@modelprofile.com/authswitch 8.0.0 → 8.1.0

package/dist_ts/classes.authorityimport.js

@@ -0,0 +1,638 @@
+import * as plugins from './plugins.js';
+import { authSwitchEnvironmentId } from './classes.operations.js';
+import { AuthSwitchTpmSecretCodec } from './classes.authoritysecrets.js';
+import { ClaudeAccountStatus } from './classes.claudestatus.js';
+import { ClaudeTokenRefresh } from './classes.claudetokenrefresh.js';
+import { CodexDaemon } from './classes.codexdaemon.js';
+import { CodexHome } from './classes.codexhome.js';
+import { HarnessProcesses } from './classes.harnessprocesses.js';
+import { LegacySourceChangedError, readLegacySourceEnrollments, readLegacySourceMaterial, readLegacySources, resolveLegacySourceLocations } from './ts_migration/legacysources/index.js';
+/**
+ * What the owner must know before importing anything.
+ *
+ * The run-order line is not advice: after an account is imported, its legacy record holds a refresh token
+ * the provider has already rotated away, and the everyday legacy commands would restore or exercise exactly
+ * that record. The import is therefore only safe once those commands run on the authority.
+ */
+const INVENTORY_NOTICE = [
+    'This inventory only reads. It changes no authority record, no legacy store and no credential.',
+    'Importing transfers ownership; it does not copy. Verifying a saved authswitch record refreshes its token, '
+        + 'and the legacy copy is unusable from that moment. The fallback is one device sign-in for that account.',
+    'A native Codex, Claude or OpenCode store is projected, not imported: the native tool stays the only '
+        + 'refresher, and its record is verified by a provider read that rotates nothing.',
+    'Do not import until the everyday commands run on the authority and the native projections exist. Until '
+        + 'then a legacy command could restore or exercise a record whose token an import has already replaced.',
+    'No file under the legacy stores is deleted by an import. Retiring those files is a separate later step.',
+    'The authority store is deliberately not backed up. Losing it later loses the remote-control enrollments '
+        + 'and every runtime binding as well as the logins: each account then needs a device sign-in, and each '
+        + 'enrollment has to be paired again.',
+];
+/** Reads the host: the watch lock file, the process table and Codex's own daemon status. */
+export class AuthSwitchImportHostQuiescence {
+    authSwitchHome;
+    codexHome;
+    constructor(authSwitchHome, codexHome) {
+        this.authSwitchHome = authSwitchHome;
+        this.codexHome = codexHome;
+    }
+    watchHolderPid() {
+        // The lock is read, never acquired: an inventory or an import must not become the watch.
+        let raw;
+        try {
+            raw = plugins.fs.readFileSync(plugins.path.join(this.authSwitchHome, 'watch.lock'), 'utf8');
+        }
+        catch {
+            return null;
+        }
+        let pid;
+        try {
+            pid = JSON.parse(raw).pid;
+        }
+        catch {
+            return null;
+        }
+        if (typeof pid !== 'number' || !Number.isSafeInteger(pid) || pid <= 0)
+            return null;
+        try {
+            process.kill(pid, 0);
+            return pid;
+        }
+        catch (error) {
+            return error.code === 'EPERM' ? pid : null;
+        }
+    }
+    runningHarnessPids(binary) {
+        return new HarnessProcesses(binary).list().map(item => item.pid);
+    }
+    codexAppServerRunning() {
+        const status = new CodexDaemon(new CodexHome(this.codexHome)).status();
+        return status === null ? null : status.running;
+    }
+}
+const idHash = (...values) => plugins.crypto.createHash('sha256').update(JSON.stringify(values)).digest('hex');
+const grantPlan = (record) => {
+    if (record.sourceKind === 'claude_native') {
+        return { providerId: 'anthropic', purpose: 'claude_host_native', audience: 'claude-code-host',
+            settledOwner: 'claude_native' };
+    }
+    if (record.sourceKind === 'opencode_native') {
+        return { providerId: 'openai', purpose: 'opencode_native', audience: 'chatgpt',
+            settledOwner: 'legacy_native' };
+    }
+    if (record.sourceKind === 'codex_native') {
+        return { providerId: 'openai', purpose: 'openai_managed', audience: 'chatgpt',
+            settledOwner: 'legacy_native' };
+    }
+    return record.providerId === 'anthropic'
+        ? { providerId: 'anthropic', purpose: 'claude_host_native', audience: 'claude-code-host',
+            settledOwner: 'daemon' }
+        : { providerId: 'openai', purpose: 'openai_managed', audience: 'chatgpt', settledOwner: 'daemon' };
+};
+/** One grant per account, purpose and audience -- the same rule the device login uses. */
+const importGrantId = (accountId, plan) => idHash('authswitch-grant-v1', accountId, plan.purpose, plan.audience);
+const importHandoffId = (sourceId) => idHash('authswitch-import-handoff-v1', sourceId);
+/** The handoff phases past the pre-send marker: the exchange may already have consumed the refresh token. */
+const spentHandoffPhases = ['source_stopped', 'needs_reauth', 'aborted'];
+/**
+ * What a ledger status asks of the owner.
+ *
+ * An unsettled row is resumed by submitting the same source again -- unless its handoff got past the marker
+ * that says the sign-in exchange may have been sent, because a rotating refresh token is never sent twice.
+ * Reading the handoff here is what keeps this answer truthful: without it a source whose only remaining
+ * repair is a device sign-in would invite a submission that can only end in a quarantine.
+ */
+const importAction = (status, handoff) => {
+    if (status === 'complete')
+        return 'none';
+    if (status === 'quarantined')
+        return 'device_login';
+    return handoff !== null && spentHandoffPhases.includes(handoff.phase) ? 'device_login' : 'resume';
+};
+/** A refusal the owner can act on. It never leaves a half-written import behind. */
+export class AuthSwitchImportRefusal extends Error {
+}
+// The annotation on the binding, not only on the arrow, is what lets a refusal narrow the code after it.
+const refuse = reason => { throw new AuthSwitchImportRefusal(reason); };
+const RUN_ORDER_REFUSAL = 'Importing needs the run-order acknowledgement: an imported source\'s legacy copy '
+    + 'holds a refresh token the provider has rotated away, and the everyday legacy commands would restore or '
+    + 'exercise exactly that copy. Import only once those commands run on the authority and the native '
+    + 'projections exist.';
+/** Strips the source location: a ledger row stores its hash, and no response may carry the path. */
+const publicSource = (record, ledgerStatus) => ({
+    id: record.id,
+    sourceKind: record.sourceKind,
+    sourcePathHash: record.sourcePathHash,
+    sourceDigest: record.sourceDigest,
+    treatment: record.treatment,
+    proof: record.proof,
+    accountId: record.accountId,
+    providerId: record.providerId,
+    email: record.email,
+    plan: record.plan,
+    label: record.label,
+    accessExpiresAt: record.accessExpiresAt,
+    enrollmentCount: record.enrollmentCount,
+    ledgerStatus,
+    problems: [...record.problems],
+});
+/**
+ * The one-time account import.
+ *
+ * It reads the legacy stores through the isolated migration readers and reports them against the authority's
+ * migration ledger. Nothing here is a runtime fallback: no ordinary authority operation reaches this class,
+ * and it never writes to a legacy store.
+ */
+export class AuthSwitchAuthorityImport {
+    database;
+    env;
+    homeDirectory;
+    now;
+    openAi;
+    claudeStatus;
+    claudeTokens;
+    secrets;
+    quiescence;
+    constructor(database, options = {}) {
+        this.database = database;
+        this.env = options.env ?? process.env;
+        this.homeDirectory = options.homeDirectory ?? plugins.os.homedir();
+        this.now = options.now ?? Date.now;
+        this.openAi = options.openAi ?? new plugins.flexAccounts.OpenAiProviderAdapter();
+        this.claudeStatus = options.claudeStatus ?? new ClaudeAccountStatus();
+        this.claudeTokens = options.claudeTokens ?? new ClaudeTokenRefresh();
+        this.secrets = options.secrets ?? new AuthSwitchTpmSecretCodec();
+        const locations = resolveLegacySourceLocations(this.env, this.homeDirectory);
+        this.quiescence = options.quiescence
+            ?? new AuthSwitchImportHostQuiescence(locations.authSwitchHome, locations.codexHome);
+    }
+    /** The credential-free report. Reads the legacy stores and the ledger; writes nothing. */
+    async inventory() {
+        const now = this.now();
+        const report = readLegacySources({ env: this.env, homeDirectory: this.homeDirectory, now });
+        const sources = [];
+        for (const record of report.sources) {
+            const ledger = await this.database.readMigrationLedger(record.id);
+            const source = publicSource(record, ledger?.status ?? null);
+            if (ledger !== null && ledger.sourceDigest !== record.sourceDigest) {
+                // The source changed after its row was written. A later import must not treat the approved bytes and
+                // the current bytes as the same source; the ledger deliberately refuses to move that row.
+                source.problems.push('the source changed after its migration ledger row was written');
+            }
+            if (ledger?.status === 'complete') {
+                source.problems.push('this source is already imported; its legacy copy is retired');
+            }
+            sources.push(source);
+        }
+        return {
+            generatedAt: new Date(now).toISOString(),
+            environmentId: authSwitchEnvironmentId(this.env),
+            notice: [...INVENTORY_NOTICE],
+            sources,
+            problems: [...report.problems],
+        };
+    }
+    /**
+     * Where every source the authority knows about stands.
+     *
+     * Read from the migration ledger, the grants and the handoffs only: it opens no legacy store, so it stays
+     * truthful about what the authority decided even if a source has since been moved or deleted on the host.
+     * A source that was never submitted has no ledger row and belongs to the inventory, not here.
+     */
+    async status(request = {}) {
+        const page = await this.database.migrationLedgerPage(request.after ?? null, request.limit ?? 128);
+        const entries = [];
+        for (const row of page.rows) {
+            const grant = row.grantId === null ? null : await this.database.readGrant(row.grantId);
+            const handoff = await this.database.readHandoff(importHandoffId(row.id));
+            entries.push({
+                sourceId: row.id, sourceKind: row.sourceKind, status: row.status,
+                accountId: row.accountId, loginId: row.grantId, owner: grant?.owner ?? null,
+                action: importAction(row.status, handoff), statusObservedAt: row.statusObservedAt,
+            });
+        }
+        return { generatedAt: this.stamp(), entries, nextCursor: page.nextCursor };
+    }
+    /**
+     * Imports one source.
+     *
+     * A source whose grant the authority takes over is verified by one real refresh, which rotates its token
+     * and is the point of no return; a source a native tool keeps refreshing is verified by a provider read
+     * that rotates nothing. Every step before the refresh is durable, and the marker that says "the exchange
+     * may have been sent" is the handoff's own `source_stopped` phase: a restart that finds it never replays
+     * the grant, it asks for a device sign-in instead.
+     */
+    async submit(request) {
+        if (request.acknowledgeRunOrder !== true)
+            refuse(RUN_ORDER_REFUSAL);
+        if (request.callerQuiescent !== true) {
+            refuse('Importing needs the caller\'s assertion that nothing it owns will use this source meanwhile: '
+                + 'a host that drives the legacy library inside its own process cannot be observed from here.');
+        }
+        const record = this.resolveSource(request.submission);
+        const plan = grantPlan(record);
+        this.assertQuiescent(record);
+        const ledger = await this.database.readMigrationLedger(record.id);
+        if (ledger !== null) {
+            if (ledger.sourceDigest !== record.sourceDigest) {
+                refuse('The source changed after its migration ledger row was written; it is a different source now.');
+            }
+            if (ledger.status === 'complete')
+                refuse('This source is already imported.');
+            if (ledger.status === 'quarantined') {
+                refuse('This source is quarantined: its outcome could not be established, so it needs a device '
+                    + 'sign-in for that account rather than another import.');
+            }
+        }
+        const accountId = record.accountId;
+        const subject = record.subject;
+        const workspaceId = record.workspaceId;
+        if (accountId === null || subject === null || workspaceId === null) {
+            refuse('The source carries no provider identity the authority can bind an account to.');
+        }
+        const grantId = importGrantId(accountId, plan);
+        if (ledger === null)
+            await this.beginLedger(record);
+        const material = this.material(record, request.submission);
+        return record.treatment === 'project'
+            ? this.project(record, plan, { accountId, subject, workspaceId, grantId }, material)
+            : this.adopt(record, plan, { accountId, subject, workspaceId, grantId }, material);
+    }
+    /** The source a submission names, proven to be the one that was inventoried. */
+    resolveSource(submission) {
+        if (submission.kind === 'external') {
+            const identity = this.externalIdentity(submission.credential.idToken);
+            return {
+                id: idHash('authswitch-migration-v1', 'agl_flex', submission.sourcePathHash),
+                sourceKind: 'agl_flex', path: '', sourcePathHash: submission.sourcePathHash,
+                sourceDigest: submission.sourceDigest, treatment: 'import', proof: 'rotating_refresh',
+                accountId: identity.accountId, subject: identity.subject, workspaceId: identity.workspaceId,
+                providerId: 'openai', email: identity.email, plan: identity.plan, label: identity.email,
+                accessExpiresAt: null, enrollmentCount: null, problems: [],
+            };
+        }
+        const report = readLegacySources({ env: this.env, homeDirectory: this.homeDirectory, now: this.now() });
+        const record = report.sources.find(source => source.id === submission.sourceId);
+        if (!record)
+            refuse('That source no longer exists on this host.');
+        if (record.sourceDigest !== submission.sourceDigest) {
+            refuse('The source changed after it was inventoried; review the inventory again before importing.');
+        }
+        if (record.problems.length)
+            refuse(`The source cannot be imported: ${record.problems.join('; ')}.`);
+        if (record.treatment === 'refuse')
+            refuse('This source is not a login the authority can hold.');
+        return record;
+    }
+    externalIdentity(idToken) {
+        let info;
+        try {
+            info = plugins.flexAuth.parseOpenAiChatGptTokenInfo(idToken);
+        }
+        catch {
+            return refuse('The submitted login carries no readable ChatGPT identity.');
+        }
+        if (!info.chatgptUserId || !info.chatgptAccountId) {
+            refuse('The submitted login omits a stable ChatGPT user or account identity.');
+        }
+        return {
+            accountId: idHash('authswitch-account-v1', 'openai', info.chatgptUserId, info.chatgptAccountId),
+            subject: info.chatgptUserId, workspaceId: info.chatgptAccountId,
+            email: info.email?.toLowerCase() ?? null, plan: info.chatgptPlanType ?? null,
+        };
+    }
+    /** Reads the credential the daemon will seal. Only an external submission brings its own. */
+    material(record, submission) {
+        if (submission.kind === 'external') {
+            return { providerId: 'openai', credential: { kind: 'chatgptOAuth', providerId: 'openai',
+                    accessToken: submission.credential.accessToken, refreshToken: submission.credential.refreshToken,
+                    idToken: submission.credential.idToken } };
+        }
+        try {
+            return readLegacySourceMaterial(record);
+        }
+        catch (error) {
+            if (error instanceof LegacySourceChangedError)
+                refuse(error.message);
+            throw error;
+        }
+    }
+    /**
+     * Refuses while anything that could refresh this source is running.
+     *
+     * Unknown counts as running: an import that guessed idle could rotate a token another owner is using.
+     */
+    assertQuiescent(record) {
+        const watch = this.quiescence.watchHolderPid();
+        if (watch !== null) {
+            refuse(`An authswitch watch is running (pid ${watch}); it switches logins. Stop it and import again.`);
+        }
+        const binary = record.providerId === 'anthropic' ? 'claude'
+            : record.sourceKind === 'opencode_native' ? 'opencode' : null;
+        if (binary !== null) {
+            const pids = this.quiescence.runningHarnessPids(binary);
+            if (pids.length) {
+                refuse(`${binary} is running (pid ${pids.join(', ')}) and owns this login. Close it and import again.`);
+            }
+        }
+        if (record.sourceKind === 'codex_native'
+            || (record.sourceKind === 'authswitch_stash' && record.providerId === 'openai')) {
+            const running = this.quiescence.codexAppServerRunning();
+            if (running !== false) {
+                refuse(running === null
+                    ? 'Codex could not be asked whether its app-server is running, and an unknown app-server counts '
+                        + 'as running. Make Codex answerable and import again.'
+                    : 'The Codex app-server is running and refreshes this login on its own schedule. '
+                        + 'Stop it with `codex app-server daemon stop` and import again.');
+            }
+        }
+    }
+    async beginLedger(record) {
+        const updateId = plugins.crypto.randomUUID();
+        // Written before any provider call, so a crash always leaves the source named in the authority.
+        await this.database.changeMigrationLedger(updateId, record.id, () => ({
+            id: record.id, version: 1, sourceKind: record.sourceKind, sourcePathHash: record.sourcePathHash,
+            sourceDigest: record.sourceDigest, status: 'prepared', accountId: null, grantId: null,
+            revision: 1, statusObservedAt: this.stamp(), updateId,
+        }));
+    }
+    async moveLedger(ledgerId, status, accountId, grantId) {
+        const updateId = plugins.crypto.randomUUID();
+        return this.database.changeMigrationLedger(updateId, ledgerId, current => {
+            if (!current)
+                throw new Error('The migration ledger row disappeared during the import.');
+            return { ...current, status, accountId, grantId, revision: current.revision + 1,
+                statusObservedAt: this.stamp(), updateId };
+        });
+    }
+    stamp() { return new Date(this.now()).toISOString(); }
+    account(record, identity, plan, existing, grantId, updateId) {
+        const label = record.label ?? record.email ?? `${plan.providerId} ${identity.workspaceId}`;
+        return existing
+            ? { ...existing, label: existing.label || label, email: record.email, plan: record.plan,
+                removed: false, revision: existing.revision + 1, statusObservedAt: this.stamp(), updateId }
+            : { id: identity.accountId, providerId: plan.providerId, issuer: plan.providerId,
+                subject: identity.subject, workspaceId: identity.workspaceId, label, email: record.email,
+                plan: record.plan, primaryGrantId: grantId, removed: false, revision: 1,
+                statusObservedAt: this.stamp(), updateId };
+    }
+    /** Writes the account and its grant, choosing the primary or the secondary transaction by identity. */
+    async putGrant(identity, record, plan, grantId, make) {
+        const existingAccount = await this.database.readAccount(identity.accountId);
+        const updateId = plugins.crypto.randomUUID();
+        if (existingAccount && existingAccount.primaryGrantId !== grantId) {
+            await this.database.changeSecondaryGrant(updateId, identity.accountId, grantId, grant => make(grant, updateId));
+            return;
+        }
+        await this.database.changeAccountAndGrant(updateId, identity.accountId, grantId, (account, grant) => ({
+            account: this.account(record, identity, plan, account, grantId, updateId),
+            grant: make(grant, updateId),
+        }));
+    }
+    baseGrant(identity, plan, grantId, existing, updateId, overrides) {
+        return {
+            id: grantId, accountId: identity.accountId, providerId: plan.providerId, purpose: plan.purpose,
+            audience: plan.audience, state: 'legacy_native_pending', owner: 'legacy_native',
+            grantGeneration: existing ? existing.grantGeneration : 1,
+            authorizationGeneration: existing ? existing.authorizationGeneration : 1,
+            revision: existing ? existing.revision + 1 : 1, ciphertext: null, accessExpiresAt: null,
+            attemptId: null, retryAt: null, retryCount: 0, problem: 'native_owner',
+            statusObservedAt: this.stamp(), updateId, ...overrides,
+        };
+    }
+    /** Refuses a source whose grant another owner already holds, in either direction. */
+    assertOwnable(existing, plan) {
+        if (!existing)
+            return;
+        if (existing.owner === plan.settledOwner || existing.owner === 'none')
+            return;
+        refuse(existing.owner === 'daemon'
+            ? 'The authority already owns this login; a native store cannot take it over without a handoff.'
+            : 'A native store already owns this login. Its account is registered from that source; select it '
+                + 'there rather than importing a second copy.');
+    }
+    /**
+     * A projected source: the account is registered, the grant stays with its native owner, and the proof is a
+     * provider read that rotates nothing. No refresh is ever sent here.
+     */
+    async project(record, plan, identity, material) {
+        this.assertOwnable(await this.database.readGrant(identity.grantId), plan);
+        await this.putGrant(identity, record, plan, identity.grantId, (existing, updateId) => this.baseGrant(identity, plan, identity.grantId, existing, updateId, { state: 'native', owner: plan.settledOwner }));
+        try {
+            await this.proveWithoutRotation(record, identity, material);
+        }
+        catch (error) {
+            // Not a quarantine: no rotating token was sent here, so nothing was consumed and nothing is lost. The
+            // account stays registered with its native owner, unproven, and the same source is submitted again
+            // once that native tool has refreshed its own store -- which is exactly what the refusal asks for.
+            await this.moveLedger(record.id, 'pending_native_owner', identity.accountId, identity.grantId);
+            throw error;
+        }
+        await this.moveLedger(record.id, 'verified', identity.accountId, identity.grantId);
+        await this.moveLedger(record.id, 'complete', identity.accountId, identity.grantId);
+        return this.result(record, 'complete', identity, []);
+    }
+    /** The non-rotating proof: the stored access token is asked about itself and must name this account. */
+    async proveWithoutRotation(record, identity, material) {
+        if (material.providerId === 'openai') {
+            const result = await this.openAi.getAccountRateLimits({ kind: 'chatgptAccess',
+                providerId: 'openai', accessToken: material.credential.accessToken,
+                accountId: identity.workspaceId, isFedrampAccount: false });
+            if (!result.success) {
+                refuse(`The stored access token could not be proven live (${result.errorCode}); let the native tool `
+                    + 'refresh its own store, then import again.');
+            }
+            // The claims of the very token that answered must still name this account.
+            const claims = plugins.flexAuth.parseOpenAiChatGptTokenInfo(material.credential.accessToken);
+            if (claims.chatgptAccountId !== identity.workspaceId) {
+                refuse('The stored access token belongs to another ChatGPT account.');
+            }
+            return;
+        }
+        const oauth = material.login.claudeAiOauth;
+        const accessToken = typeof oauth.accessToken === 'string' ? oauth.accessToken : '';
+        const scopes = Array.isArray(oauth.scopes)
+            ? oauth.scopes.filter((scope) => typeof scope === 'string') : [];
+        const read = await this.claudeStatus.readDetailed({ accessToken, scopes,
+            identity: { accountUuid: identity.subject, organizationUuid: identity.workspaceId },
+            ...(record.plan === null ? {} : { plan: record.plan }) });
+        if (read.profile === 'mismatch')
+            refuse('The native Claude login belongs to another account.');
+        if (read.profile !== 'verified') {
+            refuse(`The native Claude login could not be proven live (profile ${read.profile}); let Claude Code `
+                + 'refresh its own store, then import again.');
+        }
+    }
+    /**
+     * A source the authority takes over.
+     *
+     * The handoff row is the durable record of how far this went. `source_stopped` is written before the
+     * refresh is sent, so a lost answer is always visible afterwards and is never retried.
+     */
+    async adopt(record, plan, identity, material) {
+        const handoffId = importHandoffId(record.id);
+        let handoff = await this.database.readHandoff(handoffId);
+        if (handoff === null) {
+            this.assertOwnable(await this.database.readGrant(identity.grantId), plan);
+            const ciphertext = await this.seal(identity.grantId, material);
+            await this.putGrant(identity, record, plan, identity.grantId, (existing, updateId) => this.baseGrant(identity, plan, identity.grantId, existing, updateId, { ciphertext }));
+            handoff = await this.moveHandoff(handoffId, record, identity, 'prepared', grant => ({ ...grant, state: 'legacy_native_pending' }));
+        }
+        if (handoff.phase === 'needs_reauth' || handoff.phase === 'aborted') {
+            await this.quarantine(record, identity);
+            refuse('A previous import of this source did not settle; sign in to that account again instead.');
+        }
+        if (handoff.phase === 'prepared') {
+            // The durable marker. Everything after it may have reached the provider.
+            handoff = await this.moveHandoff(handoffId, record, identity, 'source_stopped', grant => ({ ...grant, state: 'legacy_native_pending' }));
+            const rotated = await this.rotate(material);
+            if (rotated === null) {
+                await this.failHandoff(handoffId, record, identity);
+                await this.quarantine(record, identity);
+                refuse('The sign-in service did not give a usable answer, and a rotating refresh token is never '
+                    + 'sent twice. Sign in to that account again to finish this import.');
+            }
+            const ciphertext = await this.seal(identity.grantId, rotated.material);
+            handoff = await this.moveHandoff(handoffId, record, identity, 'target_written', grant => ({
+                ...grant, ciphertext, accessExpiresAt: rotated.accessExpiresAt,
+                grantGeneration: grant.grantGeneration + 1, state: 'legacy_native_pending',
+            }));
+        }
+        if (handoff.phase === 'source_stopped') {
+            // Reached only by a restart: the exchange may have been sent, so the grant is never replayed.
+            await this.failHandoff(handoffId, record, identity);
+            await this.quarantine(record, identity);
+            refuse('This import was interrupted while its sign-in was in flight. A rotating refresh token is '
+                + 'never sent twice; sign in to that account again.');
+        }
+        if (handoff.phase === 'target_written') {
+            handoff = await this.moveHandoff(handoffId, record, identity, 'verified', grant => ({ ...grant, state: 'legacy_native_pending' }));
+        }
+        if (handoff.phase === 'verified') {
+            await this.moveHandoff(handoffId, record, identity, 'committed', grant => ({
+                ...grant, state: 'ready', owner: 'daemon', problem: 'none',
+                authorizationGeneration: grant.authorizationGeneration + 1,
+            }));
+        }
+        const ledger = await this.database.readMigrationLedger(record.id);
+        if (ledger?.status !== 'verified' && ledger?.status !== 'complete') {
+            await this.moveLedger(record.id, 'verified', identity.accountId, identity.grantId);
+        }
+        await this.storeEnrollments(record, identity);
+        if ((await this.database.readMigrationLedger(record.id))?.status !== 'complete') {
+            await this.moveLedger(record.id, 'complete', identity.accountId, identity.grantId);
+        }
+        return this.result(record, 'complete', identity, []);
+    }
+    async moveHandoff(handoffId, record, identity, phase, grantChange) {
+        const updateId = plugins.crypto.randomUUID();
+        const result = await this.database.changeHandoffAndGrant(updateId, handoffId, identity.grantId, (current, grant) => ({
+            handoff: {
+                id: handoffId, accountId: identity.accountId, grantId: identity.grantId,
+                nativeHomeId: record.sourcePathHash, direction: 'to_daemon', phase,
+                operationId: current?.operationId ?? plugins.crypto.randomUUID(),
+                sourceDigest: record.sourceDigest,
+                verifiedSourceDigest: ['verified', 'committed'].includes(phase) ? record.sourceDigest
+                    : current?.verifiedSourceDigest ?? null,
+                revision: current ? current.revision + 1 : 1, statusObservedAt: this.stamp(), updateId,
+            },
+            grant: { ...grantChange(grant), revision: grant.revision + 1,
+                statusObservedAt: this.stamp(), updateId },
+        }));
+        return result.handoff;
+    }
+    async failHandoff(handoffId, record, identity) {
+        await this.moveHandoff(handoffId, record, identity, 'needs_reauth', grant => ({
+            ...grant, state: 'needs_reauth', owner: 'none', ciphertext: null, accessExpiresAt: null,
+            problem: 'exchange_uncertain',
+        }));
+    }
+    /**
+     * Marks a source whose sign-in exchange may already have been consumed. That is its only meaning, so the
+     * refusal a later submission gets needs no further reason: the repair is always a device sign-in.
+     */
+    async quarantine(record, identity) {
+        const ledger = await this.database.readMigrationLedger(record.id);
+        if (!ledger || ledger.status === 'complete' || ledger.status === 'quarantined')
+            return;
+        // A quarantined row keeps the account and grant it names, so the owner knows which account to sign in to.
+        await this.moveLedger(record.id, 'quarantined', identity.accountId, identity.grantId);
+    }
+    /**
+     * The one rotating refresh. `null` means the outcome is unknown and the grant must never be replayed.
+     *
+     * A thrown error is the same answer as a failed one: once the request left this process, whether the
+     * provider consumed the token is unknowable, so both end in a device sign-in rather than a retry.
+     */
+    async rotate(material) {
+        try {
+            return await this.rotateOnce(material);
+        }
+        catch {
+            return null;
+        }
+    }
+    async rotateOnce(material) {
+        if (material.providerId === 'openai') {
+            const result = await this.openAi.refreshCredential(material.credential);
+            if (!result.success)
+                return null;
+            let accessExpiresAt = null;
+            try {
+                accessExpiresAt = plugins.flexAuth.parseOpenAiChatGptTokenInfo(result.credential.accessToken).expiresAt ?? null;
+            }
+            catch {
+                accessExpiresAt = null;
+            }
+            return { material: { providerId: 'openai', credential: { kind: 'chatgptOAuth', providerId: 'openai',
+                        accessToken: result.credential.accessToken, refreshToken: result.credential.refreshToken,
+                        idToken: result.credential.idToken } }, accessExpiresAt };
+        }
+        const outcome = await this.claudeTokens.refreshForAuthority(material.login.claudeAiOauth);
+        if (!outcome.success)
+            return null;
+        return {
+            material: { providerId: 'anthropic', login: { ...material.login,
+                    claudeAiOauth: { ...material.login.claudeAiOauth, accessToken: outcome.tokens.accessToken,
+                        refreshToken: outcome.tokens.refreshToken, expiresAt: outcome.tokens.expiresAt,
+                        scopes: outcome.tokens.scopes } } },
+            accessExpiresAt: new Date(outcome.tokens.expiresAt).toISOString(),
+        };
+    }
+    async seal(grantId, material) {
+        const payload = material.providerId === 'openai' ? material.credential : material.login;
+        const bytes = Buffer.from(JSON.stringify(payload), 'utf8');
+        try {
+            return await this.secrets.seal(grantId, bytes);
+        }
+        finally {
+            bytes.fill(0);
+        }
+    }
+    /** Codex remote-control enrollments travel with the credential; losing them is losing a pairing. */
+    async storeEnrollments(record, identity) {
+        if (record.sourceKind !== 'authswitch_stash' || !record.enrollmentCount)
+            return;
+        const rows = readLegacySourceEnrollments(record);
+        if (!rows.length)
+            return;
+        const enrollmentId = idHash('authswitch-enrollment-v1', identity.accountId);
+        const updateId = plugins.crypto.randomUUID();
+        const bytes = Buffer.from(JSON.stringify(rows), 'utf8');
+        let ciphertext;
+        try {
+            ciphertext = await this.secrets.seal(identity.accountId, bytes);
+        }
+        finally {
+            bytes.fill(0);
+        }
+        await this.database.changeEnrollment(updateId, enrollmentId, identity.accountId, current => ({
+            id: enrollmentId, accountId: identity.accountId, ciphertext,
+            revision: current ? current.revision + 1 : 1, updateId,
+        }));
+    }
+    result(record, status, identity, problems) {
+        return { sourceId: record.id, sourceKind: record.sourceKind, treatment: record.treatment, status,
+            accountId: identity.accountId, loginId: identity.grantId, problems };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hdXRob3JpdHlpbXBvcnQuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9jbGFzc2VzLmF1dGhvcml0eWltcG9ydC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQUV4QyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsTUFBTSx5QkFBeUIsQ0FBQztBQUNsRSxPQUFPLEVBQUUsd0JBQXdCLEVBQStCLE1BQU0sK0JBQStCLENBQUM7QUFDdEcsT0FBTyxFQUFFLG1CQUFtQixFQUE2QyxNQUFNLDJCQUEyQixDQUFDO0FBQzNHLE9BQU8sRUFBRSxrQkFBa0IsRUFBc0MsTUFBTSxpQ0FBaUMsQ0FBQztBQUN6RyxPQUFPLEVBQUUsV0FBVyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDdkQsT0FBTyxFQUFFLFNBQVMsRUFBRSxNQUFNLHdCQUF3QixDQUFDO0FBQ25ELE9BQU8sRUFBRSxnQkFBZ0IsRUFBdUIsTUFBTSwrQkFBK0IsQ0FBQztBQUN0RixPQUFPLEVBQUUsd0JBQXdCLEVBQUUsMkJBQTJCLEVBQUUsd0JBQXdCLEVBQ3RGLGlCQUFpQixFQUFFLDRCQUE0QixFQUFFLE1BQU0sdUNBQXVDLENBQUM7QUFRakc7Ozs7OztHQU1HO0FBQ0gsTUFBTSxnQkFBZ0IsR0FBc0I7SUFDMUMsK0ZBQStGO0lBQy9GLDRHQUE0RztVQUMxRyx3R0FBd0c7SUFDMUcsc0dBQXNHO1VBQ3BHLGdGQUFnRjtJQUNsRix5R0FBeUc7VUFDdkcsc0dBQXNHO0lBQ3hHLHlHQUF5RztJQUN6RywwR0FBMEc7VUFDeEcsc0dBQXNHO1VBQ3RHLG9DQUFvQztDQUN2QyxDQUFDO0FBb0RGLDRGQUE0RjtBQUM1RixNQUFNLE9BQU8sOEJBQThCO0lBQ1o7SUFBeUM7SUFBdEUsWUFBNkIsY0FBc0IsRUFBbUIsU0FBaUI7UUFBMUQsbUJBQWMsR0FBZCxjQUFjLENBQVE7UUFBbUIsY0FBUyxHQUFULFNBQVMsQ0FBUTtJQUFHLENBQUM7SUFFcEYsY0FBYztRQUNuQix5RkFBeUY7UUFDekYsSUFBSSxHQUFXLENBQUM7UUFDaEIsSUFBSSxDQUFDO1lBQUMsR0FBRyxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsWUFBWSxDQUFDLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQ3BHLE1BQU0sQ0FBQztZQUFDLE9BQU8sSUFBSSxDQUFDO1FBQUMsQ0FBQztRQUN0QixJQUFJLEdBQVksQ0FBQztRQUNqQixJQUFJLENBQUM7WUFBQyxHQUFHLEdBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQTZCLENBQUMsR0FBRyxDQUFDO1FBQUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUFDLE9BQU8sSUFBSSxDQUFDO1FBQUMsQ0FBQztRQUN0RixJQUFJLE9BQU8sR0FBRyxLQUFLLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsR0FBRyxDQUFDLElBQUksR0FBRyxJQUFJLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUNuRixJQUFJLENBQUM7WUFBQyxPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUFDLE9BQU8sR0FBRyxDQUFDO1FBQUMsQ0FBQztRQUN6QyxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQUMsT0FBUSxLQUErQixDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQUMsQ0FBQztJQUMxRixDQUFDO0lBRU0sa0JBQWtCLENBQUMsTUFBc0I7UUFDOUMsT0FBTyxJQUFJLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRU0scUJBQXFCO1FBQzFCLE1BQU0sTUFBTSxHQUFHLElBQUksV0FBVyxDQUFDLElBQUksU0FBUyxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ3ZFLE9BQU8sTUFBTSxLQUFLLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0lBQ2pELENBQUM7Q0FDRjtBQVdELE1BQU0sTUFBTSxHQUFHLENBQUMsR0FBRyxNQUFnQixFQUFVLEVBQUUsQ0FDN0MsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUM7QUFFbkYsTUFBTSxTQUFTLEdBQUcsQ0FBQyxNQUE4RCxFQUFvQixFQUFFO0lBQ3JHLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUMxQyxPQUFPLEVBQUUsVUFBVSxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsUUFBUSxFQUFFLGtCQUFrQjtZQUMzRixZQUFZLEVBQUUsZUFBZSxFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxpQkFBaUIsRUFBRSxDQUFDO1FBQzVDLE9BQU8sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxRQUFRLEVBQUUsU0FBUztZQUM1RSxZQUFZLEVBQUUsZUFBZSxFQUFFLENBQUM7SUFDcEMsQ0FBQztJQUNELElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxjQUFjLEVBQUUsQ0FBQztRQUN6QyxPQUFPLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLFNBQVM7WUFDM0UsWUFBWSxFQUFFLGVBQWUsRUFBRSxDQUFDO0lBQ3BDLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQyxVQUFVLEtBQUssV0FBVztRQUN0QyxDQUFDLENBQUMsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxRQUFRLEVBQUUsa0JBQWtCO1lBQ3RGLFlBQVksRUFBRSxRQUFRLEVBQUU7UUFDMUIsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxPQUFPLEVBQUUsZ0JBQWdCLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxZQUFZLEVBQUUsUUFBUSxFQUFFLENBQUM7QUFDdkcsQ0FBQyxDQUFDO0FBRUYsMEZBQTBGO0FBQzFGLE1BQU0sYUFBYSxHQUFHLENBQUMsU0FBaUIsRUFBRSxJQUFzQixFQUFVLEVBQUUsQ0FDMUUsTUFBTSxDQUFDLHFCQUFxQixFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUN4RSxNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQWdCLEVBQVUsRUFBRSxDQUFDLE1BQU0sQ0FBQyw4QkFBOEIsRUFBRSxRQUFRLENBQUMsQ0FBQztBQUV2Ryw2R0FBNkc7QUFDN0csTUFBTSxrQkFBa0IsR0FDdEIsQ0FBQyxnQkFBZ0IsRUFBRSxjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUM7QUFFaEQ7Ozs7Ozs7R0FPRztBQUNILE1BQU0sWUFBWSxHQUFHLENBQUMsTUFBcUMsRUFDekQsT0FBdUMsRUFBMkIsRUFBRTtJQUNwRSxJQUFJLE1BQU0sS0FBSyxVQUFVO1FBQUUsT0FBTyxNQUFNLENBQUM7SUFDekMsSUFBSSxNQUFNLEtBQUssYUFBYTtRQUFFLE9BQU8sY0FBYyxDQUFDO0lBQ3BELE9BQU8sT0FBTyxLQUFLLElBQUksSUFBSSxrQkFBa0IsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQztBQUNwRyxDQUFDLENBQUM7QUFFRixvRkFBb0Y7QUFDcEYsTUFBTSxPQUFPLHVCQUF3QixTQUFRLEtBQUs7Q0FBRztBQUVyRCx5R0FBeUc7QUFDekcsTUFBTSxNQUFNLEdBQThCLE1BQU0sQ0FBQyxFQUFFLEdBQUcsTUFBTSxJQUFJLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBRW5HLE1BQU0saUJBQWlCLEdBQUcsbUZBQW1GO01BQ3pHLHlHQUF5RztNQUN6RyxrR0FBa0c7TUFDbEcsb0JBQW9CLENBQUM7QUFFekIsb0dBQW9HO0FBQ3BHLE1BQU0sWUFBWSxHQUFHLENBQUMsTUFBMkIsRUFDL0MsWUFBcUQsRUFBMkIsRUFBRSxDQUFDLENBQUM7SUFDcEYsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFO0lBQ2IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO0lBQzdCLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztJQUNyQyxZQUFZLEVBQUUsTUFBTSxDQUFDLFlBQVk7SUFDakMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTO0lBQzNCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztJQUNuQixTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7SUFDM0IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO0lBQzdCLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztJQUNuQixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7SUFDakIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLO0lBQ25CLGVBQWUsRUFBRSxNQUFNLENBQUMsZUFBZTtJQUN2QyxlQUFlLEVBQUUsTUFBTSxDQUFDLGVBQWU7SUFDdkMsWUFBWTtJQUNaLFFBQVEsRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQztDQUMvQixDQUFDLENBQUM7QUFFSDs7Ozs7O0dBTUc7QUFDSCxNQUFNLE9BQU8seUJBQXlCO0lBVVA7SUFUWixHQUFHLENBQW9CO0lBQ3ZCLGFBQWEsQ0FBUztJQUN0QixHQUFHLENBQWU7SUFDbEIsTUFBTSxDQUFvQztJQUMxQyxZQUFZLENBQWdDO0lBQzVDLFlBQVksQ0FBZ0M7SUFDNUMsT0FBTyxDQUF5QjtJQUNoQyxVQUFVLENBQThCO0lBRXpELFlBQTZCLFFBQXFDLEVBQ2hFLFVBQTZDLEVBQUU7UUFEcEIsYUFBUSxHQUFSLFFBQVEsQ0FBNkI7UUFFaEUsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDdEMsSUFBSSxDQUFDLGFBQWEsR0FBRyxPQUFPLENBQUMsYUFBYSxJQUFJLE9BQU8sQ0FBQyxFQUFFLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDbkUsSUFBSSxDQUFDLEdBQUcsR0FBRyxPQUFPLENBQUMsR0FBRyxJQUFJLElBQUksQ0FBQyxHQUFHLENBQUM7UUFDbkMsSUFBSSxDQUFDLE1BQU0sR0FBRyxPQUFPLENBQUMsTUFBTSxJQUFJLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQ2pGLElBQUksQ0FBQyxZQUFZLEdBQUcsT0FBTyxDQUFDLFlBQVksSUFBSSxJQUFJLG1CQUFtQixFQUFFLENBQUM7UUFDdEUsSUFBSSxDQUFDLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxJQUFJLElBQUksa0JBQWtCLEVBQUUsQ0FBQztRQUNyRSxJQUFJLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQyxPQUFPLElBQUksSUFBSSx3QkFBd0IsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sU0FBUyxHQUFHLDRCQUE0QixDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzdFLElBQUksQ0FBQyxVQUFVLEdBQUcsT0FBTyxDQUFDLFVBQVU7ZUFDL0IsSUFBSSw4QkFBOEIsQ0FBQyxTQUFTLENBQUMsY0FBYyxFQUFFLFNBQVMsQ0FBQyxTQUFTLENBQUMsQ0FBQztJQUN6RixDQUFDO0lBRUQsMEZBQTBGO0lBQ25GLEtBQUssQ0FBQyxTQUFTO1FBQ3BCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLE1BQU0sR0FBRyxpQkFBaUIsQ0FBQyxFQUFFLEdBQUcsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYSxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDNUYsTUFBTSxPQUFPLEdBQThCLEVBQUUsQ0FBQztRQUM5QyxLQUFLLE1BQU0sTUFBTSxJQUFJLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNwQyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ2xFLE1BQU0sTUFBTSxHQUFHLFlBQVksQ0FBQyxNQUFNLEVBQUUsTUFBTSxFQUFFLE1BQU0sSUFBSSxJQUFJLENBQUMsQ0FBQztZQUM1RCxJQUFJLE1BQU0sS0FBSyxJQUFJLElBQUksTUFBTSxDQUFDLFlBQVksS0FBSyxNQUFNLENBQUMsWUFBWSxFQUFFLENBQUM7Z0JBQ25FLHFHQUFxRztnQkFDckcsMEZBQTBGO2dCQUMxRixNQUFNLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO1lBQ3hGLENBQUM7WUFDRCxJQUFJLE1BQU0sRUFBRSxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQ2xDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7WUFDdEYsQ0FBQztZQUNELE9BQU8sQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDdkIsQ0FBQztRQUNELE9BQU87WUFDTCxXQUFXLEVBQUUsSUFBSSxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsV0FBVyxFQUFFO1lBQ3hDLGFBQWEsRUFBRSx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDO1lBQ2hELE1BQU0sRUFBRSxDQUFDLEdBQUcsZ0JBQWdCLENBQUM7WUFDN0IsT0FBTztZQUNQLFFBQVEsRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLFFBQVEsQ0FBQztTQUMvQixDQUFDO0lBQ0osQ0FBQztJQUVEOzs7Ozs7T0FNRztJQUNJLEtBQUssQ0FBQyxNQUFNLENBQUMsVUFBOEMsRUFBRTtRQUNsRSxNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLEtBQUssSUFBSSxJQUFJLEVBQUUsT0FBTyxDQUFDLEtBQUssSUFBSSxHQUFHLENBQUMsQ0FBQztRQUNsRyxNQUFNLE9BQU8sR0FBbUMsRUFBRSxDQUFDO1FBQ25ELEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzVCLE1BQU0sS0FBSyxHQUFHLEdBQUcsQ0FBQyxPQUFPLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ3ZGLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ3pFLE9BQU8sQ0FBQyxJQUFJLENBQUM7Z0JBQ1gsUUFBUSxFQUFFLEdBQUcsQ0FBQyxFQUFFLEVBQUUsVUFBVSxFQUFFLEdBQUcsQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO2dCQUNoRSxTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVMsRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU8sRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLEtBQUssSUFBSSxJQUFJO2dCQUMzRSxNQUFNLEVBQUUsWUFBWSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsR0FBRyxDQUFDLGdCQUFnQjthQUNsRixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsT0FBTyxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLEVBQUUsT0FBTyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7SUFDN0UsQ0FBQztJQUVEOzs7Ozs7OztPQVFHO0lBQ0ksS0FBSyxDQUFDLE1BQU0sQ0FBQyxPQUNTO1FBQzNCLElBQUksT0FBTyxDQUFDLG1CQUFtQixLQUFLLElBQUk7WUFBRSxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUNwRSxJQUFJLE9BQU8sQ0FBQyxlQUFlLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDckMsTUFBTSxDQUFDLCtGQUErRjtrQkFDbEcsNEZBQTRGLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdEQsTUFBTSxJQUFJLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9CLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDN0IsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNsRSxJQUFJLE1BQU0sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNwQixJQUFJLE1BQU0sQ0FBQyxZQUFZLEtBQUssTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO2dCQUNoRCxNQUFNLENBQUMsOEZBQThGLENBQUMsQ0FBQztZQUN6RyxDQUFDO1lBQ0QsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLFVBQVU7Z0JBQUUsTUFBTSxDQUFDLGtDQUFrQyxDQUFDLENBQUM7WUFDN0UsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLGFBQWEsRUFBRSxDQUFDO2dCQUNwQyxNQUFNLENBQUMseUZBQXlGO3NCQUM1RixzREFBc0QsQ0FBQyxDQUFDO1lBQzlELENBQUM7UUFDSCxDQUFDO1FBQ0QsTUFBTSxTQUFTLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQztRQUNuQyxNQUFNLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1FBQy9CLE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDdkMsSUFBSSxTQUFTLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxJQUFJLElBQUksV0FBVyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ25FLE1BQU0sQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQzFGLENBQUM7UUFDRCxNQUFNLE9BQU8sR0FBRyxhQUFhLENBQUMsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQy9DLElBQUksTUFBTSxLQUFLLElBQUk7WUFBRSxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDcEQsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzNELE9BQU8sTUFBTSxDQUFDLFNBQVMsS0FBSyxTQUFTO1lBQ25DLENBQUMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxJQUFJLEVBQUUsRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsRUFBRSxRQUFRLENBQUM7WUFDcEYsQ0FBQyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxFQUFFLElBQUksRUFBRSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxFQUFFLFFBQVEsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFFRCxnRkFBZ0Y7SUFDeEUsYUFBYSxDQUFDLFVBQXVDO1FBQzNELElBQUksVUFBVSxDQUFDLElBQUksS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUNuQyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN0RSxPQUFPO2dCQUNMLEVBQUUsRUFBRSxNQUFNLENBQUMseUJBQXlCLEVBQUUsVUFBVSxFQUFFLFVBQVUsQ0FBQyxjQUFjLENBQUM7Z0JBQzVFLFVBQVUsRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLEVBQUUsRUFBRSxjQUFjLEVBQUUsVUFBVSxDQUFDLGNBQWM7Z0JBQzNFLFlBQVksRUFBRSxVQUFVLENBQUMsWUFBWSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsS0FBSyxFQUFFLGtCQUFrQjtnQkFDckYsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPLEVBQUUsV0FBVyxFQUFFLFFBQVEsQ0FBQyxXQUFXO2dCQUMzRixVQUFVLEVBQUUsUUFBUSxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSyxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsSUFBSSxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSztnQkFDdkYsZUFBZSxFQUFFLElBQUksRUFBRSxlQUFlLEVBQUUsSUFBSSxFQUFFLFFBQVEsRUFBRSxFQUFFO2FBQzNELENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsaUJBQWlCLENBQUMsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxhQUFhLEVBQUUsSUFBSSxDQUFDLGFBQWEsRUFBRSxHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUN4RyxNQUFNLE1BQU0sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEtBQUssVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2hGLElBQUksQ0FBQyxNQUFNO1lBQUUsTUFBTSxDQUFDLDRDQUE0QyxDQUFDLENBQUM7UUFDbEUsSUFBSSxNQUFNLENBQUMsWUFBWSxLQUFLLFVBQVUsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNwRCxNQUFNLENBQUMsMkZBQTJGLENBQUMsQ0FBQztRQUN0RyxDQUFDO1FBQ0QsSUFBSSxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU07WUFBRSxNQUFNLENBQUMsa0NBQWtDLE1BQU0sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNwRyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssUUFBUTtZQUFFLE1BQU0sQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO1FBQ2hHLE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFTyxnQkFBZ0IsQ0FBQyxPQUFlO1FBRXRDLElBQUksSUFBcUUsQ0FBQztRQUMxRSxJQUFJLENBQUM7WUFBQyxJQUFJLEdBQUcsT0FBTyxDQUFDLFFBQVEsQ0FBQywyQkFBMkIsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUFDLENBQUM7UUFDckUsTUFBTSxDQUFDO1lBQUMsT0FBTyxNQUFNLENBQUMsMkRBQTJELENBQUMsQ0FBQztRQUFDLENBQUM7UUFDckYsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLElBQUksQ0FBQyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUNsRCxNQUFNLENBQUMsc0VBQXNFLENBQUMsQ0FBQztRQUNqRixDQUFDO1FBQ0QsT0FBTztZQUNMLFNBQVMsRUFBRSxNQUFNLENBQUMsdUJBQXVCLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxhQUFhLEVBQUUsSUFBSSxDQUFDLGdCQUFnQixDQUFDO1lBQy9GLE9BQU8sRUFBRSxJQUFJLENBQUMsYUFBYSxFQUFFLFdBQVcsRUFBRSxJQUFJLENBQUMsZ0JBQWdCO1lBQy9ELEtBQUssRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLFdBQVcsRUFBRSxJQUFJLElBQUksRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLGVBQWUsSUFBSSxJQUFJO1NBQzdFLENBQUM7SUFDSixDQUFDO0lBRUQsNkZBQTZGO0lBQ3JGLFFBQVEsQ0FBQyxNQUEyQixFQUMxQyxVQUF1QztRQUN2QyxJQUFJLFVBQVUsQ0FBQyxJQUFJLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDbkMsT0FBTyxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxVQUFVLEVBQUUsUUFBUTtvQkFDckYsV0FBVyxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxVQUFVLENBQUMsVUFBVSxDQUFDLFlBQVk7b0JBQ2hHLE9BQU8sRUFBRSxVQUFVLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDL0MsQ0FBQztRQUNELElBQUksQ0FBQztZQUFDLE9BQU8sd0JBQXdCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQ2hELE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDYixJQUFJLEtBQUssWUFBWSx3QkFBd0I7Z0JBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUNyRSxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLGVBQWUsQ0FBQyxNQUEyQjtRQUNqRCxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQy9DLElBQUksS0FBSyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ25CLE1BQU0sQ0FBQyx1Q0FBdUMsS0FBSyxrREFBa0QsQ0FBQyxDQUFDO1FBQ3pHLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBMEIsTUFBTSxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsQ0FBQyxDQUFDLFFBQVE7WUFDaEYsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEtBQUssaUJBQWlCLENBQUMsQ0FBQyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDO1FBQ2hFLElBQUksTUFBTSxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3BCLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDeEQsSUFBSSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ2hCLE1BQU0sQ0FBQyxHQUFHLE1BQU0sb0JBQW9CLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLG1EQUFtRCxDQUFDLENBQUM7WUFDMUcsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxVQUFVLEtBQUssY0FBYztlQUNuQyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEtBQUssa0JBQWtCLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ2xGLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMscUJBQXFCLEVBQUUsQ0FBQztZQUN4RCxJQUFJLE9BQU8sS0FBSyxLQUFLLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxDQUFDLE9BQU8sS0FBSyxJQUFJO29CQUNyQixDQUFDLENBQUMsK0ZBQStGOzBCQUM3RixxREFBcUQ7b0JBQ3pELENBQUMsQ0FBQyxnRkFBZ0Y7MEJBQzlFLCtEQUErRCxDQUFDLENBQUM7WUFDekUsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FBQyxNQUEyQjtRQUNuRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzdDLGdHQUFnRztRQUNoRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxFQUFFLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztZQUNwRSxFQUFFLEVBQUUsTUFBTSxDQUFDLEVBQUUsRUFBRSxPQUFPLEVBQUUsQ0FBQyxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYztZQUMvRixZQUFZLEVBQUUsTUFBTSxDQUFDLFlBQVksRUFBRSxNQUFNLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLElBQUk7WUFDckYsUUFBUSxFQUFFLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxJQUFJLENBQUMsS0FBSyxFQUFFLEVBQUUsUUFBUTtTQUN0RCxDQUFDLENBQUMsQ0FBQztJQUNOLENBQUM7SUFFTyxLQUFLLENBQUMsVUFBVSxDQUFDLFFBQWdCLEVBQUUsTUFBaUQsRUFDMUYsU0FBd0IsRUFBRSxPQUFzQjtRQUNoRCxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzdDLE9BQU8sSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxFQUFFO1lBQ3ZFLElBQUksQ0FBQyxPQUFPO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMseURBQXlELENBQUMsQ0FBQztZQUN6RixPQUFPLEVBQUUsR0FBRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLE9BQU8sQ0FBQyxRQUFRLEdBQUcsQ0FBQztnQkFDN0UsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDO1FBQy9DLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVPLEtBQUssS0FBYSxPQUFPLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUU5RCxPQUFPLENBQUMsTUFBMkIsRUFBRSxRQUN0QixFQUFFLElBQXNCLEVBQUUsUUFBd0MsRUFDekYsT0FBZSxFQUFFLFFBQWdCO1FBQy9CLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxLQUFLLElBQUksTUFBTSxDQUFDLEtBQUssSUFBSSxHQUFHLElBQUksQ0FBQyxVQUFVLElBQUksUUFBUSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzNGLE9BQU8sUUFBUTtZQUNiLENBQUMsQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsS0FBSyxJQUFJLEtBQUssRUFBRSxLQUFLLEVBQUUsTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7Z0JBQ3JGLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxRQUFRLEdBQUcsQ0FBQyxFQUFFLGdCQUFnQixFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRSxRQUFRLEVBQUU7WUFDN0YsQ0FBQyxDQUFDLEVBQUUsRUFBRSxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxVQUFVO2dCQUM5RSxPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU8sRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLFdBQVcsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLE1BQU0sQ0FBQyxLQUFLO2dCQUN4RixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUksRUFBRSxjQUFjLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLENBQUM7Z0JBQ3ZFLGdCQUFnQixFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQztJQUNqRCxDQUFDO0lBRUQsdUdBQXVHO0lBQy9GLEtBQUssQ0FBQyxRQUFRLENBQUMsUUFBcUUsRUFDMUYsTUFBMkIsRUFBRSxJQUFzQixFQUFFLE9BQWUsRUFDcEUsSUFBeUY7UUFDekYsTUFBTSxlQUFlLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDNUUsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM3QyxJQUFJLGVBQWUsSUFBSSxlQUFlLENBQUMsY0FBYyxLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ2xFLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxRQUFRLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxPQUFPLEVBQzVFLEtBQUssQ0FBQyxFQUFFLENBQUMsSUFBSSxDQUFDLEtBQUssRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDO1lBQ2xDLE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLHFCQUFxQixDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLE9BQU8sRUFBRSxDQUFDLE9BQU8sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDcEcsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxJQUFJLEVBQUUsT0FBTyxFQUFFLE9BQU8sRUFBRSxRQUFRLENBQUM7WUFDekUsS0FBSyxFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsUUFBUSxDQUFDO1NBQzdCLENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVPLFNBQVMsQ0FBQyxRQUErQixFQUFFLElBQXNCLEVBQUUsT0FBZSxFQUN4RixRQUFzQyxFQUFFLFFBQWdCLEVBQ3hELFNBQXlDO1FBQ3pDLE9BQU87WUFDTCxFQUFFLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVSxFQUFFLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztZQUM5RixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsdUJBQXVCLEVBQUUsS0FBSyxFQUFFLGVBQWU7WUFDL0UsZUFBZSxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN4RCx1QkFBdUIsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN4RSxRQUFRLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLFVBQVUsRUFBRSxJQUFJLEVBQUUsZUFBZSxFQUFFLElBQUk7WUFDdkYsU0FBUyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLFVBQVUsRUFBRSxDQUFDLEVBQUUsT0FBTyxFQUFFLGNBQWM7WUFDdEUsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRSxHQUFHLFNBQVM7U0FDdkQsQ0FBQztJQUNKLENBQUM7SUFFRCxxRkFBcUY7SUFDN0UsYUFBYSxDQUFDLFFBQXNDLEVBQUUsSUFBc0I7UUFDbEYsSUFBSSxDQUFDLFFBQVE7WUFBRSxPQUFPO1FBQ3RCLElBQUksUUFBUSxDQUFDLEtBQUssS0FBSyxJQUFJLENBQUMsWUFBWSxJQUFJLFFBQVEsQ0FBQyxLQUFLLEtBQUssTUFBTTtZQUFFLE9BQU87UUFDOUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssUUFBUTtZQUNoQyxDQUFDLENBQUMsOEZBQThGO1lBQ2hHLENBQUMsQ0FBQyxnR0FBZ0c7a0JBQzlGLDRDQUE0QyxDQUFDLENBQUM7SUFDdEQsQ0FBQztJQUVEOzs7T0FHRztJQUNLLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBMkIsRUFBRSxJQUFzQixFQUN2RSxRQUFzRixFQUN0RixRQUErQjtRQUMvQixJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzFFLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQ25GLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQ2pFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxLQUFLLEVBQUUsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUM7WUFBQyxNQUFNLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUNwRSxPQUFPLEtBQUssRUFBRSxDQUFDO1lBQ2Isc0dBQXNHO1lBQ3RHLG1HQUFtRztZQUNuRyxtR0FBbUc7WUFDbkcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsc0JBQXNCLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDL0YsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ25GLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuRixPQUFPLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7SUFDdkQsQ0FBQztJQUVELHdHQUF3RztJQUNoRyxLQUFLLENBQUMsb0JBQW9CLENBQUMsTUFBMkIsRUFDNUQsUUFBcUUsRUFDckUsUUFBK0I7UUFDL0IsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLElBQUksRUFBRSxlQUFlO2dCQUMzRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQUMsVUFBVSxDQUFDLFdBQVc7Z0JBQ2xFLFNBQVMsRUFBRSxRQUFRLENBQUMsV0FBVyxFQUFFLGdCQUFnQixFQUFFLEtBQUssRUFBRSxDQUFDLENBQUM7WUFDOUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDcEIsTUFBTSxDQUFDLHFEQUFxRCxNQUFNLENBQUMsU0FBUyx5QkFBeUI7c0JBQ2pHLDJDQUEyQyxDQUFDLENBQUM7WUFDbkQsQ0FBQztZQUNELDJFQUEyRTtZQUMzRSxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsUUFBUSxDQUFDLDJCQUEyQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDN0YsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLEtBQUssUUFBUSxDQUFDLFdBQVcsRUFBRSxDQUFDO2dCQUNyRCxNQUFNLENBQUMsNkRBQTZELENBQUMsQ0FBQztZQUN4RSxDQUFDO1lBQ0QsT0FBTztRQUNULENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQztRQUMzQyxNQUFNLFdBQVcsR0FBRyxPQUFPLEtBQUssQ0FBQyxXQUFXLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbkYsTUFBTSxNQUFNLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDO1lBQ3hDLENBQUMsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBbUIsRUFBRSxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDcEYsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxFQUFFLFdBQVcsRUFBRSxNQUFNO1lBQ3JFLFFBQVEsRUFBRSxFQUFFLFdBQVcsRUFBRSxRQUFRLENBQUMsT0FBTyxFQUFFLGdCQUFnQixFQUFFLFFBQVEsQ0FBQyxXQUFXLEVBQUU7WUFDbkYsR0FBRyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM1RCxJQUFJLElBQUksQ0FBQyxPQUFPLEtBQUssVUFBVTtZQUFFLE1BQU0sQ0FBQyxxREFBcUQsQ0FBQyxDQUFDO1FBQy9GLElBQUksSUFBSSxDQUFDLE9BQU8sS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUNoQyxNQUFNLENBQUMsNkRBQTZELElBQUksQ0FBQyxPQUFPLHFCQUFxQjtrQkFDakcsMkNBQTJDLENBQUMsQ0FBQztRQUNuRCxDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ssS0FBSyxDQUFDLEtBQUssQ0FBQyxNQUEyQixFQUFFLElBQXNCLEVBQ3JFLFFBQXNGLEVBQ3RGLFFBQStCO1FBQy9CLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDN0MsSUFBSSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN6RCxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztZQUNyQixJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUFDO1lBQzFFLE1BQU0sVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQy9ELE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUMsUUFBUSxFQUFFLFFBQVEsRUFBRSxFQUFFLENBQ25GLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxFQUFFLElBQUksRUFBRSxRQUFRLENBQUMsT0FBTyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDeEYsT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQ3RFLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsS0FBSyxFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLGNBQWMsSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3BFLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDeEMsTUFBTSxDQUFDLHlGQUF5RixDQUFDLENBQUM7UUFDcEcsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLEtBQUssS0FBSyxVQUFVLEVBQUUsQ0FBQztZQUNqQyx5RUFBeUU7WUFDekUsT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxnQkFBZ0IsRUFDNUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsR0FBRyxLQUFLLEVBQUUsS0FBSyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQzNELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUM1QyxJQUFJLE9BQU8sS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDckIsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQ3BELE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7Z0JBQ3hDLE1BQU0sQ0FBQywwRkFBMEY7c0JBQzdGLGtFQUFrRSxDQUFDLENBQUM7WUFDMUUsQ0FBQztZQUNELE1BQU0sVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN2RSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLFNBQVMsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLGdCQUFnQixFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztnQkFDeEYsR0FBRyxLQUFLLEVBQUUsVUFBVSxFQUFFLGVBQWUsRUFBRSxPQUFPLENBQUMsZUFBZTtnQkFDOUQsZUFBZSxFQUFFLEtBQUssQ0FBQyxlQUFlLEdBQUcsQ0FBQyxFQUFFLEtBQUssRUFBRSx1QkFBdUI7YUFDM0UsQ0FBQyxDQUFDLENBQUM7UUFDTixDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLGdCQUFnQixFQUFFLENBQUM7WUFDdkMsOEZBQThGO1lBQzlGLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQ3BELE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDeEMsTUFBTSxDQUFDLDJGQUEyRjtrQkFDOUYsa0RBQWtELENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLGdCQUFnQixFQUFFLENBQUM7WUFDdkMsT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQ3RFLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQyxFQUFFLEdBQUcsS0FBSyxFQUFFLEtBQUssRUFBRSx1QkFBdUIsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUM3RCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsS0FBSyxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ2pDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxXQUFXLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO2dCQUN6RSxHQUFHLEtBQUssRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLE1BQU07Z0JBQzFELHVCQUF1QixFQUFFLEtBQUssQ0FBQyx1QkFBdUIsR0FBRyxDQUFDO2FBQzNELENBQUMsQ0FBQyxDQUFDO1FBQ04sQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxtQkFBbUIsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEUsSUFBSSxNQUFNLEVBQUUsTUFBTSxLQUFLLFVBQVUsSUFBSSxNQUFNLEVBQUUsTUFBTSxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ25FLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQzlDLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDLEVBQUUsTUFBTSxLQUFLLFVBQVUsRUFBRSxDQUFDO1lBQ2hGLE1BQU0sSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNyRixDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO0lBQ3ZELENBQUM7SUFFTyxLQUFLLENBQUMsV0FBVyxDQUFDLFNBQWlCLEVBQUUsTUFBMkIsRUFDdEUsUUFBZ0QsRUFBRSxLQUF1QyxFQUN6RixXQUFvRTtRQUNwRSxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzdDLE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxPQUFPLEVBQzVGLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztZQUNuQixPQUFPLEVBQUU7Z0JBQ1AsRUFBRSxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLFNBQVMsRUFBRSxPQUFPLEVBQUUsUUFBUSxDQUFDLE9BQU87Z0JBQ3ZFLFlBQVksRUFBRSxNQUFNLENBQUMsY0FBYyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsS0FBSztnQkFDbEUsV0FBVyxFQUFFLE9BQU8sRUFBRSxXQUFXLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUU7Z0JBQ2hFLFlBQVksRUFBRSxNQUFNLENBQUMsWUFBWTtnQkFDakMsb0JBQW9CLEVBQUUsQ0FBQyxVQUFVLEVBQUUsV0FBVyxDQUFDLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsWUFBWTtvQkFDbkYsQ0FBQyxDQUFDLE9BQU8sRUFBRSxvQkFBb0IsSUFBSSxJQUFJO2dCQUN6QyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLGdCQUFnQixFQUFFLElBQUksQ0FBQyxLQUFLLEVBQUUsRUFBRSxRQUFRO2FBQ3ZGO1lBQ0QsS0FBSyxFQUFFLEVBQUUsR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDLEVBQUUsUUFBUSxFQUFFLEtBQUssQ0FBQyxRQUFRLEdBQUcsQ0FBQztnQkFDMUQsZ0JBQWdCLEVBQUUsSUFBSSxDQUFDLEtBQUssRUFBRSxFQUFFLFFBQVEsRUFBRTtTQUM3QyxDQUFDLENBQUMsQ0FBQztRQUNOLE9BQU8sTUFBTSxDQUFDLE9BQU8sQ0FBQztJQUN4QixDQUFDO0lBRU8sS0FBSyxDQUFDLFdBQVcsQ0FBQyxTQUFpQixFQUFFLE1BQTJCLEVBQ3RFLFFBQWdEO1FBQ2hELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxjQUFjLEVBQUUsS0FBSyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQzVFLEdBQUcsS0FBSyxFQUFFLEtBQUssRUFBRSxjQUFjLEVBQUUsS0FBSyxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsSUFBSSxFQUFFLGVBQWUsRUFBRSxJQUFJO1lBQ3ZGLE9BQU8sRUFBRSxvQkFBb0I7U0FDOUIsQ0FBQyxDQUFDLENBQUM7SUFDTixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ssS0FBSyxDQUFDLFVBQVUsQ0FBQyxNQUEyQixFQUNsRCxRQUFnRDtRQUNoRCxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ2xFLElBQUksQ0FBQyxNQUFNLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxVQUFVLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxhQUFhO1lBQUUsT0FBTztRQUN2RiwwR0FBMEc7UUFDMUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sQ0FBQyxFQUFFLEVBQUUsYUFBYSxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3hGLENBQUM7SUFFRDs7Ozs7T0FLRztJQUNLLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBK0I7UUFFbEQsSUFBSSxDQUFDO1lBQUMsT0FBTyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUM7UUFBQyxDQUFDO1FBQy9DLE1BQU0sQ0FBQztZQUFDLE9BQU8sSUFBSSxDQUFDO1FBQUMsQ0FBQztJQUN4QixDQUFDO0lBRU8sS0FBSyxDQUFDLFVBQVUsQ0FBQyxRQUErQjtRQUV0RCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDckMsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUN4RSxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU87Z0JBQUUsT0FBTyxJQUFJLENBQUM7WUFDakMsSUFBSSxlQUFlLEdBQWtCLElBQUksQ0FBQztZQUMxQyxJQUFJLENBQUM7Z0JBQUMsZUFBZSxHQUFHLE9BQU8sQ0FBQyxRQUFRLENBQUMsMkJBQTJCLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxXQUFXLENBQUMsQ0FBQyxTQUFTLElBQUksSUFBSSxDQUFDO1lBQUMsQ0FBQztZQUN4SCxNQUFNLENBQUM7Z0JBQUMsZUFBZSxHQUFHLElBQUksQ0FBQztZQUFDLENBQUM7WUFDakMsT0FBTyxFQUFFLFFBQVEsRUFBRSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLGNBQWMsRUFBRSxVQUFVLEVBQUUsUUFBUTt3QkFDakcsV0FBVyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFlBQVk7d0JBQ3hGLE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLEVBQUUsZUFBZSxFQUFFLENBQUM7UUFDOUQsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLGFBQWEsQ0FBQyxDQUFDO1FBQzFGLElBQUksQ0FBQyxPQUFPLENBQUMsT0FBTztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ2xDLE9BQU87WUFDTCxRQUFRLEVBQUUsRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLEtBQUssRUFBRSxFQUFFLEdBQUcsUUFBUSxDQUFDLEtBQUs7b0JBQzdELGFBQWEsRUFBRSxFQUFFLEdBQUcsUUFBUSxDQUFDLEtBQUssQ0FBQyxhQUFhLEVBQUUsV0FBVyxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVzt3QkFDdkYsWUFBWSxFQUFFLE9BQU8sQ0FBQyxNQUFNLENBQUMsWUFBWSxFQUFFLFNBQVMsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFNBQVM7d0JBQzlFLE1BQU0sRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxFQUFFLEVBQUU7WUFDdkMsZUFBZSxFQUFFLElBQUksSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsV0FBVyxFQUFFO1NBQ2xFLENBQUM7SUFDSixDQUFDO0lBRU8sS0FBSyxDQUFDLElBQUksQ0FBQyxPQUFlLEVBQUUsUUFBK0I7UUFDakUsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLFVBQVUsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUM7UUFDeEYsTUFBTSxLQUFLLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLE9BQU8sQ0FBQyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzNELElBQUksQ0FBQztZQUFDLE9BQU8sTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFBQyxDQUFDO2dCQUMvQyxDQUFDO1lBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUFDLENBQUM7SUFDNUIsQ0FBQztJQUVELG9HQUFvRztJQUM1RixLQUFLLENBQUMsZ0JBQWdCLENBQUMsTUFBMkIsRUFDeEQsUUFBK0I7UUFDL0IsSUFBSSxNQUFNLENBQUMsVUFBVSxLQUFLLGtCQUFrQixJQUFJLENBQUMsTUFBTSxDQUFDLGVBQWU7WUFBRSxPQUFPO1FBQ2hGLE1BQU0sSUFBSSxHQUFHLDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2pELElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTTtZQUFFLE9BQU87UUFDekIsTUFBTSxZQUFZLEdBQUcsTUFBTSxDQUFDLDBCQUEwQixFQUFFLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM1RSxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxDQUFDO1FBQzdDLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUN4RCxJQUFJLFVBQWtCLENBQUM7UUFDdkIsSUFBSSxDQUFDO1lBQUMsVUFBVSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUFDLENBQUM7Z0JBQ2hFLENBQUM7WUFBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQUMsQ0FBQztRQUMxQixNQUFNLElBQUksQ0FBQyxRQUFRLENBQUMsZ0JBQWdCLENBQUMsUUFBUSxFQUFFLFlBQVksRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUMzRixFQUFFLEVBQUUsWUFBWSxFQUFFLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUyxFQUFFLFVBQVU7WUFDM0QsUUFBUSxFQUFFLE9BQU8sQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxRQUFRO1NBQ3ZELENBQUMsQ0FBQyxDQUFDO0lBQ04sQ0FBQztJQUVPLE1BQU0sQ0FBQyxNQUEyQixFQUFFLE1BQXlDLEVBQ25GLFFBQWdELEVBQUUsUUFBa0I7UUFDcEUsT0FBTyxFQUFFLFFBQVEsRUFBRSxNQUFNLENBQUMsRUFBRSxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLE1BQU07WUFDOUYsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTLEVBQUUsT0FBTyxFQUFFLFFBQVEsQ0FBQyxPQUFPLEVBQUUsUUFBUSxFQUFFLENBQUM7SUFDekUsQ0FBQztDQUNGIn0=