@modelprofile.com/authswitch 6.3.0 → 6.5.0

package/dist_ts/classes.authoritydaemon.js

@@ -0,0 +1,492 @@
+import * as plugins from './plugins.js';
+import { AuthSwitchAuthorityBroker } from './classes.authoritybroker.js';
+import { AuthSwitchAuthorityDatabase } from './classes.authoritydatabase.js';
+import { AuthSwitchAuthorityFrameReader, authSwitchAuthorityFrameBytes, maxAuthSwitchAuthorityFrameBytes } from './classes.authorityframing.js';
+import { AuthSwitchManagedCodex, findManagedCodexProcess } from './classes.codexmanaged.js';
+const hasKeys = (value, keys) => value !== null && typeof value === 'object' && !Array.isArray(value)
+    && Object.keys(value).length === keys.length && keys.every(key => Object.hasOwn(value, key));
+const invalid = () => { throw new plugins.typedrequest.TypedResponseError('Invalid authswitch authority request.'); };
+/** TypedRequest handlers over a private one-request-per-connection Unix socket. */
+export class AuthSwitchAuthorityDaemon {
+    options;
+    database;
+    broker;
+    managementRouter = new plugins.typedrequest.TypedRouter();
+    runtimeRouter = new plugins.typedrequest.TypedRouter();
+    managementServer;
+    runtimeServer;
+    sockets = new Set();
+    managedCodex = new Map();
+    managedCodexHomes = new Set();
+    managedCodexAccountIds = new Map();
+    drainingAccounts = new Set();
+    managedCodexStops = new Map();
+    managedCodexFailures = [];
+    closing = false;
+    constructor(options) {
+        this.options = options;
+        this.database = new AuthSwitchAuthorityDatabase(options);
+        this.broker = new AuthSwitchAuthorityBroker(this.database, options.broker);
+        this.register();
+    }
+    register() {
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.snapshot', async (request) => {
+            if (request === null || typeof request !== 'object' || Array.isArray(request))
+                invalid();
+            const keys = Object.keys(request);
+            if (keys.some(key => !['accountAfter', 'bindingAfter', 'limit'].includes(key)))
+                invalid();
+            return { snapshot: await this.broker.snapshot(request) };
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.events', async (request, tools) => {
+            if (!hasKeys(request, ['epoch', 'afterRevision', 'waitMs']))
+                invalid();
+            return this.broker.events(request.epoch, request.afterRevision, request.waitMs, tools?.abortSignal);
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.add', async (request) => {
+            if (!hasKeys(request, ['providerId', 'flow']) || request.providerId !== 'openai' || request.flow !== 'device')
+                invalid();
+            return { operation: await this.broker.beginAddOpenAi() };
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.reauth', async (request) => {
+            if (!hasKeys(request, ['accountId', 'flow']) || request.flow !== 'device' || typeof request.accountId !== 'string')
+                invalid();
+            if (this.drainingAccounts.has(request.accountId))
+                throw new Error('Account runtime drain is already in progress.');
+            this.drainingAccounts.add(request.accountId);
+            try {
+                await this.drainManagedCodexAccount(request.accountId);
+                const operation = await this.broker.beginReauthOpenAi(request.accountId);
+                void this.broker.waitOperation(operation.id).finally(() => this.drainingAccounts.delete(request.accountId)).catch(() => { });
+                return { operation };
+            }
+            catch (error) {
+                this.drainingAccounts.delete(request.accountId);
+                throw error;
+            }
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.operation', async (request) => {
+            if (!hasKeys(request, ['operationId']) || typeof request.operationId !== 'string')
+                invalid();
+            return { operation: this.broker.getOperation(request.operationId) };
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.cancel', async (request) => {
+            if (!hasKeys(request, ['operationId']) || typeof request.operationId !== 'string')
+                invalid();
+            return { operation: await this.broker.cancelOperation(request.operationId) };
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.rename', async (request) => {
+            if (!hasKeys(request, ['accountId', 'expectedRevision', 'label']) || typeof request.accountId !== 'string'
+                || typeof request.expectedRevision !== 'number' || typeof request.label !== 'string')
+                invalid();
+            return { account: await this.broker.renameAccount(request.accountId, request.expectedRevision, request.label) };
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.remove', async (request) => {
+            if (!hasKeys(request, ['accountId', 'expectedRevision']) || typeof request.accountId !== 'string'
+                || typeof request.expectedRevision !== 'number')
+                invalid();
+            if (this.drainingAccounts.has(request.accountId))
+                throw new Error('Account runtime drain is already in progress.');
+            this.drainingAccounts.add(request.accountId);
+            try {
+                await this.drainManagedCodexAccount(request.accountId);
+                return { account: await this.broker.removeAccount(request.accountId, request.expectedRevision) };
+            }
+            finally {
+                this.drainingAccounts.delete(request.accountId);
+            }
+        }));
+        this.managementRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.bind', async (request) => {
+            if (!hasKeys(request, ['accountId', 'runtime', 'scopeId', 'incarnationId'])
+                || typeof request.accountId !== 'string' || typeof request.scopeId !== 'string'
+                || typeof request.incarnationId !== 'string')
+                invalid();
+            return this.broker.bindAccount(request);
+        }));
+        this.runtimeRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('authswitch.authority.resolveAccess', async (request) => {
+            if ((typeof request !== 'object' || request === null || Array.isArray(request))
+                || !['bindingId', 'capability', 'minValidityMs'].every(key => Object.hasOwn(request, key))
+                || Object.keys(request).some(key => !['bindingId', 'capability', 'minValidityMs',
+                    'rejectedGrantGeneration'].includes(key))
+                || typeof request.bindingId !== 'string' || typeof request.capability !== 'string'
+                || typeof request.minValidityMs !== 'number'
+                || (request.rejectedGrantGeneration !== undefined && typeof request.rejectedGrantGeneration !== 'number'))
+                invalid();
+            return this.broker.resolveAccess(request.bindingId, request.capability, request.minValidityMs, request.rejectedGrantGeneration);
+        }));
+    }
+    async start() {
+        if (this.managementServer || this.runtimeServer)
+            throw new Error('Authswitch authority daemon is already started.');
+        await this.database.start();
+        try {
+            await this.broker.start();
+            const managementDirectory = plugins.path.dirname(this.options.authoritySocketPath);
+            const runtimeDirectory = plugins.path.dirname(this.options.runtimeSocketPath);
+            const databaseDirectory = plugins.path.dirname(this.options.socketPath);
+            if (managementDirectory === runtimeDirectory || databaseDirectory === runtimeDirectory
+                || managementDirectory.startsWith(runtimeDirectory + plugins.path.sep)
+                || databaseDirectory.startsWith(runtimeDirectory + plugins.path.sep)
+                || runtimeDirectory.startsWith(managementDirectory + plugins.path.sep)
+                || runtimeDirectory.startsWith(databaseDirectory + plugins.path.sep)) {
+                throw new Error('Runtime socket directory must contain no management or database endpoint.');
+            }
+            this.managementServer = await this.listen(this.options.authoritySocketPath, this.managementRouter);
+            this.runtimeServer = await this.listen(this.options.runtimeSocketPath, this.runtimeRouter);
+        }
+        catch (error) {
+            try {
+                await this.close();
+            }
+            catch { /* Preserve startup failure. */ }
+            throw error;
+        }
+    }
+    /** Trusted in-process SDK admission; management RPC exposure belongs to the later CLI cutover. */
+    async drainManagedCodexAccount(accountId) {
+        const scopes = [...this.managedCodexAccountIds]
+            .filter(([, assignedAccountId]) => assignedAccountId === accountId).map(([scopeId]) => scopeId);
+        const results = await Promise.allSettled(scopes.map(scopeId => this.stopManagedCodex(scopeId)));
+        const failed = results.filter((result) => result.status === 'rejected');
+        if (failed.length)
+            throw new AggregateError(failed.map(result => result.reason), 'Managed Codex account drain failed.');
+    }
+    async startManagedCodex(input) {
+        if (!plugins.path.isAbsolute(input.codexHomeDirectory)
+            || plugins.path.normalize(input.codexHomeDirectory) !== input.codexHomeDirectory) {
+            throw new Error('Managed Codex requires a normalized absolute state home.');
+        }
+        const homeId = plugins.crypto.createHash('sha256').update(JSON.stringify(['authswitch-codex-home-v1', input.codexHomeDirectory])).digest('hex');
+        if (this.closing || !this.managementServer || !this.runtimeServer
+            || this.managedCodex.has(input.scopeId) || this.managedCodexStops.has(input.scopeId)
+            || this.managedCodexHomes.has(homeId) || this.drainingAccounts.has(input.accountId)) {
+            throw new Error('Managed Codex scope is unavailable.');
+        }
+        this.managedCodexHomes.add(homeId);
+        this.managedCodexAccountIds.set(input.scopeId, input.accountId);
+        const runId = plugins.crypto.randomUUID();
+        const task = (async () => {
+            let bound;
+            let runtime;
+            let claimed = false;
+            try {
+                const home = input.codexHomeDirectory;
+                const parent = plugins.path.dirname(home);
+                const parentStat = await plugins.fs.promises.lstat(parent);
+                if (!parentStat.isDirectory() || parentStat.isSymbolicLink() || parentStat.uid !== process.getuid?.()
+                    || (parentStat.mode & 0o077) !== 0 || await plugins.fs.promises.realpath(parent) !== parent) {
+                    throw new Error('Managed Codex home parent must be private and owned by this user.');
+                }
+                const nativeHomes = [plugins.path.join(plugins.os.homedir(), '.codex'), process.env.CODEX_HOME]
+                    .filter((value) => typeof value === 'string' && plugins.path.isAbsolute(value));
+                if (nativeHomes.some(native => home === native || home.startsWith(native + plugins.path.sep)
+                    || native.startsWith(home + plugins.path.sep))) {
+                    throw new Error('Managed Codex cannot adopt an active native Codex home.');
+                }
+                const existing = await this.database.readCodexHome(homeId);
+                if (existing && (existing.accountId !== input.accountId || existing.scopeId !== input.scopeId)) {
+                    throw new Error('Managed Codex home already belongs to another account or scope.');
+                }
+                let homeExists = false;
+                try {
+                    const stat = await plugins.fs.promises.lstat(home);
+                    if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()
+                        || (stat.mode & 0o077) !== 0 || await plugins.fs.promises.realpath(home) !== home) {
+                        throw new Error('Managed Codex home is not a private owned directory.');
+                    }
+                    homeExists = true;
+                }
+                catch (error) {
+                    if (!(error && typeof error === 'object' && 'code' in error && error.code === 'ENOENT'))
+                        throw error;
+                }
+                if (!existing && homeExists && (await plugins.fs.promises.readdir(home)).length) {
+                    throw new Error('An existing Codex home needs explicit native-owner handoff before enrollment.');
+                }
+                await this.database.reserveCodexHome(input.accountId, input.scopeId, homeId, plugins.crypto.randomUUID());
+                if (!homeExists)
+                    await plugins.fs.promises.mkdir(home, { mode: 0o700 });
+                bound = await this.broker.bindAccount({ accountId: input.accountId, runtime: 'codex',
+                    scopeId: input.scopeId, incarnationId: plugins.crypto.randomUUID() });
+                runtime = new AuthSwitchManagedCodex({
+                    runtimeDirectory: plugins.path.join(plugins.path.dirname(plugins.path.dirname(this.options.authoritySocketPath)), 'managed-codex'),
+                    codexHomeDirectory: home, workspaceDirectory: input.workspaceDirectory, executable: input.executable,
+                    onNotification: input.onNotification, onServerRequest: input.onServerRequest,
+                    broker: this.broker, bindingId: bound.binding.id, capability: bound.capability,
+                    onPreparedRun: async (socketPath) => {
+                        const assigned = await this.database.readCodexHome(homeId);
+                        if (!assigned || assigned.accountId !== input.accountId || assigned.scopeId !== input.scopeId) {
+                            throw new Error('Managed Codex home assignment changed.');
+                        }
+                        if (assigned.activeRun) {
+                            const survivor = await findManagedCodexProcess(assigned.activeRun.socketPath);
+                            if (survivor)
+                                throw new Error('Managed Codex home still has a live app-server owner.');
+                            await this.database.changeCodexRun(homeId, assigned.activeRun.id, null, plugins.crypto.randomUUID());
+                        }
+                        await this.database.changeCodexRun(homeId, null, { id: runId, socketPath, pid: null, startedAt: null }, plugins.crypto.randomUUID());
+                        claimed = true;
+                    },
+                    onChildSpawned: async (pid, startedAt) => {
+                        const assigned = await this.database.readCodexHome(homeId);
+                        if (assigned?.activeRun?.id !== runId || assigned.activeRun.pid !== null) {
+                            throw new Error('Managed Codex run registration changed before process verification.');
+                        }
+                        await this.database.changeCodexRun(homeId, runId, { ...assigned.activeRun, pid, startedAt }, plugins.crypto.randomUUID());
+                    },
+                    onUnavailable: () => {
+                        void this.stopManagedCodex(input.scopeId).catch(error => {
+                            this.managedCodexFailures.push(error);
+                            process.stderr.write('Managed Codex cleanup failed after its control connection closed.\n');
+                        });
+                    },
+                });
+                await runtime.start();
+                if (this.closing)
+                    throw new Error('Managed Codex admission closed during startup.');
+                return { runtime, bindingId: bound.binding.id, capability: bound.capability, homeId, runId };
+            }
+            catch (error) {
+                const cleanupErrors = [];
+                if (runtime)
+                    try {
+                        await runtime.close();
+                    }
+                    catch (cleanupError) {
+                        cleanupErrors.push(cleanupError);
+                    }
+                if (claimed && cleanupErrors.length === 0)
+                    try {
+                        await this.database.changeCodexRun(homeId, runId, null, plugins.crypto.randomUUID());
+                    }
+                    catch (cleanupError) {
+                        cleanupErrors.push(cleanupError);
+                    }
+                if (bound)
+                    try {
+                        await this.broker.revokeBinding(bound.binding.id, bound.capability);
+                    }
+                    catch (cleanupError) {
+                        cleanupErrors.push(cleanupError);
+                    }
+                if (cleanupErrors.length === 0) {
+                    this.managedCodexHomes.delete(homeId);
+                    this.managedCodexAccountIds.delete(input.scopeId);
+                }
+                if (cleanupErrors.length)
+                    throw new AggregateError([error, ...cleanupErrors], 'Managed Codex admission cleanup failed.');
+                throw error;
+            }
+        })();
+        this.managedCodex.set(input.scopeId, task);
+        try {
+            return (await task).runtime;
+        }
+        catch (error) {
+            this.managedCodex.delete(input.scopeId);
+            throw error;
+        }
+    }
+    stopManagedCodex(scopeId) {
+        const existing = this.managedCodexStops.get(scopeId);
+        if (existing)
+            return existing;
+        const task = this.managedCodex.get(scopeId);
+        if (!task)
+            return Promise.resolve();
+        this.managedCodex.delete(scopeId);
+        const stopping = (async () => {
+            let entry;
+            try {
+                entry = await task;
+            }
+            catch { /* Failed admission already closed its process and revoked its binding. */
+                return;
+            }
+            const { runtime, bindingId, capability, homeId, runId } = entry;
+            const errors = [];
+            try {
+                await runtime.close();
+            }
+            catch (error) {
+                errors.push(error);
+            }
+            if (errors.length === 0)
+                try {
+                    await this.database.changeCodexRun(homeId, runId, null, plugins.crypto.randomUUID());
+                    this.managedCodexHomes.delete(homeId);
+                    this.managedCodexAccountIds.delete(scopeId);
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+            try {
+                await this.broker.revokeBinding(bindingId, capability);
+            }
+            catch (error) {
+                errors.push(error);
+            }
+            if (errors.length)
+                throw new AggregateError(errors, 'Managed Codex shutdown was incomplete.');
+        })();
+        this.managedCodexStops.set(scopeId, stopping);
+        void stopping.finally(() => { if (this.managedCodexStops.get(scopeId) === stopping)
+            this.managedCodexStops.delete(scopeId); }).catch(() => { });
+        return stopping;
+    }
+    async listen(path, router) {
+        const directory = plugins.path.dirname(path);
+        await plugins.fs.promises.mkdir(directory, { recursive: true, mode: 0o700 });
+        const stat = await plugins.fs.promises.lstat(directory);
+        if (!stat.isDirectory() || stat.isSymbolicLink() || stat.uid !== process.getuid?.()) {
+            throw new Error('Authswitch authority socket directory is not private.');
+        }
+        await plugins.fs.promises.chmod(directory, 0o700);
+        await this.clearStaleSocket(path);
+        const server = plugins.net.createServer(socket => this.accept(socket, router));
+        try {
+            await new Promise((resolve, reject) => {
+                server.once('error', reject);
+                server.listen(path, () => { server.off('error', reject); resolve(); });
+            });
+            await plugins.fs.promises.chmod(path, 0o600);
+            return server;
+        }
+        catch (error) {
+            if (server.listening)
+                await new Promise(resolve => server.close(() => resolve()));
+            throw error;
+        }
+    }
+    /** A killed daemon leaves a pathname behind; only remove an unchanged, owned, refused Unix socket. */
+    async clearStaleSocket(path) {
+        let before;
+        try {
+            before = await plugins.fs.promises.lstat(path);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+        if (!before.isSocket() || before.uid !== process.getuid?.())
+            throw new Error('Authswitch socket path is unsafe.');
+        const refused = await new Promise((resolve, reject) => {
+            const probe = plugins.net.createConnection(path);
+            probe.setTimeout(1_000, () => { probe.destroy(); reject(new Error('Authswitch socket probe timed out.')); });
+            probe.once('connect', () => { probe.destroy(); resolve(false); });
+            probe.once('error', error => {
+                probe.destroy();
+                if (error.code === 'ECONNREFUSED')
+                    resolve(true);
+                else
+                    reject(error);
+            });
+        });
+        if (!refused)
+            throw new Error('Authswitch authority socket is already active.');
+        const after = await plugins.fs.promises.lstat(path);
+        if (!after.isSocket() || after.uid !== before.uid || after.dev !== before.dev || after.ino !== before.ino) {
+            throw new Error('Authswitch socket path changed during startup.');
+        }
+        await plugins.fs.promises.unlink(path);
+    }
+    accept(socket, router) {
+        this.sockets.add(socket);
+        const abort = new AbortController();
+        socket.on('close', () => { this.sockets.delete(socket); abort.abort(); });
+        const frame = new AuthSwitchAuthorityFrameReader();
+        let handled = false;
+        socket.setTimeout(35_000, () => socket.destroy());
+        socket.on('data', chunk => {
+            if (handled) {
+                socket.destroy();
+                return;
+            }
+            if (!Buffer.isBuffer(chunk)) {
+                socket.destroy();
+                return;
+            }
+            let input;
+            try {
+                input = frame.add(chunk);
+            }
+            catch {
+                socket.destroy();
+                return;
+            }
+            if (input === null)
+                return;
+            handled = true;
+            let request;
+            try {
+                request = JSON.parse(input);
+            }
+            catch {
+                socket.destroy();
+                return;
+            }
+            void router.routeAndAddResponse(request, { trustedLocalData: { authoritySocket: socket },
+                trustedAbortSignal: abort.signal })
+                .then(response => {
+                const raw = JSON.stringify(response);
+                if (authSwitchAuthorityFrameBytes(raw) > maxAuthSwitchAuthorityFrameBytes) {
+                    socket.destroy();
+                    return;
+                }
+                socket.end(raw + '\n');
+            }).catch(() => socket.destroy());
+        });
+    }
+    async close() {
+        this.closing = true;
+        const errors = [];
+        for (const scopeId of [...this.managedCodex.keys()]) {
+            try {
+                await this.stopManagedCodex(scopeId);
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        for (const stopping of [...this.managedCodexStops.values()]) {
+            try {
+                await stopping;
+            }
+            catch (error) {
+                errors.push(error);
+            }
+        }
+        errors.push(...this.managedCodexFailures);
+        try {
+            await this.broker.close();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+        const management = this.managementServer;
+        const runtime = this.runtimeServer;
+        this.managementServer = undefined;
+        this.runtimeServer = undefined;
+        for (const socket of this.sockets)
+            socket.destroy();
+        for (const server of [management, runtime]) {
+            if (server)
+                try {
+                    await new Promise((resolve, reject) => server.close(error => error ? reject(error) : resolve()));
+                }
+                catch (error) {
+                    errors.push(error);
+                }
+        }
+        try {
+            await this.database.stop();
+        }
+        catch (error) {
+            errors.push(error);
+        }
+        if (errors.length)
+            throw new AggregateError(errors, 'Authswitch authority shutdown was incomplete.');
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlkYWVtb24uanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmF1dGhvcml0eWRhZW1vbi50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFDQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQU94QyxPQUFPLEVBQUUseUJBQXlCLEVBQTBDLE1BQU0sOEJBQThCLENBQUM7QUFDakgsT0FBTyxFQUFFLDJCQUEyQixFQUE0QyxNQUFNLGdDQUFnQyxDQUFDO0FBQ3ZILE9BQU8sRUFBRSw4QkFBOEIsRUFBRSw2QkFBNkIsRUFDcEUsZ0NBQWdDLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUMxRSxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsdUJBQXVCLEVBQXVDLE1BQU0sMkJBQTJCLENBQUM7QUFRakksTUFBTSxPQUFPLEdBQUcsQ0FBQyxLQUFjLEVBQUUsSUFBdUIsRUFBb0MsRUFBRSxDQUM1RixLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDO09BQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxLQUFLLElBQUksQ0FBQyxNQUFNLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLEdBQUcsQ0FBQyxDQUFDLENBQUM7QUFDL0YsTUFBTSxPQUFPLEdBQUcsR0FBVSxFQUFFLEdBQUcsTUFBTSxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsdUNBQXVDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUU3SCxtRkFBbUY7QUFDbkYsTUFBTSxPQUFPLHlCQUF5QjtJQWlCUDtJQWhCYixRQUFRLENBQThCO0lBQ3RDLE1BQU0sQ0FBNEI7SUFDakMsZ0JBQWdCLEdBQUcsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRSxDQUFDO0lBQzFELGFBQWEsR0FBRyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDaEUsZ0JBQWdCLENBQXNCO0lBQ3RDLGFBQWEsQ0FBc0I7SUFDMUIsT0FBTyxHQUFHLElBQUksR0FBRyxFQUFzQixDQUFDO0lBQ3hDLFlBQVksR0FBRyxJQUFJLEdBQUcsRUFDa0IsQ0FBQztJQUN6QyxpQkFBaUIsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ3RDLHNCQUFzQixHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO0lBQ25ELGdCQUFnQixHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDckMsaUJBQWlCLEdBQUcsSUFBSSxHQUFHLEVBQXlCLENBQUM7SUFDckQsb0JBQW9CLEdBQWMsRUFBRSxDQUFDO0lBQzlDLE9BQU8sR0FBRyxLQUFLLENBQUM7SUFFeEIsWUFBNkIsT0FBMEM7UUFBMUMsWUFBTyxHQUFQLE9BQU8sQ0FBbUM7UUFDckUsSUFBSSxDQUFDLFFBQVEsR0FBRyxJQUFJLDJCQUEyQixDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3pELElBQUksQ0FBQyxNQUFNLEdBQUcsSUFBSSx5QkFBeUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzRSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDbEIsQ0FBQztJQUVPLFFBQVE7UUFDZCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLCtCQUErQixFQUFFLEtBQUssRUFBQyxPQUFPLEVBQUMsRUFBRTtZQUMvQyxJQUFJLE9BQU8sS0FBSyxJQUFJLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1lBQ3pGLE1BQU0sSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDbEMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLGNBQWMsRUFBRSxjQUFjLEVBQUUsT0FBTyxDQUFDLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzFGLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzNELENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLDZCQUE2QixFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLEVBQUU7WUFDdEQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQyxPQUFPLEVBQUUsZUFBZSxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1lBQ3ZFLE9BQU8sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxPQUFPLENBQUMsYUFBYSxFQUFFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDO1FBQ3RHLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLDBCQUEwQixFQUFFLEtBQUssRUFBQyxPQUFPLEVBQUMsRUFBRTtZQUMxQyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLFlBQVksRUFBRSxNQUFNLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUTtnQkFBRSxPQUFPLEVBQUUsQ0FBQztZQUN6SCxPQUFPLEVBQUUsU0FBUyxFQUFFLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsRUFBRSxDQUFDO1FBQzNELENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLDZCQUE2QixFQUFFLEtBQUssRUFBQyxPQUFPLEVBQUMsRUFBRTtZQUM3QyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFNBQVMsS0FBSyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1lBQzlILElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsK0NBQStDLENBQUMsQ0FBQztZQUNuSCxJQUFJLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUM3QyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxJQUFJLENBQUMsd0JBQXdCLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUN2RCxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUN6RSxLQUFLLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxPQUFPLENBQUMsR0FBRyxFQUFFLENBQUMsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQzVILE9BQU8sRUFBRSxTQUFTLEVBQUUsQ0FBQztZQUN2QixDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFBQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFBQyxNQUFNLEtBQUssQ0FBQztZQUFDLENBQUM7UUFDbkYsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNOLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxlQUFlLENBQUMsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDekUsZ0NBQWdDLEVBQUUsS0FBSyxFQUFDLE9BQU8sRUFBQyxFQUFFO1lBQ2hELElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUMsYUFBYSxDQUFDLENBQUMsSUFBSSxPQUFPLE9BQU8sQ0FBQyxXQUFXLEtBQUssUUFBUTtnQkFBRSxPQUFPLEVBQUUsQ0FBQztZQUM3RixPQUFPLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ3RFLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLDZCQUE2QixFQUFFLEtBQUssRUFBQyxPQUFPLEVBQUMsRUFBRTtZQUM3QyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLGFBQWEsQ0FBQyxDQUFDLElBQUksT0FBTyxPQUFPLENBQUMsV0FBVyxLQUFLLFFBQVE7Z0JBQUUsT0FBTyxFQUFFLENBQUM7WUFDN0YsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQy9FLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLDZCQUE2QixFQUFFLEtBQUssRUFBQyxPQUFPLEVBQUMsRUFBRTtZQUM3QyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLFdBQVcsRUFBRSxrQkFBa0IsRUFBRSxPQUFPLENBQUMsQ0FBQyxJQUFJLE9BQU8sT0FBTyxDQUFDLFNBQVMsS0FBSyxRQUFRO21CQUNyRyxPQUFPLE9BQU8sQ0FBQyxnQkFBZ0IsS0FBSyxRQUFRLElBQUksT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7Z0JBQUUsT0FBTyxFQUFFLENBQUM7WUFDbEcsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxTQUFTLEVBQUUsT0FBTyxDQUFDLGdCQUFnQixFQUFFLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2xILENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDTixJQUFJLENBQUMsZ0JBQWdCLENBQUMsZUFBZSxDQUFDLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ3pFLDZCQUE2QixFQUFFLEtBQUssRUFBQyxPQUFPLEVBQUMsRUFBRTtZQUM3QyxJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDLFdBQVcsRUFBRSxrQkFBa0IsQ0FBQyxDQUFDLElBQUksT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVE7bUJBQzVGLE9BQU8sT0FBTyxDQUFDLGdCQUFnQixLQUFLLFFBQVE7Z0JBQUUsT0FBTyxFQUFFLENBQUM7WUFDN0QsSUFBSSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1lBQ25ILElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQzdDLElBQUksQ0FBQztnQkFDSCxNQUFNLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ3ZELE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7WUFDbkcsQ0FBQztvQkFBUyxDQUFDO2dCQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQUMsQ0FBQztRQUNoRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ04sSUFBSSxDQUFDLGdCQUFnQixDQUFDLGVBQWUsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUN6RSwyQkFBMkIsRUFBRSxLQUFLLEVBQUMsT0FBTyxFQUFDLEVBQUU7WUFDM0MsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQyxXQUFXLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxlQUFlLENBQUMsQ0FBQzttQkFDdEUsT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxPQUFPLEtBQUssUUFBUTttQkFDNUUsT0FBTyxPQUFPLENBQUMsYUFBYSxLQUFLLFFBQVE7Z0JBQUUsT0FBTyxFQUFFLENBQUM7WUFDMUQsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUMxQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ04sSUFBSSxDQUFDLGFBQWEsQ0FBQyxlQUFlLENBQUMsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDdEUsb0NBQW9DLEVBQUUsS0FBSyxFQUFDLE9BQU8sRUFBQyxFQUFFO1lBQ3BELElBQUksQ0FBQyxPQUFPLE9BQU8sS0FBSyxRQUFRLElBQUksT0FBTyxLQUFLLElBQUksSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxDQUFDO21CQUMxRSxDQUFDLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxlQUFlLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxHQUFHLENBQUMsQ0FBQzttQkFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxlQUFlO29CQUM5RSx5QkFBeUIsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQzttQkFDeEMsT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxVQUFVLEtBQUssUUFBUTttQkFDL0UsT0FBTyxPQUFPLENBQUMsYUFBYSxLQUFLLFFBQVE7bUJBQ3pDLENBQUMsT0FBTyxDQUFDLHVCQUF1QixLQUFLLFNBQVMsSUFBSSxPQUFPLE9BQU8sQ0FBQyx1QkFBdUIsS0FBSyxRQUFRLENBQUM7Z0JBQUUsT0FBTyxFQUFFLENBQUM7WUFDdkgsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLGFBQWEsRUFDM0YsT0FBTyxDQUFDLHVCQUF1QixDQUFDLENBQUM7UUFDckMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNSLENBQUM7SUFFTSxLQUFLLENBQUMsS0FBSztRQUNoQixJQUFJLElBQUksQ0FBQyxnQkFBZ0IsSUFBSSxJQUFJLENBQUMsYUFBYTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsaURBQWlELENBQUMsQ0FBQztRQUNwSCxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDNUIsSUFBSSxDQUFDO1lBQ0gsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQzFCLE1BQU0sbUJBQW1CLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDO1lBQ25GLE1BQU0sZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1lBQzlFLE1BQU0saUJBQWlCLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUN4RSxJQUFJLG1CQUFtQixLQUFLLGdCQUFnQixJQUFJLGlCQUFpQixLQUFLLGdCQUFnQjttQkFDakYsbUJBQW1CLENBQUMsVUFBVSxDQUFDLGdCQUFnQixHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDO21CQUNuRSxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7bUJBQ2pFLGdCQUFnQixDQUFDLFVBQVUsQ0FBQyxtQkFBbUIsR0FBRyxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQzttQkFDbkUsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLGlCQUFpQixHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdkUsTUFBTSxJQUFJLEtBQUssQ0FBQywyRUFBMkUsQ0FBQyxDQUFDO1lBQy9GLENBQUM7WUFDRCxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDbkcsSUFBSSxDQUFDLGFBQWEsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLENBQUM7Z0JBQUMsTUFBTSxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUM7WUFBQyxDQUFDO1lBQUMsTUFBTSxDQUFDLENBQUMsK0JBQStCLENBQUMsQ0FBQztZQUNyRSxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQsa0dBQWtHO0lBQzFGLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxTQUFpQjtRQUN0RCxNQUFNLE1BQU0sR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLHNCQUFzQixDQUFDO2FBQzVDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxpQkFBaUIsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsS0FBSyxTQUFTLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNsRyxNQUFNLE9BQU8sR0FBRyxNQUFNLE9BQU8sQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDaEcsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDLE1BQU0sRUFBbUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEtBQUssVUFBVSxDQUFDLENBQUM7UUFDekcsSUFBSSxNQUFNLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxjQUFjLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxxQ0FBcUMsQ0FBQyxDQUFDO0lBQzFILENBQUM7SUFFTSxLQUFLLENBQUMsaUJBQWlCLENBQUMsS0FHd0M7UUFDckUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQztlQUNqRCxPQUFPLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLENBQUMsa0JBQWtCLENBQUMsS0FBSyxLQUFLLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztZQUNuRixNQUFNLElBQUksS0FBSyxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsMEJBQTBCLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNoSixJQUFJLElBQUksQ0FBQyxPQUFPLElBQUksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYTtlQUM1RCxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDO2VBQ2pGLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUN0RixNQUFNLElBQUksS0FBSyxDQUFDLHFDQUFxQyxDQUFDLENBQUM7UUFDekQsQ0FBQztRQUNELElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDbkMsSUFBSSxDQUFDLHNCQUFzQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNoRSxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzFDLE1BQU0sSUFBSSxHQUFHLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDdkIsSUFBSSxLQUFzRSxDQUFDO1lBQzNFLElBQUksT0FBMkMsQ0FBQztZQUNoRCxJQUFJLE9BQU8sR0FBRyxLQUFLLENBQUM7WUFDcEIsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxHQUFHLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQztnQkFDdEMsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7Z0JBQzFDLE1BQU0sVUFBVSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUMzRCxJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsRUFBRSxJQUFJLFVBQVUsQ0FBQyxjQUFjLEVBQUUsSUFBSSxVQUFVLENBQUMsR0FBRyxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRTt1QkFDaEcsQ0FBQyxVQUFVLENBQUMsSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxNQUFNLEVBQUUsQ0FBQztvQkFDOUYsTUFBTSxJQUFJLEtBQUssQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO2dCQUN2RixDQUFDO2dCQUNELE1BQU0sV0FBVyxHQUFHLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxRQUFRLENBQUMsRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQztxQkFDNUYsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFtQixFQUFFLENBQUMsT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7Z0JBQ25HLElBQUksV0FBVyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLElBQUksS0FBSyxNQUFNLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUM7dUJBQ3ZGLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxDQUFDO29CQUNqRCxNQUFNLElBQUksS0FBSyxDQUFDLHlEQUF5RCxDQUFDLENBQUM7Z0JBQzdFLENBQUM7Z0JBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQztnQkFDM0QsSUFBSSxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLEtBQUssQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLE9BQU8sS0FBSyxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztvQkFDL0YsTUFBTSxJQUFJLEtBQUssQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO2dCQUNyRixDQUFDO2dCQUNELElBQUksVUFBVSxHQUFHLEtBQUssQ0FBQztnQkFDdkIsSUFBSSxDQUFDO29CQUNILE1BQU0sSUFBSSxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO29CQUNuRCxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRTsyQkFDOUUsQ0FBQyxJQUFJLENBQUMsSUFBSSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsSUFBSSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLEVBQUUsQ0FBQzt3QkFDcEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO29CQUMxRSxDQUFDO29CQUNELFVBQVUsR0FBRyxJQUFJLENBQUM7Z0JBQ3BCLENBQUM7Z0JBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztvQkFDZixJQUFJLENBQUMsQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sSUFBSSxLQUFLLElBQUksS0FBSyxDQUFDLElBQUksS0FBSyxRQUFRLENBQUM7d0JBQUUsTUFBTSxLQUFLLENBQUM7Z0JBQ3ZHLENBQUM7Z0JBQ0QsSUFBSSxDQUFDLFFBQVEsSUFBSSxVQUFVLElBQUksQ0FBQyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO29CQUNoRixNQUFNLElBQUksS0FBSyxDQUFDLCtFQUErRSxDQUFDLENBQUM7Z0JBQ25HLENBQUM7Z0JBQ0QsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO2dCQUMxRyxJQUFJLENBQUMsVUFBVTtvQkFBRSxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztnQkFDeEUsS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLFNBQVMsRUFBRSxPQUFPLEVBQUUsT0FBTztvQkFDbEYsT0FBTyxFQUFFLEtBQUssQ0FBQyxPQUFPLEVBQUUsYUFBYSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLEVBQUUsQ0FBQyxDQUFDO2dCQUN4RSxPQUFPLEdBQUcsSUFBSSxzQkFBc0IsQ0FBQztvQkFDbkMsZ0JBQWdCLEVBQUUsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxtQkFBbUIsQ0FBQyxDQUFDLEVBQUUsZUFBZSxDQUFDO29CQUNsSSxrQkFBa0IsRUFBRSxJQUFJLEVBQUUsa0JBQWtCLEVBQUUsS0FBSyxDQUFDLGtCQUFrQixFQUFFLFVBQVUsRUFBRSxLQUFLLENBQUMsVUFBVTtvQkFDcEcsY0FBYyxFQUFFLEtBQUssQ0FBQyxjQUFjLEVBQUUsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlO29CQUM1RSxNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU0sRUFBRSxTQUFTLEVBQUUsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsVUFBVSxFQUFFLEtBQUssQ0FBQyxVQUFVO29CQUM5RSxhQUFhLEVBQUUsS0FBSyxFQUFDLFVBQVUsRUFBQyxFQUFFO3dCQUNoQyxNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDO3dCQUMzRCxJQUFJLENBQUMsUUFBUSxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsSUFBSSxRQUFRLENBQUMsT0FBTyxLQUFLLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQzs0QkFDOUYsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO3dCQUM1RCxDQUFDO3dCQUNELElBQUksUUFBUSxDQUFDLFNBQVMsRUFBRSxDQUFDOzRCQUN2QixNQUFNLFFBQVEsR0FBRyxNQUFNLHVCQUF1QixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLENBQUM7NEJBQzlFLElBQUksUUFBUTtnQ0FBRSxNQUFNLElBQUksS0FBSyxDQUFDLHVEQUF1RCxDQUFDLENBQUM7NEJBQ3ZGLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxFQUFFLElBQUksRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7d0JBQ3ZHLENBQUM7d0JBQ0QsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsSUFBSSxFQUM3QyxFQUFFLEVBQUUsRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLEdBQUcsRUFBRSxJQUFJLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQzt3QkFDdEYsT0FBTyxHQUFHLElBQUksQ0FBQztvQkFDakIsQ0FBQztvQkFDRCxjQUFjLEVBQUUsS0FBSyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsRUFBRTt3QkFDdkMsTUFBTSxRQUFRLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQzt3QkFDM0QsSUFBSSxRQUFRLEVBQUUsU0FBUyxFQUFFLEVBQUUsS0FBSyxLQUFLLElBQUksUUFBUSxDQUFDLFNBQVMsQ0FBQyxHQUFHLEtBQUssSUFBSSxFQUFFLENBQUM7NEJBQ3pFLE1BQU0sSUFBSSxLQUFLLENBQUMscUVBQXFFLENBQUMsQ0FBQzt3QkFDekYsQ0FBQzt3QkFDRCxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQzlDLEVBQUUsR0FBRyxRQUFRLENBQUMsU0FBUyxFQUFFLEdBQUcsRUFBRSxTQUFTLEVBQUUsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUM7b0JBQzVFLENBQUM7b0JBQ0QsYUFBYSxFQUFFLEdBQUcsRUFBRTt3QkFDbEIsS0FBSyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsRUFBRTs0QkFDdEQsSUFBSSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQzs0QkFDdEMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMscUVBQXFFLENBQUMsQ0FBQzt3QkFDOUYsQ0FBQyxDQUFDLENBQUM7b0JBQ0wsQ0FBQztpQkFDRixDQUFDLENBQUM7Z0JBQ0gsTUFBTSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQ3RCLElBQUksSUFBSSxDQUFDLE9BQU87b0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO2dCQUNwRixPQUFPLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxLQUFLLENBQUMsT0FBTyxDQUFDLEVBQUUsRUFBRSxVQUFVLEVBQUUsS0FBSyxDQUFDLFVBQVUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLENBQUM7WUFDL0YsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsTUFBTSxhQUFhLEdBQWMsRUFBRSxDQUFDO2dCQUNwQyxJQUFJLE9BQU87b0JBQUUsSUFBSSxDQUFDO3dCQUFDLE1BQU0sT0FBTyxDQUFDLEtBQUssRUFBRSxDQUFDO29CQUFDLENBQUM7b0JBQUMsT0FBTyxZQUFZLEVBQUUsQ0FBQzt3QkFBQyxhQUFhLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxDQUFDO29CQUFDLENBQUM7Z0JBQ3RHLElBQUksT0FBTyxJQUFJLGFBQWEsQ0FBQyxNQUFNLEtBQUssQ0FBQztvQkFBRSxJQUFJLENBQUM7d0JBQzlDLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO29CQUN2RixDQUFDO29CQUFDLE9BQU8sWUFBWSxFQUFFLENBQUM7d0JBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztvQkFBQyxDQUFDO2dCQUM1RCxJQUFJLEtBQUs7b0JBQUUsSUFBSSxDQUFDO3dCQUFDLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEVBQUUsS0FBSyxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUFDLENBQUM7b0JBQ3ZGLE9BQU8sWUFBWSxFQUFFLENBQUM7d0JBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsQ0FBQztvQkFBQyxDQUFDO2dCQUMxRCxJQUFJLGFBQWEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7b0JBQy9CLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUM7b0JBQ3RDLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUNwRCxDQUFDO2dCQUNELElBQUksYUFBYSxDQUFDLE1BQU07b0JBQUUsTUFBTSxJQUFJLGNBQWMsQ0FBQyxDQUFDLEtBQUssRUFBRSxHQUFHLGFBQWEsQ0FBQyxFQUFFLHlDQUF5QyxDQUFDLENBQUM7Z0JBQ3pILE1BQU0sS0FBSyxDQUFDO1lBQ2QsQ0FBQztRQUNILENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDTCxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzNDLElBQUksQ0FBQztZQUFDLE9BQU8sQ0FBQyxNQUFNLElBQUksQ0FBQyxDQUFDLE9BQU8sQ0FBQztRQUFDLENBQUM7UUFDcEMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUMsQ0FBQztJQUN6RSxDQUFDO0lBRU0sZ0JBQWdCLENBQUMsT0FBZTtRQUNyQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3JELElBQUksUUFBUTtZQUFFLE9BQU8sUUFBUSxDQUFDO1FBQzlCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQzVDLElBQUksQ0FBQyxJQUFJO1lBQUUsT0FBTyxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEMsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDbEMsTUFBTSxRQUFRLEdBQUcsQ0FBQyxLQUFLLElBQUksRUFBRTtZQUMzQixJQUFJLEtBQTJCLENBQUM7WUFDaEMsSUFBSSxDQUFDO2dCQUFDLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQztZQUFDLENBQUM7WUFDM0IsTUFBTSxDQUFDLENBQUMsMEVBQTBFO2dCQUFDLE9BQU87WUFBQyxDQUFDO1lBQzVGLE1BQU0sRUFBRSxPQUFPLEVBQUUsU0FBUyxFQUFFLFVBQVUsRUFBRSxNQUFNLEVBQUUsS0FBSyxFQUFFLEdBQUcsS0FBSyxDQUFDO1lBQ2hFLE1BQU0sTUFBTSxHQUFjLEVBQUUsQ0FBQztZQUM3QixJQUFJLENBQUM7Z0JBQUMsTUFBTSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7WUFBQyxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1lBQUMsQ0FBQztZQUNwRSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQztnQkFBRSxJQUFJLENBQUM7b0JBQzVCLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQyxDQUFDO29CQUNyRixJQUFJLENBQUMsaUJBQWlCLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO29CQUN0QyxJQUFJLENBQUMsc0JBQXNCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUM5QyxDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFBQyxDQUFDO1lBQ3ZDLElBQUksQ0FBQztnQkFBQyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsQ0FBQztZQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxDQUFDO1lBQ3JHLElBQUksTUFBTSxDQUFDLE1BQU07Z0JBQUUsTUFBTSxJQUFJLGNBQWMsQ0FBQyxNQUFNLEVBQUUsd0NBQXdDLENBQUMsQ0FBQztRQUNoRyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ0wsSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDOUMsS0FBSyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsRUFBRSxHQUFHLElBQUksSUFBSSxDQUFDLGlCQUFpQixDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsS0FBSyxRQUFRO1lBQUUsSUFBSSxDQUFDLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztRQUMvSSxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRU8sS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFZLEVBQUUsTUFBd0M7UUFDekUsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDN0MsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsU0FBUyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUM3RSxNQUFNLElBQUksR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN4RCxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxJQUFJLElBQUksQ0FBQyxjQUFjLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxLQUFLLE9BQU8sQ0FBQyxNQUFNLEVBQUUsRUFBRSxFQUFFLENBQUM7WUFDcEYsTUFBTSxJQUFJLEtBQUssQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxTQUFTLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDbEQsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDbEMsTUFBTSxNQUFNLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDO1FBQy9FLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxPQUFPLENBQU8sQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7Z0JBQzFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUM3QixNQUFNLENBQUMsTUFBTSxDQUFDLElBQUksRUFBRSxHQUFHLEVBQUUsR0FBRyxNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxNQUFNLENBQUMsQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDekUsQ0FBQyxDQUFDLENBQUM7WUFDSCxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsS0FBSyxDQUFDLENBQUM7WUFDN0MsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixJQUFJLE1BQU0sQ0FBQyxTQUFTO2dCQUFFLE1BQU0sSUFBSSxPQUFPLENBQU8sT0FBTyxDQUFDLEVBQUUsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsQ0FBQztZQUN4RixNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQsc0dBQXNHO0lBQzlGLEtBQUssQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFZO1FBQ3pDLElBQUksTUFBd0IsQ0FBQztRQUM3QixJQUFJLENBQUM7WUFBQyxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQ3ZELE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDYixJQUFLLEtBQStCLENBQUMsSUFBSSxLQUFLLFFBQVE7Z0JBQUUsT0FBTztZQUMvRCxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsRUFBRSxJQUFJLE1BQU0sQ0FBQyxHQUFHLEtBQUssT0FBTyxDQUFDLE1BQU0sRUFBRSxFQUFFO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO1FBQ2xILE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxPQUFPLENBQVUsQ0FBQyxPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUU7WUFDN0QsTUFBTSxLQUFLLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUNqRCxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxHQUFHLEVBQUUsR0FBRyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDN0csS0FBSyxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsR0FBRyxFQUFFLEdBQUcsS0FBSyxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDbEUsS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLEVBQUU7Z0JBQzFCLEtBQUssQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDaEIsSUFBSyxLQUErQixDQUFDLElBQUksS0FBSyxjQUFjO29CQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQzs7b0JBQ3ZFLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNyQixDQUFDLENBQUMsQ0FBQztRQUNMLENBQUMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE9BQU87WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdEQUFnRCxDQUFDLENBQUM7UUFDaEYsTUFBTSxLQUFLLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDcEQsSUFBSSxDQUFDLEtBQUssQ0FBQyxRQUFRLEVBQUUsSUFBSSxLQUFLLENBQUMsR0FBRyxLQUFLLE1BQU0sQ0FBQyxHQUFHLElBQUksS0FBSyxDQUFDLEdBQUcsS0FBSyxNQUFNLENBQUMsR0FBRyxJQUFJLEtBQUssQ0FBQyxHQUFHLEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQzFHLE1BQU0sSUFBSSxLQUFLLENBQUMsZ0RBQWdELENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBQ0QsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDekMsQ0FBQztJQUVPLE1BQU0sQ0FBQyxNQUEwQixFQUFFLE1BQXdDO1FBQ2pGLElBQUksQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ3pCLE1BQU0sS0FBSyxHQUFHLElBQUksZUFBZSxFQUFFLENBQUM7UUFDcEMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxPQUFPLEVBQUUsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxFQUFFLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMxRSxNQUFNLEtBQUssR0FBRyxJQUFJLDhCQUE4QixFQUFFLENBQUM7UUFDbkQsSUFBSSxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ3BCLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxFQUFFLEdBQUcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1FBQ2xELE1BQU0sQ0FBQyxFQUFFLENBQUMsTUFBTSxFQUFFLEtBQUssQ0FBQyxFQUFFO1lBQ3hCLElBQUksT0FBTyxFQUFFLENBQUM7Z0JBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUFDLE9BQU87WUFBQyxDQUFDO1lBQzFDLElBQUksQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUFDLE9BQU87WUFBQyxDQUFDO1lBQzFELElBQUksS0FBb0IsQ0FBQztZQUN6QixJQUFJLENBQUM7Z0JBQUMsS0FBSyxHQUFHLEtBQUssQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxDQUFDO1lBQ2pDLE1BQU0sQ0FBQztnQkFBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQUMsT0FBTztZQUFDLENBQUM7WUFDbkMsSUFBSSxLQUFLLEtBQUssSUFBSTtnQkFBRSxPQUFPO1lBQzNCLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDZixJQUFJLE9BQXNCLENBQUM7WUFDM0IsSUFBSSxDQUFDO2dCQUFDLE9BQU8sR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBa0IsQ0FBQztZQUFDLENBQUM7WUFDckQsTUFBTSxDQUFDO2dCQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFBQyxPQUFPO1lBQUMsQ0FBQztZQUNuQyxLQUFLLE1BQU0sQ0FBQyxtQkFBbUIsQ0FBQyxPQUFPLEVBQUUsRUFBRSxnQkFBZ0IsRUFBRSxFQUFFLGVBQWUsRUFBRSxNQUFNLEVBQUU7Z0JBQ3RGLGtCQUFrQixFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztpQkFDbEMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxFQUFFO2dCQUNmLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLENBQUM7Z0JBQ3JDLElBQUksNkJBQTZCLENBQUMsR0FBRyxDQUFDLEdBQUcsZ0NBQWdDLEVBQUUsQ0FBQztvQkFBQyxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7b0JBQUMsT0FBTztnQkFBQyxDQUFDO2dCQUN4RyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsR0FBRyxJQUFJLENBQUMsQ0FBQztZQUN6QixDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDLENBQUM7UUFDckMsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLEtBQUs7UUFDaEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDcEIsTUFBTSxNQUFNLEdBQWMsRUFBRSxDQUFDO1FBQzdCLEtBQUssTUFBTSxPQUFPLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQ3BELElBQUksQ0FBQztnQkFBQyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxDQUFDO1FBQ3JGLENBQUM7UUFDRCxLQUFLLE1BQU0sUUFBUSxJQUFJLENBQUMsR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsTUFBTSxFQUFFLENBQUMsRUFBRSxDQUFDO1lBQzVELElBQUksQ0FBQztnQkFBQyxNQUFNLFFBQVEsQ0FBQztZQUFDLENBQUM7WUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO2dCQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7WUFBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLG9CQUFvQixDQUFDLENBQUM7UUFDMUMsSUFBSSxDQUFDO1lBQUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxDQUFDO1FBQUMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUN4RSxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLENBQUM7UUFDekMsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQztRQUNuQyxJQUFJLENBQUMsZ0JBQWdCLEdBQUcsU0FBUyxDQUFDO1FBQ2xDLElBQUksQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDO1FBQy9CLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE9BQU87WUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEQsS0FBSyxNQUFNLE1BQU0sSUFBSSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzNDLElBQUksTUFBTTtnQkFBRSxJQUFJLENBQUM7b0JBQ2YsTUFBTSxJQUFJLE9BQU8sQ0FBTyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO2dCQUN6RyxDQUFDO2dCQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7b0JBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFBQyxDQUFDO1FBQ3pDLENBQUM7UUFDRCxJQUFJLENBQUM7WUFBQyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7UUFBQyxDQUFDO1FBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztZQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQ3pFLElBQUksTUFBTSxDQUFDLE1BQU07WUFBRSxNQUFNLElBQUksY0FBYyxDQUFDLE1BQU0sRUFBRSwrQ0FBK0MsQ0FBQyxDQUFDO0lBQ3ZHLENBQUM7Q0FDRiJ9

package/dist_ts/classes.authoritydatabase.d.ts

@@ -0,0 +1,103 @@
+import { type IStoredAuthorityAccount, type IStoredAuthorityBinding, type IStoredAuthorityCodexHome, type IStoredAuthorityEnrollment, type IStoredAuthorityEvent, type IStoredAuthorityGrant, type IStoredAuthorityHandoff, type IStoredAuthorityMeta, type IStoredAuthorityMigrationLedger } from './classes.authoritymodels.js';
+export interface IAuthSwitchAuthorityDatabaseOptions {
+    dataDirectory: string;
+    socketPath: string;
+}
+/** Separate account, grant, binding and journal records; the only global record is a revision counter. */
+export declare class AuthSwitchAuthorityDatabase {
+    private readonly options;
+    private engine?;
+    private database?;
+    private started;
+    constructor(options: IAuthSwitchAuthorityDatabaseOptions);
+    private privateDirectory;
+    start(): Promise<void>;
+    private db;
+    private transaction;
+    readMeta(): Promise<IStoredAuthorityMeta>;
+    readAccount(id: string): Promise<IStoredAuthorityAccount | null>;
+    readBinding(id: string): Promise<IStoredAuthorityBinding | null>;
+    readCodexHome(id: string): Promise<IStoredAuthorityCodexHome | null>;
+    /** Home path identity is hashed by the caller; no vendor files or raw paths enter SmartData. */
+    reserveCodexHome(accountId: string, scopeId: string, homeId: string, updateId: string): Promise<{
+        newlyRegistered: boolean;
+    }>;
+    /** Pre-spawn claim is durable; the exact socket lets a later daemon detect a child born before PID readback. */
+    changeCodexRun(homeId: string, expectedRunId: string | null, activeRun: IStoredAuthorityCodexHome['activeRun'], updateId: string): Promise<void>;
+    /** One consistent authorization view. Callers must not combine separate binding and grant reads. */
+    readBindingContext(id: string): Promise<{
+        binding: IStoredAuthorityBinding | null;
+        account: IStoredAuthorityAccount | null;
+        grant: IStoredAuthorityGrant | null;
+    }>;
+    readGrant(id: string): Promise<IStoredAuthorityGrant | null>;
+    readEnrollment(id: string): Promise<IStoredAuthorityEnrollment | null>;
+    readHandoff(id: string): Promise<IStoredAuthorityHandoff | null>;
+    readMigrationLedger(id: string): Promise<IStoredAuthorityMigrationLedger | null>;
+    migrationLedgerByStatus(status: IStoredAuthorityMigrationLedger['status'], after: string | null, limit?: number): Promise<IStoredAuthorityMigrationLedger[]>;
+    readAccountAndPrimaryGrant(id: string): Promise<{
+        account: IStoredAuthorityAccount | null;
+        grant: IStoredAuthorityGrant | null;
+    }>;
+    page(accountAfter: string | null, bindingAfter: string | null, limit: number): Promise<{
+        meta: IStoredAuthorityMeta;
+        accounts: Array<{
+            account: IStoredAuthorityAccount;
+            grant: IStoredAuthorityGrant | null;
+        }>;
+        bindings: IStoredAuthorityBinding[];
+        nextAccountCursor: string | null;
+        nextBindingCursor: string | null;
+    }>;
+    grantsByState(state: IStoredAuthorityGrant['state'], after: string | null, limit?: number): Promise<IStoredAuthorityGrant[]>;
+    grantsForAccount(accountId: string, after: string | null, limit?: number): Promise<IStoredAuthorityGrant[]>;
+    eventsAfter(revision: number, limit?: number): Promise<IStoredAuthorityEvent[]>;
+    private appendEvent;
+    private persistAccount;
+    private persistGrant;
+    /** Atomic account/grant enrollment or reauthentication. Both records become visible together. */
+    changeAccountAndGrant(updateId: string, accountId: string, grantId: string, change: (account: IStoredAuthorityAccount | null, grant: IStoredAuthorityGrant | null) => {
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+    }): Promise<{
+        meta: IStoredAuthorityMeta;
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+    }>;
+    /** Grant transition and public account revision share a transaction and one event. */
+    changeGrant(updateId: string, grantId: string, change: (grant: IStoredAuthorityGrant, account: IStoredAuthorityAccount) => IStoredAuthorityGrant): Promise<{
+        meta: IStoredAuthorityMeta;
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+    }>;
+    /** Add a distinct per-purpose grant without replacing the account's primary grant. */
+    changeSecondaryGrant(updateId: string, accountId: string, grantId: string, change: (grant: IStoredAuthorityGrant | null, account: IStoredAuthorityAccount) => IStoredAuthorityGrant): Promise<{
+        account: IStoredAuthorityAccount;
+        grant: IStoredAuthorityGrant;
+    }>;
+    /** Remove all managed grants in one transaction; native owners must be stopped and handed off first. */
+    removeAccountAndGrants(updateId: string, accountId: string, expectedRevision: number, statusObservedAt: string): Promise<IStoredAuthorityAccount>;
+    changeAccount(updateId: string, accountId: string, change: (draft: IStoredAuthorityAccount | null) => IStoredAuthorityAccount): Promise<{
+        meta: IStoredAuthorityMeta;
+        account: IStoredAuthorityAccount;
+    }>;
+    changeBinding(updateId: string, bindingId: string, accountId: string, change: (draft: IStoredAuthorityBinding | null, account: IStoredAuthorityAccount, grant: IStoredAuthorityGrant | null) => IStoredAuthorityBinding): Promise<{
+        meta: IStoredAuthorityMeta;
+        binding: IStoredAuthorityBinding;
+    }>;
+    /** Closing an owned runtime revokes only its exact capability/incarnation. */
+    revokeBinding(updateId: string, bindingId: string, capabilityHash: string): Promise<boolean>;
+    /** Enrollment metadata is sealed by the caller and cannot become detached from an account. */
+    changeEnrollment(updateId: string, enrollmentId: string, accountId: string, change: (current: IStoredAuthorityEnrollment | null) => IStoredAuthorityEnrollment): Promise<IStoredAuthorityEnrollment>;
+    /** Journal and grant advance together; no intermediate phase may expose an active daemon grant. */
+    changeHandoffAndGrant(updateId: string, handoffId: string, grantId: string, change: (current: IStoredAuthorityHandoff | null, grant: IStoredAuthorityGrant, account: IStoredAuthorityAccount) => {
+        handoff: IStoredAuthorityHandoff;
+        grant: IStoredAuthorityGrant;
+    }): Promise<{
+        handoff: IStoredAuthorityHandoff;
+        grant: IStoredAuthorityGrant;
+    }>;
+    /** Ledger transitions never silently replace an active credential or waive backup proof. */
+    changeMigrationLedger(updateId: string, ledgerId: string, change: (current: IStoredAuthorityMigrationLedger | null) => IStoredAuthorityMigrationLedger): Promise<IStoredAuthorityMigrationLedger>;
+    stop(): Promise<void>;
+}