@inco/lightning-js 0.0.0-bootstrap.0

package/dist/esm/kms/quorumClient.js

@@ -0,0 +1,459 @@
+import { keccak256 } from 'viem';
+import { bytesToBigInt, bytesToHex, parseHex, } from '../binary.js';
+import { EListAttestedDecryptError, } from '../elistattesteddecrypt/types.js';
+import { bigintToPlaintext, encryptionSchemes, } from '../encryption/encryption.js';
+import { getEListElementType, getHandleType, handleTypes } from '../handle.js';
+import { decrypt } from '../lite/xwing.js';
+import { retryWithBackoff } from '../retry.js';
+import { getKmsClient } from './client.js';
+import { verifyComputeResponseConsistency, verifyDecryptResponseConsistency, verifyEListResponseConsistency, } from './quorumConsistency.js';
+import { verifyPlaintextAttestationSignatures, verifyReencryptionAttestationSignatures, } from './signatureVerification.js';
+import { executeWithThreshold } from './thresholdPromises.js';
+/**
+ * Checks if the threshold is at least a majority of signers and throws an error if not.
+ * This is important to ensure that the quorum client provides the expected security guarantees.
+ */
+function checkMajorityThreshold(threshold, signerCount) {
+    const majority = Math.floor(signerCount / 2) + 1;
+    if (threshold < majority) {
+        throw new Error(`Threshold (${threshold}) must be at least a majority (${majority}) of ${signerCount} signers to ensure security guarantees.`);
+    }
+}
+export class KmsQuorumClient {
+    kmss;
+    threshold;
+    // Implementation
+    constructor(attestersOrClients, threshold) {
+        if (attestersOrClients.length === 0) {
+            throw new Error('At least one attester or KMS client is required');
+        }
+        if (threshold < 1 || threshold > attestersOrClients.length) {
+            throw new Error(`Threshold must be between 1 and ${attestersOrClients.length}`);
+        }
+        checkMajorityThreshold(threshold, attestersOrClients.length);
+        // Check if first element is a KmsClient (has attestedDecrypt method) or an attester object
+        if (attestersOrClients.length > 0 &&
+            'attestedDecrypt' in attestersOrClients[0]) {
+            // Handle KmsClient[] case
+            const kmsClients = attestersOrClients;
+            this.kmss = kmsClients.map((client) => ({
+                client,
+                signer: client.signerAddress,
+            }));
+        }
+        else {
+            // Handle { url: string; signer: Address }[] case
+            const attesters = attestersOrClients;
+            this.kmss = attesters.map((attester) => {
+                return {
+                    client: getKmsClient(attester.url, attester.signer),
+                    signer: attester.signer,
+                };
+            });
+        }
+        this.threshold = threshold;
+    }
+    /**
+     * Creates a KmsQuorumClient from an array of URLs.
+     * Requires signer addresses and threshold to be explicitly provided.
+     *
+     * @param urls - Array of KMS endpoint URLs
+     * @param signers - Array of signer addresses, must match the length of URLs
+     * @param threshold - Number of successful responses required (must be between 1 and urls.length)
+     * @throws {Error} If URLs array is empty, signers length doesn't match URLs length, or threshold is invalid
+     */
+    static fromUrls(urls, signers, threshold) {
+        if (urls.length === 0) {
+            throw new Error('At least one URL is required');
+        }
+        if (signers.length !== urls.length) {
+            throw new Error(`Signers array length (${signers.length}) must match URLs array length (${urls.length})`);
+        }
+        if (threshold < 1 || threshold > urls.length) {
+            throw new Error(`Threshold must be between 1 and ${urls.length} (number of URLs)`);
+        }
+        const attesters = urls.map((url, index) => {
+            return { url, signer: signers[index] };
+        });
+        return new KmsQuorumClient(attesters, threshold);
+    }
+    /**
+     * Creates a KmsQuorumClient from an array of KmsClient instances.
+     * Each KmsClient must have a signerAddress property.
+     *
+     * @param kmsClients - Array of KMS client instances
+     * @param threshold - Number of successful responses required (must be between 1 and kmsClients.length)
+     * @throws {Error} If KMS clients array is empty or threshold is invalid
+     */
+    static fromKmsClients(kmsClients, threshold) {
+        if (kmsClients.length === 0) {
+            throw new Error('At least one KMS client is required');
+        }
+        if (threshold < 1 || threshold > kmsClients.length) {
+            throw new Error(`Threshold must be between 1 and ${kmsClients.length} (number of KMS clients)`);
+        }
+        return new KmsQuorumClient(kmsClients, threshold);
+    }
+    async attestedDecrypt(request, executorAddress, client, backoffConfig, reencryptKeypair) {
+        const thresholdResults = await this.executeKmsOperationWithThreshold(async (kms) => {
+            return await kms.client.attestedDecrypt(request);
+        }, backoffConfig);
+        // Verify that responses are consistent across quorum (plaintext or ciphertext)
+        const { reference, winningResults } = await verifyDecryptResponseConsistency(thresholdResults, this.threshold, reencryptKeypair);
+        return this.buildAggregatedAttestations(reference, winningResults.map((r) => r.response), winningResults.map((r) => r.signer), executorAddress, client);
+    }
+    async attestedCompute(request, executorAddress, client, backoffConfig, reencryptKeypair) {
+        const thresholdResults = await this.executeKmsOperationWithThreshold(async (kms) => {
+            return await kms.client.attestedCompute(request);
+        }, backoffConfig);
+        // Verify that responses are consistent across quorum
+        const { reference, winningResults } = await verifyComputeResponseConsistency(thresholdResults, this.threshold, request, reencryptKeypair);
+        return this.buildAggregatedComputeAttestation(reference, winningResults.map((r) => r.response), winningResults.map((r) => r.signer), executorAddress, client);
+    }
+    async attestedReveal(request, executorAddress, client, backoffConfig) {
+        const thresholdResults = await this.executeKmsOperationWithThreshold(async (kms) => {
+            return await kms.client.attestedReveal(request);
+        }, backoffConfig);
+        // Verify that responses are consistent across quorum (plaintext only for reveal)
+        const { reference, winningResults } = await verifyDecryptResponseConsistency(thresholdResults, this.threshold);
+        return this.buildAggregatedAttestations(reference, winningResults.map((r) => r.response), winningResults.map((r) => r.signer), executorAddress, client);
+    }
+    async eListAttestedDecrypt(request, executorAddress, client, backoffConfig, reencryptKeypair) {
+        const thresholdResults = await this.executeKmsOperationWithThreshold(async (kms) => {
+            return await kms.client.eListAttestedDecrypt(request);
+        }, backoffConfig);
+        const { reference, winningResults } = await verifyEListResponseConsistency(thresholdResults, this.threshold, reencryptKeypair);
+        const elistHandle = request.elistHandleWithProof?.handle;
+        if (!elistHandle) {
+            throw new EListAttestedDecryptError('Missing elistHandleWithProof.handle in request');
+        }
+        return this.buildAggregatedEListAttestation(elistHandle, reference, winningResults.map((r) => r.response), winningResults.map((r) => r.signer), executorAddress, client, reencryptKeypair);
+    }
+    async eListAttestedReveal(request, executorAddress, client, backoffConfig) {
+        const thresholdResults = await this.executeKmsOperationWithThreshold(async (kms) => {
+            return await kms.client.eListAttestedReveal(request);
+        }, backoffConfig);
+        const { reference, winningResults } = await verifyEListResponseConsistency(thresholdResults, this.threshold);
+        return this.buildAggregatedEListAttestation(request.handle, reference, winningResults.map((r) => r.response), winningResults.map((r) => r.signer), executorAddress, client);
+    }
+    /**
+     * Generic method to execute a KMS operation across all clients with retry and threshold logic.
+     * Returns results with both the response and signer address.
+     */
+    async executeKmsOperationWithThreshold(operation, backoffConfig) {
+        // Create promises for all KMS clients, tracking signer addresses
+        // Each client call is wrapped with retry logic
+        const promises = this.kmss.map(async (kms, index) => {
+            try {
+                const response = await retryWithBackoff(async () => {
+                    return await operation(kms);
+                }, backoffConfig);
+                return { response, signer: kms.signer };
+            }
+            catch (error) {
+                throw new Error(`KMS client ${index} (signer: ${kms.signer}) failed: ${error}`);
+            }
+        });
+        return await executeWithThreshold(promises, this.threshold);
+    }
+    /**
+     * Collects signatures from responses and sorts them by signer address (ascending).
+     * This is required by SignatureVerifier.
+     */
+    collectAndSortSignatures(signatures, signers) {
+        const signaturesWithSigners = signatures.map((signature, idx) => ({
+            signature,
+            signer: signers[idx],
+        }));
+        // Sort by signer address in ascending order (as required by SignatureVerifier)
+        signaturesWithSigners.sort((a, b) => {
+            const aBigInt = BigInt(a.signer);
+            const bBigInt = BigInt(b.signer);
+            if (aBigInt < bBigInt)
+                return -1;
+            if (aBigInt > bBigInt)
+                return 1;
+            return 0;
+        });
+        // Extract sorted signatures
+        return signaturesWithSigners.map((item) => item.signature);
+    }
+    /**
+     * Builds a plaintext attestation from a DecryptionAttestation proto message.
+     */
+    buildPlaintextAttestation(decryptionAttestation, covalidatorSignatures) {
+        if (!decryptionAttestation.value ||
+            decryptionAttestation.value.case !== 'plaintext') {
+            throw new Error('Expected plaintext attestation');
+        }
+        const plaintextBytes = decryptionAttestation.value.value.value;
+        const handle = decryptionAttestation.handle;
+        const handleType = getHandleType(handle);
+        const bigIntValue = bytesToBigInt(plaintextBytes);
+        const plaintext = bigintToPlaintext(encryptionSchemes.xwing, handleType, bigIntValue);
+        return {
+            handle,
+            plaintext,
+            covalidatorSignatures,
+        };
+    }
+    async buildAggregatedAttestations(reference, thresholdResponses, signers, executorAddress, client) {
+        const attestationCount = reference.decryptionAttestations.length;
+        const results = [];
+        for (let i = 0; i < attestationCount; i++) {
+            const refAtt = reference.decryptionAttestations[i];
+            if (!refAtt.value) {
+                throw new Error('No value in attestation');
+            }
+            // Collect signatures and sort by signer address
+            const signatures = thresholdResponses.map((resp) => resp.decryptionAttestations[i].signature);
+            const covalidatorSignatures = this.collectAndSortSignatures(signatures, signers);
+            if (refAtt.value.case === 'plaintext') {
+                // Verify covalidator signatures over the plaintext attestation
+                // executorAddress and client are only undefined when using a non-real client (e.g. in tests)
+                if (executorAddress && client) {
+                    await verifyPlaintextAttestationSignatures(refAtt.handle, refAtt.value.value.value, covalidatorSignatures, executorAddress, client);
+                }
+                results.push(this.buildPlaintextAttestation(refAtt, covalidatorSignatures));
+            }
+            else if (refAtt.value.case === 'reencryption') {
+                // Collect per-covalidator encrypted signatures and ciphertexts
+                const encryptedSignatures = [];
+                const perCovalidatorCiphertexts = [];
+                for (const resp of thresholdResponses) {
+                    const attValue = resp.decryptionAttestations[i].value;
+                    if (attValue?.case === 'reencryption') {
+                        encryptedSignatures.push(attValue.value.encryptedSignature);
+                        perCovalidatorCiphertexts.push(attValue.value.userCiphertext);
+                    }
+                    else {
+                        throw new Error(`Expected reencryption attestation but received '${attValue?.case}'`);
+                    }
+                }
+                const encryptedCovalidatorSignatures = this.collectAndSortSignatures(encryptedSignatures, signers);
+                const sortedCiphertexts = this.collectAndSortSignatures(perCovalidatorCiphertexts, signers);
+                // executorAddress and client are only undefined when using a non-real client (e.g. in tests)
+                if (executorAddress && client) {
+                    await verifyReencryptionAttestationSignatures(refAtt.handle, sortedCiphertexts, encryptedCovalidatorSignatures, covalidatorSignatures, executorAddress, client);
+                }
+                const reencryption = refAtt.value.value;
+                const ct = reencryption.userCiphertext;
+                const handleType = getHandleType(parseHex(refAtt.handle));
+                results.push({
+                    handle: refAtt.handle,
+                    encryptedPlaintext: {
+                        ciphertext: {
+                            value: bytesToHex(ct),
+                            scheme: encryptionSchemes.xwing, // EncryptionScheme: XWING
+                            type: handleType,
+                        },
+                    },
+                    encryptedSignatures: encryptedCovalidatorSignatures,
+                    covalidatorSignatures,
+                });
+            }
+            else {
+                throw new Error(`Unexpected attestation type: ${refAtt.value.case}, expected 'plaintext' or 'reencryption'`);
+            }
+        }
+        return results;
+    }
+    async buildAggregatedComputeAttestation(reference, thresholdResponses, signers, executorAddress, client) {
+        const refAtt = reference.decryptionAttestation;
+        if (!refAtt) {
+            throw new Error('No decryption attestation in reference response');
+        }
+        if (!refAtt.value) {
+            throw new Error('No value in reference attestation');
+        }
+        // Collect signatures and sort by signer address
+        // All responses are guaranteed to have decryption attestations by verifyComputeResponseConsistency
+        const signatures = [];
+        for (const resp of thresholdResponses) {
+            const att = resp.decryptionAttestation;
+            if (!att)
+                throw new Error('Missing decryption attestation in winning response');
+            signatures.push(att.signature);
+        }
+        const covalidatorSignatures = this.collectAndSortSignatures(signatures, signers);
+        if (refAtt.value.case === 'plaintext') {
+            // Verify covalidator signatures over the plaintext attestation
+            // executorAddress and client are only undefined when using a non-real client (e.g. in tests)
+            if (executorAddress && client) {
+                await verifyPlaintextAttestationSignatures(refAtt.handle, refAtt.value.value.value, covalidatorSignatures, executorAddress, client);
+            }
+            return this.buildPlaintextAttestation(refAtt, covalidatorSignatures);
+        }
+        if (refAtt.value.case === 'reencryption') {
+            // Reencryption envelope signatures are verified per-covalidator via
+            // isValidReencryptionAttestation on-chain (each has a unique digest).
+            const reencryption = refAtt.value.value;
+            const ct = reencryption.userCiphertext;
+            if (!ct) {
+                throw new Error('No ciphertext in reencryption');
+            }
+            const handleType = getHandleType(parseHex(refAtt.handle));
+            // Collect per-covalidator encrypted signatures and ciphertexts
+            const encryptedSignatures = [];
+            const perCovalidatorCiphertexts = [];
+            for (const resp of thresholdResponses) {
+                if (resp.decryptionAttestation?.value.case === 'reencryption') {
+                    const reenc = resp.decryptionAttestation.value.value;
+                    encryptedSignatures.push(reenc.encryptedSignature);
+                    perCovalidatorCiphertexts.push(reenc.userCiphertext);
+                }
+                else {
+                    throw new Error(`Expected reencryption attestation but received '${resp.decryptionAttestation?.value.case}'`);
+                }
+            }
+            const encryptedCovalidatorSignatures = this.collectAndSortSignatures(encryptedSignatures, signers);
+            const sortedCiphertexts = this.collectAndSortSignatures(perCovalidatorCiphertexts, signers);
+            // executorAddress and client are only undefined when using a non-real client (e.g. in tests)
+            if (executorAddress && client) {
+                await verifyReencryptionAttestationSignatures(refAtt.handle, sortedCiphertexts, encryptedCovalidatorSignatures, covalidatorSignatures, executorAddress, client);
+            }
+            return {
+                handle: refAtt.handle,
+                encryptedPlaintext: {
+                    ciphertext: {
+                        value: bytesToHex(ct),
+                        scheme: encryptionSchemes.xwing, // EncryptionScheme: XWING
+                        type: handleType,
+                    },
+                },
+                encryptedSignatures: encryptedCovalidatorSignatures,
+                covalidatorSignatures,
+            };
+        }
+        throw new Error(`Unexpected attestation type: ${refAtt.value.case}, expected 'plaintext' or 'reencryption'`);
+    }
+    async buildAggregatedEListAttestation(elistHandle, reference, thresholdResponses, signers, executorAddress, client, reencryptKeypair) {
+        const refProofAtt = reference.commitmentProofAttestation;
+        if (!refProofAtt) {
+            throw new Error('No commitmentProofAttestation in reference response');
+        }
+        if (!refProofAtt.value) {
+            throw new Error('No value in commitmentProofAttestation');
+        }
+        // Collect and sort commitment proof signatures
+        const proofSignatures = thresholdResponses.map((resp) => resp.commitmentProofAttestation.signature);
+        const covalidatorSignatures = this.collectAndSortSignatures(proofSignatures, signers);
+        // Build commitment proof from the attestation
+        // The commitment proof is always a keccak256 hash (uint256), regardless of the elist handle type.
+        let commitmentProof;
+        if (refProofAtt.value.case === 'plaintext') {
+            const proofBytes = refProofAtt.value.value.value;
+            const proofHandle = refProofAtt.handle;
+            // Verify commitment proof signatures
+            if (executorAddress && client) {
+                await verifyPlaintextAttestationSignatures(proofHandle, proofBytes, covalidatorSignatures, executorAddress, client);
+            }
+            commitmentProof = bigintToPlaintext(encryptionSchemes.xwing, handleTypes.euint256, bytesToBigInt(proofBytes));
+        }
+        else {
+            throw new Error(`Unexpected commitmentProofAttestation type: ${refProofAtt.value.case}`);
+        }
+        // Verify proof hashes: per-element and aggregate
+        await this.verifyElementProofHashes(reference, refProofAtt.value.value.value, reencryptKeypair);
+        // Build values and commitments from EListElements
+        const elementType = getEListElementType(elistHandle);
+        const commitments = [];
+        const isReencryption = reference.values.length > 0 &&
+            reference.values[0].value.case === 'reencryption';
+        if (isReencryption) {
+            const values = [];
+            for (const elem of reference.values) {
+                commitments.push(elem.commitment);
+                if (elem.value.case !== 'reencryption') {
+                    throw new Error(`Expected reencryption elist element but got '${elem.value.case}'`);
+                }
+                const ct = elem.value.value.userCiphertext;
+                values.push({
+                    ciphertext: {
+                        value: bytesToHex(ct),
+                        scheme: encryptionSchemes.xwing,
+                        type: elementType,
+                    },
+                });
+            }
+            return {
+                handle: elistHandle,
+                commitmentProof,
+                values,
+                covalidatorSignatures,
+                commitments,
+            };
+        }
+        else {
+            const values = [];
+            for (const elem of reference.values) {
+                commitments.push(elem.commitment);
+                if (elem.value.case !== 'plaintext') {
+                    throw new Error(`Expected plaintext elist element but got '${elem.value.case}'`);
+                }
+                const plaintextBytes = elem.value.value.value;
+                values.push(bigintToPlaintext(encryptionSchemes.xwing, elementType, bytesToBigInt(plaintextBytes)));
+            }
+            return {
+                handle: elistHandle,
+                commitmentProof,
+                values,
+                covalidatorSignatures,
+                commitments,
+            };
+        }
+    }
+    /**
+     * Verifies proof hashes at two levels:
+     * 1. Aggregate: keccak256(concat(proofHashes)) must equal the attested commitmentProof
+     * 2. Per-element:
+     *    - For plaintext (reveal): proofHash[i] = keccak256(value[i])
+     *    - For reencryption (decrypt): proofHash[i] = keccak256(commitment[i] || plaintext[i])
+     *      — requires reencryptKeypair to decrypt the ciphertext first.
+     */
+    async verifyElementProofHashes(reference, commitmentProofBytes, reencryptKeypair) {
+        // Aggregate check: keccak256(concat(proofHashes)) must match the attested commitment proof
+        const proofHashesConcat = new Uint8Array(reference.proofHashes.reduce((acc, h) => acc + h.length, 0));
+        let offset = 0;
+        for (const h of reference.proofHashes) {
+            proofHashesConcat.set(h, offset);
+            offset += h.length;
+        }
+        const computedProof = keccak256(bytesToHex(proofHashesConcat));
+        const attestedProof = bytesToHex(commitmentProofBytes);
+        if (computedProof !== attestedProof) {
+            throw new EListAttestedDecryptError(`Commitment proof verification failed: computed ${computedProof} but attested value is ${attestedProof}`);
+        }
+        // Per-element check
+        if (reference.proofHashes.length !== reference.values.length) {
+            throw new EListAttestedDecryptError(`proofHashes length (${reference.proofHashes.length}) does not match values length (${reference.values.length})`);
+        }
+        for (let i = 0; i < reference.values.length; i++) {
+            const elem = reference.values[i];
+            let preimage;
+            if (elem.value.case === 'reencryption') {
+                if (!reencryptKeypair) {
+                    // Can't verify without keypair; aggregate check + signatures still hold
+                    continue;
+                }
+                const plaintext = await decrypt(reencryptKeypair, elem.value.value.userCiphertext);
+                const combined = new Uint8Array(elem.commitment.length + plaintext.length);
+                combined.set(elem.commitment, 0);
+                combined.set(plaintext, elem.commitment.length);
+                preimage = combined;
+            }
+            else if (elem.value.case === 'plaintext') {
+                preimage = elem.value.value.value;
+            }
+            else {
+                throw new EListAttestedDecryptError(`Unexpected elist element type at index ${i}: ${elem.value.case}`);
+            }
+            const computedHash = keccak256(bytesToHex(preimage));
+            const expectedHash = bytesToHex(reference.proofHashes[i]);
+            if (computedHash !== expectedHash) {
+                throw new EListAttestedDecryptError(`Element proof hash mismatch at index ${i}: computed ${computedHash} but expected ${expectedHash}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicXVvcnVtQ2xpZW50LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vc3JjL2ttcy9xdW9ydW1DbGllbnQudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxFQUFFLFNBQVMsRUFBZ0IsTUFBTSxNQUFNLENBQUM7QUFLL0MsT0FBTyxFQUNMLGFBQWEsRUFDYixVQUFVLEVBQ1YsUUFBUSxHQUVULE1BQU0sY0FBYyxDQUFDO0FBQ3RCLE9BQU8sRUFDTCx5QkFBeUIsR0FHMUIsTUFBTSxrQ0FBa0MsQ0FBQztBQU0xQyxPQUFPLEVBQ0wsaUJBQWlCLEVBQ2pCLGlCQUFpQixHQUNsQixNQUFNLDZCQUE2QixDQUFDO0FBY3JDLE9BQU8sRUFBRSxtQkFBbUIsRUFBRSxhQUFhLEVBQUUsV0FBVyxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQy9FLE9BQU8sRUFBRSxPQUFPLEVBQXFCLE1BQU0sa0JBQWtCLENBQUM7QUFFOUQsT0FBTyxFQUFFLGdCQUFnQixFQUFFLE1BQU0sYUFBYSxDQUFDO0FBQy9DLE9BQU8sRUFBRSxZQUFZLEVBQWtCLE1BQU0sYUFBYSxDQUFDO0FBQzNELE9BQU8sRUFDTCxnQ0FBZ0MsRUFDaEMsZ0NBQWdDLEVBQ2hDLDhCQUE4QixHQUMvQixNQUFNLHdCQUF3QixDQUFDO0FBR2hDLE9BQU8sRUFDTCxvQ0FBb0MsRUFDcEMsdUNBQXVDLEdBQ3hDLE1BQU0sNEJBQTRCLENBQUM7QUFDcEMsT0FBTyxFQUFFLG9CQUFvQixFQUFFLE1BQU0sd0JBQXdCLENBQUM7QUFPOUQ7OztHQUdHO0FBQ0gsU0FBUyxzQkFBc0IsQ0FBQyxTQUFpQixFQUFFLFdBQW1CO0lBQ3BFLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNqRCxJQUFJLFNBQVMsR0FBRyxRQUFRLEVBQUUsQ0FBQztRQUN6QixNQUFNLElBQUksS0FBSyxDQUNiLGNBQWMsU0FBUyxrQ0FBa0MsUUFBUSxRQUFRLFdBQVcseUNBQXlDLENBQzlILENBQUM7SUFDSixDQUFDO0FBQ0gsQ0FBQztBQUVELE1BQU0sT0FBTyxlQUFlO0lBQ1QsSUFBSSxDQUFRO0lBQ1osU0FBUyxDQUFTO0lBUW5DLGlCQUFpQjtJQUNqQixZQUNFLGtCQUFvRSxFQUNwRSxTQUFpQjtRQUVqQixJQUFJLGtCQUFrQixDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNwQyxNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksU0FBUyxHQUFHLENBQUMsSUFBSSxTQUFTLEdBQUcsa0JBQWtCLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDM0QsTUFBTSxJQUFJLEtBQUssQ0FDYixtQ0FBbUMsa0JBQWtCLENBQUMsTUFBTSxFQUFFLENBQy9ELENBQUM7UUFDSixDQUFDO1FBRUQsc0JBQXNCLENBQUMsU0FBUyxFQUFFLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRTdELDJGQUEyRjtRQUMzRixJQUNFLGtCQUFrQixDQUFDLE1BQU0sR0FBRyxDQUFDO1lBQzdCLGlCQUFpQixJQUFJLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxFQUMxQyxDQUFDO1lBQ0QsMEJBQTBCO1lBQzFCLE1BQU0sVUFBVSxHQUFHLGtCQUFpQyxDQUFDO1lBQ3JELElBQUksQ0FBQyxJQUFJLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQztnQkFDdEMsTUFBTTtnQkFDTixNQUFNLEVBQUUsTUFBTSxDQUFDLGFBQWE7YUFDN0IsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO2FBQU0sQ0FBQztZQUNOLGlEQUFpRDtZQUNqRCxNQUFNLFNBQVMsR0FBRyxrQkFHZixDQUFDO1lBQ0osSUFBSSxDQUFDLElBQUksR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUU7Z0JBQ3JDLE9BQU87b0JBQ0wsTUFBTSxFQUFFLFlBQVksQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxNQUFNLENBQUM7b0JBQ25ELE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtpQkFDeEIsQ0FBQztZQUNKLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO0lBQzdCLENBQUM7SUFFRDs7Ozs7Ozs7T0FRRztJQUNILE1BQU0sQ0FBQyxRQUFRLENBQ2IsSUFBYyxFQUNkLE9BQWtCLEVBQ2xCLFNBQWlCO1FBRWpCLElBQUksSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN0QixNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDbkMsTUFBTSxJQUFJLEtBQUssQ0FDYix5QkFBeUIsT0FBTyxDQUFDLE1BQU0sbUNBQW1DLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FDekYsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLFNBQVMsR0FBRyxDQUFDLElBQUksU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM3QyxNQUFNLElBQUksS0FBSyxDQUNiLG1DQUFtQyxJQUFJLENBQUMsTUFBTSxtQkFBbUIsQ0FDbEUsQ0FBQztRQUNKLENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQ3hDLE9BQU8sRUFBRSxHQUFHLEVBQUUsTUFBTSxFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3pDLENBQUMsQ0FBQyxDQUFDO1FBRUgsT0FBTyxJQUFJLGVBQWUsQ0FBQyxTQUFTLEVBQUUsU0FBUyxDQUFDLENBQUM7SUFDbkQsQ0FBQztJQUVEOzs7Ozs7O09BT0c7SUFDSCxNQUFNLENBQUMsY0FBYyxDQUNuQixVQUF1QixFQUN2QixTQUFpQjtRQUVqQixJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDNUIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFFRCxJQUFJLFNBQVMsR0FBRyxDQUFDLElBQUksU0FBUyxHQUFHLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuRCxNQUFNLElBQUksS0FBSyxDQUNiLG1DQUFtQyxVQUFVLENBQUMsTUFBTSwwQkFBMEIsQ0FDL0UsQ0FBQztRQUNKLENBQUM7UUFFRCxPQUFPLElBQUksZUFBZSxDQUFDLFVBQVUsRUFBRSxTQUFTLENBQUMsQ0FBQztJQUNwRCxDQUFDO0lBRUQsS0FBSyxDQUFDLGVBQWUsQ0FDbkIsT0FBK0IsRUFDL0IsZUFBd0IsRUFDeEIsTUFBa0IsRUFDbEIsYUFBc0MsRUFDdEMsZ0JBQStCO1FBTy9CLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0NBQWdDLENBQ2xFLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRTtZQUNaLE9BQU8sTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuRCxDQUFDLEVBQ0QsYUFBYSxDQUNkLENBQUM7UUFFRiwrRUFBK0U7UUFDL0UsTUFBTSxFQUFFLFNBQVMsRUFBRSxjQUFjLEVBQUUsR0FDakMsTUFBTSxnQ0FBZ0MsQ0FDcEMsZ0JBR0UsRUFDRixJQUFJLENBQUMsU0FBUyxFQUNkLGdCQUFnQixDQUNqQixDQUFDO1FBRUosT0FBTyxJQUFJLENBQUMsMkJBQTJCLENBQ3JDLFNBQVMsRUFDVCxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3JDLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFDbkMsZUFBZSxFQUNmLE1BQU0sQ0FDUCxDQUFDO0lBQ0osQ0FBQztJQUVELEtBQUssQ0FBQyxlQUFlLENBQ25CLE9BQStCLEVBQy9CLGVBQXdCLEVBQ3hCLE1BQWtCLEVBQ2xCLGFBQXNDLEVBQ3RDLGdCQUErQjtRQUsvQixNQUFNLGdCQUFnQixHQUFHLE1BQU0sSUFBSSxDQUFDLGdDQUFnQyxDQUNsRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEVBQUU7WUFDWixPQUFPLE1BQU0sR0FBRyxDQUFDLE1BQU0sQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbkQsQ0FBQyxFQUNELGFBQWEsQ0FDZCxDQUFDO1FBRUYscURBQXFEO1FBQ3JELE1BQU0sRUFBRSxTQUFTLEVBQUUsY0FBYyxFQUFFLEdBQ2pDLE1BQU0sZ0NBQWdDLENBQ3BDLGdCQUdFLEVBQ0YsSUFBSSxDQUFDLFNBQVMsRUFDZCxPQUFPLEVBQ1AsZ0JBQWdCLENBQ2pCLENBQUM7UUFFSixPQUFPLElBQUksQ0FBQyxpQ0FBaUMsQ0FDM0MsU0FBUyxFQUNULGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsRUFDckMsY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxFQUNuQyxlQUFlLEVBQ2YsTUFBTSxDQUNQLENBQUM7SUFDSixDQUFDO0lBRUQsS0FBSyxDQUFDLGNBQWMsQ0FDbEIsT0FBOEIsRUFDOUIsZUFBd0IsRUFDeEIsTUFBa0IsRUFDbEIsYUFBc0M7UUFPdEMsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLElBQUksQ0FBQyxnQ0FBZ0MsQ0FDbEUsS0FBSyxFQUFFLEdBQUcsRUFBRSxFQUFFO1lBQ1osT0FBTyxNQUFNLEdBQUcsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ2xELENBQUMsRUFDRCxhQUFhLENBQ2QsQ0FBQztRQUVGLGlGQUFpRjtRQUNqRixNQUFNLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxHQUNqQyxNQUFNLGdDQUFnQyxDQUNwQyxnQkFHRSxFQUNGLElBQUksQ0FBQyxTQUFTLENBQ2YsQ0FBQztRQUVKLE9BQU8sSUFBSSxDQUFDLDJCQUEyQixDQUNyQyxTQUFTLEVBQ1QsY0FBYyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxFQUNyQyxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEVBQ25DLGVBQWUsRUFDZixNQUFNLENBQ1AsQ0FBQztJQUNKLENBQUM7SUFFRCxLQUFLLENBQUMsb0JBQW9CLENBQ3hCLE9BQW9DLEVBQ3BDLGVBQXdCLEVBQ3hCLE1BQWtCLEVBQ2xCLGFBQXNDLEVBQ3RDLGdCQUErQjtRQUsvQixNQUFNLGdCQUFnQixHQUFHLE1BQU0sSUFBSSxDQUFDLGdDQUFnQyxDQUNsRSxLQUFLLEVBQUUsR0FBRyxFQUFFLEVBQUU7WUFDWixPQUFPLE1BQU0sR0FBRyxDQUFDLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4RCxDQUFDLEVBQ0QsYUFBYSxDQUNkLENBQUM7UUFFRixNQUFNLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxHQUFHLE1BQU0sOEJBQThCLENBQ3hFLGdCQUdFLEVBQ0YsSUFBSSxDQUFDLFNBQVMsRUFDZCxnQkFBZ0IsQ0FDakIsQ0FBQztRQUVGLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQyxvQkFBb0IsRUFBRSxNQUFNLENBQUM7UUFDekQsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sSUFBSSx5QkFBeUIsQ0FDakMsZ0RBQWdELENBQ2pELENBQUM7UUFDSixDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUMsK0JBQStCLENBQ3pDLFdBQXdCLEVBQ3hCLFNBQVMsRUFDVCxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3JDLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFDbkMsZUFBZSxFQUNmLE1BQU0sRUFDTixnQkFBZ0IsQ0FDakIsQ0FBQztJQUNKLENBQUM7SUFFRCxLQUFLLENBQUMsbUJBQW1CLENBQ3ZCLE9BQW1DLEVBQ25DLGVBQXdCLEVBQ3hCLE1BQWtCLEVBQ2xCLGFBQXNDO1FBRXRDLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0NBQWdDLENBQ2xFLEtBQUssRUFBRSxHQUFHLEVBQUUsRUFBRTtZQUNaLE9BQU8sTUFBTSxHQUFHLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3ZELENBQUMsRUFDRCxhQUFhLENBQ2QsQ0FBQztRQUVGLE1BQU0sRUFBRSxTQUFTLEVBQUUsY0FBYyxFQUFFLEdBQUcsTUFBTSw4QkFBOEIsQ0FDeEUsZ0JBR0UsRUFDRixJQUFJLENBQUMsU0FBUyxDQUNmLENBQUM7UUFFRixPQUFPLElBQUksQ0FBQywrQkFBK0IsQ0FDekMsT0FBTyxDQUFDLE1BQW1CLEVBQzNCLFNBQVMsRUFDVCxjQUFjLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLEVBQ3JDLGNBQWMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsRUFDbkMsZUFBZSxFQUNmLE1BQU0sQ0FHUCxDQUFDO0lBQ0osQ0FBQztJQUVEOzs7T0FHRztJQUNLLEtBQUssQ0FBQyxnQ0FBZ0MsQ0FDNUMsU0FBMkMsRUFDM0MsYUFBc0M7UUFFdEMsaUVBQWlFO1FBQ2pFLCtDQUErQztRQUMvQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsR0FBRyxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQ2xELElBQUksQ0FBQztnQkFDSCxNQUFNLFFBQVEsR0FBRyxNQUFNLGdCQUFnQixDQUFDLEtBQUssSUFBSSxFQUFFO29CQUNqRCxPQUFPLE1BQU0sU0FBUyxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUM5QixDQUFDLEVBQUUsYUFBYSxDQUFDLENBQUM7Z0JBQ2xCLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMxQyxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixNQUFNLElBQUksS0FBSyxDQUNiLGNBQWMsS0FBSyxhQUFhLEdBQUcsQ0FBQyxNQUFNLGFBQWEsS0FBSyxFQUFFLENBQy9ELENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7UUFFSCxPQUFPLE1BQU0sb0JBQW9CLENBRzlCLFFBQVEsRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUM7SUFDL0IsQ0FBQztJQUVEOzs7T0FHRztJQUNLLHdCQUF3QixDQUM5QixVQUF3QixFQUN4QixPQUFrQjtRQUVsQixNQUFNLHFCQUFxQixHQUFHLFVBQVUsQ0FBQyxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEVBQUUsQ0FBQyxDQUFDO1lBQ2hFLFNBQVM7WUFDVCxNQUFNLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQztTQUNyQixDQUFDLENBQUMsQ0FBQztRQUVKLCtFQUErRTtRQUMvRSxxQkFBcUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUU7WUFDbEMsTUFBTSxPQUFPLEdBQUcsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUNqQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ2pDLElBQUksT0FBTyxHQUFHLE9BQU87Z0JBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztZQUNqQyxJQUFJLE9BQU8sR0FBRyxPQUFPO2dCQUFFLE9BQU8sQ0FBQyxDQUFDO1lBQ2hDLE9BQU8sQ0FBQyxDQUFDO1FBQ1gsQ0FBQyxDQUFDLENBQUM7UUFFSCw0QkFBNEI7UUFDNUIsT0FBTyxxQkFBcUIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBRUQ7O09BRUc7SUFDSyx5QkFBeUIsQ0FDL0IscUJBQWlELEVBQ2pELHFCQUFtQztRQUVuQyxJQUNFLENBQUMscUJBQXFCLENBQUMsS0FBSztZQUM1QixxQkFBcUIsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsRUFDaEQsQ0FBQztZQUNELE1BQU0sSUFBSSxLQUFLLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcscUJBQXFCLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7UUFDL0QsTUFBTSxNQUFNLEdBQUcscUJBQXFCLENBQUMsTUFBbUIsQ0FBQztRQUN6RCxNQUFNLFVBQVUsR0FBRyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDekMsTUFBTSxXQUFXLEdBQUcsYUFBYSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sU0FBUyxHQUFHLGlCQUFpQixDQUNqQyxpQkFBaUIsQ0FBQyxLQUFLLEVBQ3ZCLFVBQThCLEVBQzlCLFdBQVcsQ0FDWixDQUFDO1FBRUYsT0FBTztZQUNMLE1BQU07WUFDTixTQUFTO1lBQ1QscUJBQXFCO1NBQ3VDLENBQUM7SUFDakUsQ0FBQztJQUVPLEtBQUssQ0FBQywyQkFBMkIsQ0FDdkMsU0FBMkQsRUFDM0Qsa0JBQXdFLEVBQ3hFLE9BQWtCLEVBQ2xCLGVBQXdCLEVBQ3hCLE1BQWtCO1FBT2xCLE1BQU0sZ0JBQWdCLEdBQUcsU0FBUyxDQUFDLHNCQUFzQixDQUFDLE1BQU0sQ0FBQztRQUNqRSxNQUFNLE9BQU8sR0FHUCxFQUFFLENBQUM7UUFFVCxLQUFLLElBQUksQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLEdBQUcsZ0JBQWdCLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQztZQUMxQyxNQUFNLE1BQU0sR0FBRyxTQUFTLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDbkQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztnQkFDbEIsTUFBTSxJQUFJLEtBQUssQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQzdDLENBQUM7WUFFRCxnREFBZ0Q7WUFDaEQsTUFBTSxVQUFVLEdBQUcsa0JBQWtCLENBQUMsR0FBRyxDQUN2QyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLHNCQUFzQixDQUFDLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FDbkQsQ0FBQztZQUNGLE1BQU0scUJBQXFCLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixDQUN6RCxVQUFVLEVBQ1YsT0FBTyxDQUNSLENBQUM7WUFFRixJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsRUFBRSxDQUFDO2dCQUN0QywrREFBK0Q7Z0JBQy9ELDZGQUE2RjtnQkFDN0YsSUFBSSxlQUFlLElBQUksTUFBTSxFQUFFLENBQUM7b0JBQzlCLE1BQU0sb0NBQW9DLENBQ3hDLE1BQU0sQ0FBQyxNQUFNLEVBQ2IsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUN4QixxQkFBcUIsRUFDckIsZUFBZSxFQUNmLE1BQU0sQ0FDUCxDQUFDO2dCQUNKLENBQUM7Z0JBQ0QsT0FBTyxDQUFDLElBQUksQ0FDVixJQUFJLENBQUMseUJBQXlCLENBQUMsTUFBTSxFQUFFLHFCQUFxQixDQUFDLENBQzlELENBQUM7WUFDSixDQUFDO2lCQUFNLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssY0FBYyxFQUFFLENBQUM7Z0JBQ2hELCtEQUErRDtnQkFDL0QsTUFBTSxtQkFBbUIsR0FBaUIsRUFBRSxDQUFDO2dCQUM3QyxNQUFNLHlCQUF5QixHQUFpQixFQUFFLENBQUM7Z0JBQ25ELEtBQUssTUFBTSxJQUFJLElBQUksa0JBQWtCLEVBQUUsQ0FBQztvQkFDdEMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLHNCQUFzQixDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQztvQkFDdEQsSUFBSSxRQUFRLEVBQUUsSUFBSSxLQUFLLGNBQWMsRUFBRSxDQUFDO3dCQUN0QyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO3dCQUM1RCx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsQ0FBQztvQkFDaEUsQ0FBQzt5QkFBTSxDQUFDO3dCQUNOLE1BQU0sSUFBSSxLQUFLLENBQ2IsbURBQW1ELFFBQVEsRUFBRSxJQUFJLEdBQUcsQ0FDckUsQ0FBQztvQkFDSixDQUFDO2dCQUNILENBQUM7Z0JBRUQsTUFBTSw4QkFBOEIsR0FBRyxJQUFJLENBQUMsd0JBQXdCLENBQ2xFLG1CQUFtQixFQUNuQixPQUFPLENBQ1IsQ0FBQztnQkFFRixNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FDckQseUJBQXlCLEVBQ3pCLE9BQU8sQ0FDUixDQUFDO2dCQUVGLDZGQUE2RjtnQkFDN0YsSUFBSSxlQUFlLElBQUksTUFBTSxFQUFFLENBQUM7b0JBQzlCLE1BQU0sdUNBQXVDLENBQzNDLE1BQU0sQ0FBQyxNQUFNLEVBQ2IsaUJBQWlCLEVBQ2pCLDhCQUE4QixFQUM5QixxQkFBcUIsRUFDckIsZUFBZSxFQUNmLE1BQU0sQ0FDUCxDQUFDO2dCQUNKLENBQUM7Z0JBRUQsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7Z0JBQ3hDLE1BQU0sRUFBRSxHQUFHLFlBQVksQ0FBQyxjQUFjLENBQUM7Z0JBQ3ZDLE1BQU0sVUFBVSxHQUFHLGFBQWEsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7Z0JBQzFELE9BQU8sQ0FBQyxJQUFJLENBQUM7b0JBQ1gsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFtQjtvQkFDbEMsa0JBQWtCLEVBQUU7d0JBQ2xCLFVBQVUsRUFBRTs0QkFDVixLQUFLLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FBQzs0QkFDckIsTUFBTSxFQUFFLGlCQUFpQixDQUFDLEtBQUssRUFBRSwwQkFBMEI7NEJBQzNELElBQUksRUFBRSxVQUE4Qjt5QkFDckM7cUJBQ3FEO29CQUN4RCxtQkFBbUIsRUFBRSw4QkFBOEI7b0JBQ25ELHFCQUFxQjtpQkFJdEIsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLE1BQU0sSUFBSSxLQUFLLENBQ2IsZ0NBQWdDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSwwQ0FBMEMsQ0FDNUYsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVPLEtBQUssQ0FBQyxpQ0FBaUMsQ0FDN0MsU0FBa0MsRUFDbEMsa0JBQTZDLEVBQzdDLE9BQWtCLEVBQ2xCLGVBQXdCLEVBQ3hCLE1BQWtCO1FBS2xCLE1BQU0sTUFBTSxHQUFHLFNBQVMsQ0FBQyxxQkFBcUIsQ0FBQztRQUMvQyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDWixNQUFNLElBQUksS0FBSyxDQUFDLGlEQUFpRCxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDbEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ3ZELENBQUM7UUFFRCxnREFBZ0Q7UUFDaEQsbUdBQW1HO1FBQ25HLE1BQU0sVUFBVSxHQUFpQixFQUFFLENBQUM7UUFDcEMsS0FBSyxNQUFNLElBQUksSUFBSSxrQkFBa0IsRUFBRSxDQUFDO1lBQ3RDLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxxQkFBcUIsQ0FBQztZQUN2QyxJQUFJLENBQUMsR0FBRztnQkFDTixNQUFNLElBQUksS0FBSyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7WUFDeEUsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUNELE1BQU0scUJBQXFCLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixDQUN6RCxVQUFVLEVBQ1YsT0FBTyxDQUNSLENBQUM7UUFFRixJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLFdBQVcsRUFBRSxDQUFDO1lBQ3RDLCtEQUErRDtZQUMvRCw2RkFBNkY7WUFDN0YsSUFBSSxlQUFlLElBQUksTUFBTSxFQUFFLENBQUM7Z0JBQzlCLE1BQU0sb0NBQW9DLENBQ3hDLE1BQU0sQ0FBQyxNQUFNLEVBQ2IsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUN4QixxQkFBcUIsRUFDckIsZUFBZSxFQUNmLE1BQU0sQ0FDUCxDQUFDO1lBQ0osQ0FBQztZQUNELE9BQU8sSUFBSSxDQUFDLHlCQUF5QixDQUFDLE1BQU0sRUFBRSxxQkFBcUIsQ0FBQyxDQUFDO1FBQ3ZFLENBQUM7UUFFRCxJQUFJLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLGNBQWMsRUFBRSxDQUFDO1lBQ3pDLG9FQUFvRTtZQUNwRSxzRUFBc0U7WUFFdEUsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDeEMsTUFBTSxFQUFFLEdBQUcsWUFBWSxDQUFDLGNBQWMsQ0FBQztZQUN2QyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7Z0JBQ1IsTUFBTSxJQUFJLEtBQUssQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1lBQ25ELENBQUM7WUFFRCxNQUFNLFVBQVUsR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO1lBRTFELCtEQUErRDtZQUMvRCxNQUFNLG1CQUFtQixHQUFpQixFQUFFLENBQUM7WUFDN0MsTUFBTSx5QkFBeUIsR0FBaUIsRUFBRSxDQUFDO1lBQ25ELEtBQUssTUFBTSxJQUFJLElBQUksa0JBQWtCLEVBQUUsQ0FBQztnQkFDdEMsSUFBSSxJQUFJLENBQUMscUJBQXFCLEVBQUUsS0FBSyxDQUFDLElBQUksS0FBSyxjQUFjLEVBQUUsQ0FBQztvQkFDOUQsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7b0JBQ3JELG1CQUFtQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQztvQkFDbkQseUJBQXlCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsQ0FBQztnQkFDdkQsQ0FBQztxQkFBTSxDQUFDO29CQUNOLE1BQU0sSUFBSSxLQUFLLENBQ2IsbURBQW1ELElBQUksQ0FBQyxxQkFBcUIsRUFBRSxLQUFLLENBQUMsSUFBSSxHQUFHLENBQzdGLENBQUM7Z0JBQ0osQ0FBQztZQUNILENBQUM7WUFFRCxNQUFNLDhCQUE4QixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FDbEUsbUJBQW1CLEVBQ25CLE9BQU8sQ0FDUixDQUFDO1lBRUYsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLENBQUMsd0JBQXdCLENBQ3JELHlCQUF5QixFQUN6QixPQUFPLENBQ1IsQ0FBQztZQUVGLDZGQUE2RjtZQUM3RixJQUFJLGVBQWUsSUFBSSxNQUFNLEVBQUUsQ0FBQztnQkFDOUIsTUFBTSx1Q0FBdUMsQ0FDM0MsTUFBTSxDQUFDLE1BQU0sRUFDYixpQkFBaUIsRUFDakIsOEJBQThCLEVBQzlCLHFCQUFxQixFQUNyQixlQUFlLEVBQ2YsTUFBTSxDQUNQLENBQUM7WUFDSixDQUFDO1lBRUQsT0FBTztnQkFDTCxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQW1CO2dCQUNsQyxrQkFBa0IsRUFBRTtvQkFDbEIsVUFBVSxFQUFFO3dCQUNWLEtBQUssRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO3dCQUNyQixNQUFNLEVBQUUsaUJBQWlCLENBQUMsS0FBSyxFQUFFLDBCQUEwQjt3QkFDM0QsSUFBSSxFQUFFLFVBQThCO3FCQUNyQztpQkFDcUQ7Z0JBQ3hELG1CQUFtQixFQUFFLDhCQUE4QjtnQkFDbkQscUJBQXFCO2FBQ2dELENBQUM7UUFDMUUsQ0FBQztRQUVELE1BQU0sSUFBSSxLQUFLLENBQ2IsZ0NBQWdDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSwwQ0FBMEMsQ0FDNUYsQ0FBQztJQUNKLENBQUM7SUFFTyxLQUFLLENBQUMsK0JBQStCLENBQzNDLFdBQXNCLEVBQ3RCLFNBQXFFLEVBQ3JFLGtCQUVDLEVBQ0QsT0FBa0IsRUFDbEIsZUFBd0IsRUFDeEIsTUFBa0IsRUFDbEIsZ0JBQStCO1FBSy9CLE1BQU0sV0FBVyxHQUFHLFNBQVMsQ0FBQywwQkFBMEIsQ0FBQztRQUN6RCxJQUFJLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDakIsTUFBTSxJQUFJLEtBQUssQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0NBQXdDLENBQUMsQ0FBQztRQUM1RCxDQUFDO1FBRUQsK0NBQStDO1FBQy9DLE1BQU0sZUFBZSxHQUFHLGtCQUFrQixDQUFDLEdBQUcsQ0FDNUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQywwQkFBMkIsQ0FBQyxTQUFTLENBQ3JELENBQUM7UUFDRixNQUFNLHFCQUFxQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FDekQsZUFBZSxFQUNmLE9BQU8sQ0FDUixDQUFDO1FBRUYsOENBQThDO1FBQzlDLGtHQUFrRztRQUNsRyxJQUFJLGVBQXFELENBQUM7UUFDMUQsSUFBSSxXQUFXLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxXQUFXLEVBQUUsQ0FBQztZQUMzQyxNQUFNLFVBQVUsR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDakQsTUFBTSxXQUFXLEdBQUcsV0FBVyxDQUFDLE1BQW1CLENBQUM7WUFFcEQscUNBQXFDO1lBQ3JDLElBQUksZUFBZSxJQUFJLE1BQU0sRUFBRSxDQUFDO2dCQUM5QixNQUFNLG9DQUFvQyxDQUN4QyxXQUFXLEVBQ1gsVUFBVSxFQUNWLHFCQUFxQixFQUNyQixlQUFlLEVBQ2YsTUFBTSxDQUNQLENBQUM7WUFDSixDQUFDO1lBRUQsZUFBZSxHQUFHLGlCQUFpQixDQUNqQyxpQkFBaUIsQ0FBQyxLQUFLLEVBQ3ZCLFdBQVcsQ0FBQyxRQUE0QixFQUN4QyxhQUFhLENBQUMsVUFBVSxDQUFDLENBQzFCLENBQUM7UUFDSixDQUFDO2FBQU0sQ0FBQztZQUNOLE1BQU0sSUFBSSxLQUFLLENBQ2IsK0NBQStDLFdBQVcsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQ3hFLENBQUM7UUFDSixDQUFDO1FBRUQsaURBQWlEO1FBQ2pELE1BQU0sSUFBSSxDQUFDLHdCQUF3QixDQUNqQyxTQUFTLEVBQ1QsV0FBVyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUM3QixnQkFBZ0IsQ0FDakIsQ0FBQztRQUVGLGtEQUFrRDtRQUNsRCxNQUFNLFdBQVcsR0FBRyxtQkFBbUIsQ0FBQyxXQUFXLENBQXFCLENBQUM7UUFDekUsTUFBTSxXQUFXLEdBQWlCLEVBQUUsQ0FBQztRQUNyQyxNQUFNLGNBQWMsR0FDbEIsU0FBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsQ0FBQztZQUMzQixTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssY0FBYyxDQUFDO1FBRXBELElBQUksY0FBYyxFQUFFLENBQUM7WUFDbkIsTUFBTSxNQUFNLEdBQTBELEVBQUUsQ0FBQztZQUN6RSxLQUFLLE1BQU0sSUFBSSxJQUFJLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQztnQkFDcEMsV0FBVyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7Z0JBQ2xDLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssY0FBYyxFQUFFLENBQUM7b0JBQ3ZDLE1BQU0sSUFBSSxLQUFLLENBQ2IsZ0RBQWdELElBQUksQ0FBQyxLQUFLLENBQUMsSUFBSSxHQUFHLENBQ25FLENBQUM7Z0JBQ0osQ0FBQztnQkFDRCxNQUFNLEVBQUUsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUM7Z0JBQzNDLE1BQU0sQ0FBQyxJQUFJLENBQUM7b0JBQ1YsVUFBVSxFQUFFO3dCQUNWLEtBQUssRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO3dCQUNyQixNQUFNLEVBQUUsaUJBQWlCLENBQUMsS0FBSzt3QkFDL0IsSUFBSSxFQUFFLFdBQVc7cUJBQ2xCO2lCQUNxRCxDQUFDLENBQUM7WUFDNUQsQ0FBQztZQUNELE9BQU87Z0JBQ0wsTUFBTSxFQUFFLFdBQVc7Z0JBQ25CLGVBQWU7Z0JBQ2YsTUFBTTtnQkFDTixxQkFBcUI7Z0JBQ3JCLFdBQVc7YUFJWixDQUFDO1FBQ0osQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLE1BQU0sR0FBMkMsRUFBRSxDQUFDO1lBQzFELEtBQUssTUFBTSxJQUFJLElBQUksU0FBUyxDQUFDLE1BQU0sRUFBRSxDQUFDO2dCQUNwQyxXQUFXLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDbEMsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxXQUFXLEVBQUUsQ0FBQztvQkFDcEMsTUFBTSxJQUFJLEtBQUssQ0FDYiw2Q0FBNkMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEdBQUcsQ0FDaEUsQ0FBQztnQkFDSixDQUFDO2dCQUNELE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQztnQkFDOUMsTUFBTSxDQUFDLElBQUksQ0FDVCxpQkFBaUIsQ0FDZixpQkFBaUIsQ0FBQyxLQUFLLEVBQ3ZCLFdBQVcsRUFDWCxhQUFhLENBQUMsY0FBYyxDQUFDLENBQzlCLENBQ0YsQ0FBQztZQUNKLENBQUM7WUFDRCxPQUFPO2dCQUNMLE1BQU0sRUFBRSxXQUFXO2dCQUNuQixlQUFlO2dCQUNmLE1BQU07Z0JBQ04scUJBQXFCO2dCQUNyQixXQUFXO2FBQ3NELENBQUM7UUFDdEUsQ0FBQztJQUNILENBQUM7SUFFRDs7Ozs7OztPQU9HO0lBQ0ssS0FBSyxDQUFDLHdCQUF3QixDQUNwQyxTQUFxRSxFQUNyRSxvQkFBZ0MsRUFDaEMsZ0JBQStCO1FBRS9CLDJGQUEyRjtRQUMzRixNQUFNLGlCQUFpQixHQUFHLElBQUksVUFBVSxDQUN0QyxTQUFTLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEdBQUcsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLEdBQUcsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUM1RCxDQUFDO1FBQ0YsSUFBSSxNQUFNLEdBQUcsQ0FBQyxDQUFDO1FBQ2YsS0FBSyxNQUFNLENBQUMsSUFBSSxTQUFTLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDdEMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUNqQyxNQUFNLElBQUksQ0FBQyxDQUFDLE1BQU0sQ0FBQztRQUNyQixDQUFDO1FBQ0QsTUFBTSxhQUFhLEdBQUcsU0FBUyxDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7UUFDL0QsTUFBTSxhQUFhLEdBQUcsVUFBVSxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDdkQsSUFBSSxhQUFhLEtBQUssYUFBYSxFQUFFLENBQUM7WUFDcEMsTUFBTSxJQUFJLHlCQUF5QixDQUNqQyxrREFBa0QsYUFBYSwwQkFBMEIsYUFBYSxFQUFFLENBQ3pHLENBQUM7UUFDSixDQUFDO1FBRUQsb0JBQW9CO1FBQ3BCLElBQUksU0FBUyxDQUFDLFdBQVcsQ0FBQyxNQUFNLEtBQUssU0FBUyxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUM3RCxNQUFNLElBQUkseUJBQXlCLENBQ2pDLHVCQUF1QixTQUFTLENBQUMsV0FBVyxDQUFDLE1BQU0sbUNBQW1DLFNBQVMsQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQ2pILENBQUM7UUFDSixDQUFDO1FBRUQsS0FBSyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxHQUFHLFNBQVMsQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUM7WUFDakQsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNqQyxJQUFJLFFBQW9CLENBQUM7WUFFekIsSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxjQUFjLEVBQUUsQ0FBQztnQkFDdkMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7b0JBQ3RCLHdFQUF3RTtvQkFDeEUsU0FBUztnQkFDWCxDQUFDO2dCQUNELE1BQU0sU0FBUyxHQUFHLE1BQU0sT0FBTyxDQUM3QixnQkFBZ0IsRUFDaEIsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsY0FBYyxDQUNoQyxDQUFDO2dCQUNGLE1BQU0sUUFBUSxHQUFHLElBQUksVUFBVSxDQUM3QixJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUMsTUFBTSxDQUMxQyxDQUFDO2dCQUNGLFFBQVEsQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQztnQkFDakMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDaEQsUUFBUSxHQUFHLFFBQVEsQ0FBQztZQUN0QixDQUFDO2lCQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssV0FBVyxFQUFFLENBQUM7Z0JBQzNDLFFBQVEsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUM7WUFDcEMsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLE1BQU0sSUFBSSx5QkFBeUIsQ0FDakMsMENBQTBDLENBQUMsS0FBSyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUNsRSxDQUFDO1lBQ0osQ0FBQztZQUVELE1BQU0sWUFBWSxHQUFHLFNBQVMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztZQUNyRCxNQUFNLFlBQVksR0FBRyxVQUFVLENBQUMsU0FBUyxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzFELElBQUksWUFBWSxLQUFLLFlBQVksRUFBRSxDQUFDO2dCQUNsQyxNQUFNLElBQUkseUJBQXlCLENBQ2pDLHdDQUF3QyxDQUFDLGNBQWMsWUFBWSxpQkFBaUIsWUFBWSxFQUFFLENBQ25HLENBQUM7WUFDSixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist/esm/kms/quorumConsistency.d.ts

@@ -0,0 +1,82 @@
+import type { Address } from 'viem';
+import type { AttestedComputeRequest, AttestedComputeResponse, AttestedDecryptResponse, AttestedRevealResponse, EListAttestedDecryptResponse, EListAttestedRevealResponse, DecryptionAttestation as ProtoDecryptionAttestation } from '../generated/es/inco/kms/lite/v1/kms_service_pb.js';
+import type { XwingKeypair } from '../lite/xwing.js';
+/**
+ * Computes a canonical key for a single attestation.
+ * For plaintext/reencryption+keypair, the key is handle:hex(value).
+ * For reencryption without a keypair (XWing ciphertexts are non-deterministic),
+ * falls back to handle:op-type as a structural stand-in.
+ */
+export declare function computeAttestationKey(att: ProtoDecryptionAttestation, reencryptKeypair?: XwingKeypair): Promise<string>;
+/**
+ * Validates that all responses in a winning bucket have the same attestation
+ * count and types as the quorum-elected reference (bucket[0]).
+ */
+export declare function validateDecryptResponseStructure<T extends AttestedDecryptResponse | AttestedRevealResponse>(bucket: Array<{
+    response: T;
+    signer: Address;
+}>): void;
+/**
+ * Validates that all responses in a winning bucket have a decryption
+ * attestation with the same case as the quorum-elected reference (bucket[0]),
+ * and that the case is consistent with the request's reencryptPubKey.
+ */
+export declare function validateComputeResponseStructure(bucket: Array<{
+    response: AttestedComputeResponse;
+    signer: Address;
+}>, request?: AttestedComputeRequest): void;
+/**
+ * Verifies decrypt/reveal response consistency using hash-bucket voting.
+ * Collects all N responses, buckets them by content key, and returns the
+ * winning bucket (the first one with >= threshold votes).
+ *
+ * This is robust against a faulty first-responding node: even if responses[0]
+ * disagrees, a quorum of agreeing responses will form a winning bucket.
+ */
+export declare function verifyDecryptResponseConsistency<T extends AttestedDecryptResponse | AttestedRevealResponse>(allResults: Array<{
+    response: T;
+    signer: Address;
+}>, threshold: number, reencryptKeypair?: XwingKeypair): Promise<{
+    reference: T;
+    winningResults: Array<{
+        response: T;
+        signer: Address;
+    }>;
+}>;
+type EListResponse = EListAttestedDecryptResponse | EListAttestedRevealResponse;
+/**
+ * Validates that all elist responses in a winning bucket have the same
+ * number of values and matching indices.
+ */
+export declare function validateEListResponseStructure<T extends EListResponse>(bucket: Array<{
+    response: T;
+    signer: Address;
+}>): void;
+/**
+ * Verifies elist response consistency using hash-bucket voting.
+ * Works for both EListAttestedDecryptResponse and EListAttestedRevealResponse.
+ */
+export declare function verifyEListResponseConsistency<T extends EListResponse>(allResults: Array<{
+    response: T;
+    signer: Address;
+}>, threshold: number, reencryptKeypair?: XwingKeypair): Promise<{
+    reference: T;
+    winningResults: Array<{
+        response: T;
+        signer: Address;
+    }>;
+}>;
+/**
+ * Verifies compute response consistency using hash-bucket voting.
+ */
+export declare function verifyComputeResponseConsistency(allResults: Array<{
+    response: AttestedComputeResponse;
+    signer: Address;
+}>, threshold: number, request?: AttestedComputeRequest, reencryptKeypair?: XwingKeypair): Promise<{
+    reference: AttestedComputeResponse;
+    winningResults: Array<{
+        response: AttestedComputeResponse;
+        signer: Address;
+    }>;
+}>;
+export {};