPrincipals, TRelyingPartySessionEndReason } from './interfaces.js';
 export declare const RELYING_PARTY_DEFAULT_SESSION_MAX_AGE_SECONDS: number;
 export declare const RELYING_PARTY_DEFAULT_LOGIN_PATH_PREFIX = "/auth/";
 /** The label the CSRF HMAC starts with unless the application names its own. */
@@ -17,6 +17,10 @@ export declare const RELYING_PARTY_MAX_SESSIONS_PAGE_LIMIT = 1000;
 export declare const BEARER_HANDOFF_MAX_AGE_SECONDS = 60;
 /** How long a bearer access token lives unless `bearer.accessTokenMaxAgeSeconds` says otherwise. */
 export declare const RELYING_PARTY_DEFAULT_BEARER_ACCESS_TOKEN_MAX_AGE_SECONDS: number;
+/** How long a spent refresh token may come back as a lost answer unless `bearer.refreshReuseGraceSeconds` says otherwise. */
+export declare const RELYING_PARTY_DEFAULT_REFRESH_REUSE_GRACE_SECONDS = 60;
+/** The longest `bearer.refreshReuseGraceSeconds`: a spent token that comes back later is always reuse. */
+export declare const RELYING_PARTY_MAX_REFRESH_REUSE_GRACE_SECONDS = 300;
 /**
  * How long ending a session waits for the provider to take its tokens back.
  * The local session is already revoked when that call runs.
@@ -62,6 +66,14 @@ export interface IRelyingPartySessionsOptions<TPrincipal extends object | undefi
         session?: string;
         intent?: string;
     };
+    /**
+     * How the session and intent cookies go across sites: `{ sameSite: 'Lax' }`
+     * by default. A page framed on another site needs `sameSite: 'None'` (an
+     * https `publicOrigin` only), with `partitioned: true` where the browser
+     * keeps third-party cookies per top-level site. The constructor refuses
+     * every other combination.
+     */
+    cookiePolicy?: IRelyingPartyCookiePolicy;
     /** the prefix of the login routes; a login never returns into it */
     loginPathPrefix?: string;
     /**
@@ -78,20 +90,22 @@ export interface IRelyingPartySessionsOptions<TPrincipal extends object | undefi
  * sign in through bearer hand-off and nothing else. The relying party never
  * reads or sets a cookie — not even the clearing intent cookie of a callback
  * that is no bearer login — so it has no CSRF token and takes no CSRF key:
- * `csrfKey`, `csrfLabel` and `cookieNames` are refused, not ignored. The
+ * `csrfKey`, `csrfLabel`, `cookieNames` and `cookiePolicy` are refused, not
+ * ignored. The
  * cookie steps (`openSession`, `startLogin`, `completeLogin`, `abandonLogin`,
  * `finalizeLogin`, `clearSessionCookie`, `clearIntentCookie`) throw
  * `RelyingPartyError('login_method_unavailable')` and `resolveCookieSession`
  * answers `null`.
  */
-export interface IRelyingPartyBearerOnlySessionsOptions<TPrincipal extends object | undefined = undefined> extends Omit<IRelyingPartySessionsOptions<TPrincipal>, 'provider' | 'csrfKey' | 'csrfLabel' | 'cookieNames' | 'cookieSessions' | 'bearer'> {
+export interface IRelyingPartyBearerOnlySessionsOptions<TPrincipal extends object | undefined = undefined> extends Omit<IRelyingPartySessionsOptions<TPrincipal>, 'provider' | 'csrfKey' | 'csrfLabel' | 'cookieNames' | 'cookiePolicy' | 'cookieSessions' | 'bearer'> {
     cookieSessions: false;
-    /** every bearer session is a provider login */
+    /** every bearer session comes from a live provider login, directly or through a hand-off opened from one */
     provider: IOidcProvider;
     bearer: IRelyingPartyBearerOptions;
     csrfKey?: never;
     csrfLabel?: never;
     cookieNames?: never;
+    cookiePolicy?: never;
 }
 /**
  * The relying-party session layer: provider logins through the authorization
@@ -106,10 +120,10 @@ export interface IRelyingPartyBearerOnlySessionsOptions<TPrincipal extends objec
  * ended sessions are swept one bounded batch at a time when a login starts or
  * the application opens a session, and the only timer — the revocation
  * budget — is unreferenced and cleared on every path. Every session comes
- * from a login start or from `openSession`, and each of those sweeps a batch
- * of at least one first, so removal keeps pace with creation and the ended
- * sessions kept stay bounded. Nothing here does I/O while it is constructed,
- * so it is built before the database connects.
+ * from a login start, `openSession` or `openBearerHandoff`, and each of those
+ * sweeps a batch of at least one first, so removal keeps pace with creation
+ * and the ended sessions kept stay bounded. Nothing here does I/O while it is
+ * constructed, so it is built before the database connects.
  *
  * `TPrincipal` is what a `principals.resolve` answers; with `isActive`
  * principals it stays `undefined`.
@@ -120,6 +134,8 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     readonly secureCookies: boolean;
     readonly sessionCookieName: string;
     readonly intentCookieName: string;
+    /** how the session and intent cookies go across sites, as the constructor resolved `cookiePolicy` */
+    readonly cookiePolicy: Readonly<Required<IRelyingPartyCookiePolicy>>;
     readonly loginPathPrefix: string;
     readonly sessionMaxAgeSeconds: number;
     constructor(optionsArg: IRelyingPartySessionsOptions<TPrincipal> | IRelyingPartyBearerOnlySessionsOptions<TPrincipal>);
@@ -181,10 +197,29 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     /**
      * Ends every live session of a principal but `keepSessionId` (a password
      * change keeps the session that asked for it) and answers how many ended.
+     * A session that expired is over already and is neither ended nor counted.
      */
     endSessionsOfPrincipal(principalIdArg: string, optionsArg?: {
         keepSessionId?: string;
     }): Promise<number>;
+    /**
+     * Erases every session of a principal, live or ended, and every row that
+     * belongs to one, without waiting for a sweep: what an application runs
+     * when it deletes an account, after its own erasers and before its user
+     * record.
+     *
+     * First each session not revoked yet, an expired one too, ends as
+     * `endSession` ends it: its tokens stop working at once, `onSessionEnded`
+     * names the principal, and its provider tokens go back to idp.global,
+     * which a deleted row could no longer do. Then each session's rows go: in
+     * bearer mode its hand-offs, claimed or not, and its token generations;
+     * the login attempt a provider session came out of; and the session row
+     * last, because it is the only link from the principal to the others, so
+     * an erase that fails half way leaves a retry everything it needs. A
+     * session opened or a token issued while the erase runs is not covered;
+     * it works only while the principal is active.
+     */
+    eraseSessionsOfPrincipal(principalIdArg: string): Promise<IRelyingPartySessionsErasure>;
     /**
      * One page of a principal's live sessions, newest first: the ones neither
      * ended nor expired, and none at all while the principal is not active —
@@ -248,6 +283,35 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
      * at most and only its hash is stored. A code nobody claims ends its session.
      */
     completeBearerLogin(callbackUrlArg: URL): Promise<IRelyingPartyBearerHandoff>;
+    /**
+     * Opens a bearer session for a device the application pairs to a person
+     * who is signed in here, and answers its single-use hand-off code, which
+     * the device claims at `bearer/claim` with the verifier of `codeChallenge`,
+     * exactly like the code of a bearer login.
+     *
+     * `openerSessionId` names the session that confirmed the pairing, taken
+     * from the application's own record, never from the device. It must be a
+     * live provider login: not ended, not expired, its principal active, and
+     * with a provider login of its own. A session the application opened
+     * itself or one opened here does not qualify, so a paired device never
+     * pairs another one. Anything else throws
+     * `RelyingPartyError('invalid_handoff_opener')`.
+     *
+     * The new session acts as the opener's principal and has no provider login
+     * of its own: it ends by its expiry, `endSession`, `endSessionsOfPrincipal`,
+     * `bearer/logout` or the reuse of one of its credentials, never by an
+     * idp.global logout, and `AuthorityObserver` refuses it
+     * (`authority_login_required`). `maxAgeSeconds` is a whole number from 1 to
+     * `sessionMaxAgeSeconds`, the default, as for `openSession`. The code lives
+     * `BEARER_HANDOFF_MAX_AGE_SECONDS` at most and never past the session, and
+     * only its hash is stored; a code nobody claims ends its session. Nothing
+     * is stored for a refused opening.
+     */
+    openBearerHandoff(optionsArg: {
+        openerSessionId: string;
+        codeChallenge: string;
+        maxAgeSeconds?: number;
+    }): Promise<IRelyingPartyBearerHandoffOpening>;
     /** `abandonLogin` for a bearer login: the provider came back without a code. */
     abandonBearerLogin(callbackUrlArg: URL): Promise<void>;
     /**
@@ -261,13 +325,45 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     /**
      * Rotates a bearer session's tokens: the refresh token is spent, a new
      * access and refresh token answer, and the old access token stops working.
-     * Rotation is strict — a client serializes its refreshes — because a
-     * refresh token that comes back after it was spent ends the whole session.
-     * The provider login is checked on the way: a login idp.global ended ends
-     * the session here (`invalid_bearer_grant`), an unreachable provider fails
-     * with `AuthorityTokenError('authority_unavailable')` and spends nothing.
+     * A client serializes its refreshes, because a refresh token that comes
+     * back after it was spent ends the whole session, with one exception for
+     * an answer that never reached the client: within
+     * `bearer.refreshReuseGraceSeconds` of its rotation (60 by default), a
+     * spent refresh token whose successor was never presented — neither its
+     * access token nor its refresh token — revokes that successor and answers a
+     * new pair (`bearer_refresh_reissued`). Only hashes are stored, so the lost
+     * pair is replaced, never repeated. Once the successor was presented, after
+     * the window, or for a second retry that loses the race to the first, it is
+     * reuse. The provider login of a bearer login is checked on the way: a
+     * login idp.global ended ends the session here (`invalid_bearer_grant`), an
+     * unreachable provider fails with `AuthorityTokenError('authority_unavailable')`
+     * and spends nothing. A session `openBearerHandoff` opened has no provider
+     * login (no `idpSubject` is stored) and rotates without the provider.
      */
     refreshBearerTokens(refreshTokenArg: unknown): Promise<IRelyingPartyBearerTokens>;
+    /**
+     * The successor of a spent generation when its answer may have been lost:
+     * the rotation is at most `refreshReuseGraceMs` old, and the successor is
+     * still current and was never presented. `null` otherwise, which is reuse.
+     */
+    private lostSuccessorOf;
+    /**
+     * Issues a pair again for a spent generation whose answer was lost. The
+     * successor that answer carried is revoked first, by one conditional write
+     * that needs it current and unpresented: of two retries at once exactly one
+     * takes it, and the other is reuse, as is a successor presented in the
+     * meantime. Then the new generation is stored and the spent one names it,
+     * so a retry after this answer is lost too finds it within the same window
+     * (counted from the original rotation). A failure after the revocation
+     * leaves the session without a current generation; its retry is reuse.
+     */
+    private reissueLostRotation;
+    /**
+     * Records the first presentation of a current generation's access or refresh
+     * token, once. Answers whether the generation is still current: `false`
+     * when a lost answer of its predecessor revoked it just now.
+     */
+    private markBearerGenerationPresented;
     /**
      * The live session behind a bearer access token, or `null`: the token of the
      * session's current generation, not expired, its session live and its
@@ -279,7 +375,9 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     /**
      * Ends the session of a bearer token — a live access token or the current
      * refresh token — like `endSession`. A refresh token that was already spent
-     * is reuse and ends the session as such. Answers whether this call ended it.
+     * is reuse and ends the session as such, unless `refreshBearerTokens` would
+     * take it as a lost answer (`lostSuccessorOf`): then it is a logout like the
+     * current one. Answers whether this call ended it.
      */
     endBearerSession(tokenArg: unknown): Promise<boolean>;
     /**
@@ -328,6 +426,8 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
      */
     private openProviderLogin;
     private newSessionDoc;
+    /** The attributes every session and intent cookie is set and cleared with: one policy for all of them. */
+    private cookieAttributes;
     private csrfTokenOf;
     private opening;
     private snapshot;
@@ -341,7 +441,13 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
     private createProviderSession;
     /** Where a bearer attempt's outcome goes, while its return target is still configured; `null` otherwise. */
     private bearerDeliveryOfAttempt;
-    /** Stores the next token generation of a live session and answers its tokens; none of them is stored in the clear. */
+    /**
+     * Stores a new hand-off of a session, bound to the client's challenge, and
+     * answers its code, which is stored only as a hash. The code lives
+     * `BEARER_HANDOFF_MAX_AGE_SECONDS` at most and never past the session.
+     */
+    private storeBearerHandoff;
+    /** Stores the next token generation of a live session and answers its tokens and its id; no token is stored in the clear. */
     private issueBearerTokens;
     /** A spent hand-off code or refresh token came back: whoever holds it, the session ends. */
     private bearerCredentialReused;
@@ -415,9 +521,13 @@ export declare class RelyingPartySessions<TPrincipal extends object | undefined
      * page per login start and per session the application opens. An ended
      * session's expiry is its revocation at the latest, so the expiry index
      * finds expired and revoked sessions alike. Each of them ended already: the
-     * row goes without an end, a hook or a provider call. A row is deleted only
-     * while its expiry is still past the cutoff, so a row whose expiry moved
-     * after the page was read stays. A sweep that cannot run never blocks a
+     * row goes without an end, a hook or a provider call. Its children go
+     * first: in bearer mode its hand-offs and token generations, by their
+     * `sessionId` index, and only then the session row, which is the only link
+     * from a principal to them; a sweep that fails half way leaves the session
+     * row, and the next sweep finds it and deletes the rest. Expiry never moves
+     * later, so a session past the cutoff stays past it, and its row is deleted
+     * only while that still holds. A sweep that cannot run never blocks a
      * sign-in.
      */
     private sweepEndedSessions;