@modelprofile.com/authswitch 9.1.0 → 10.0.0

package/dist_ts/interfaces.openai.d.ts

@@ -0,0 +1,118 @@
+/**
+ * The ChatGPT account types authswitch owns: the sign-in it runs, the credential it holds and refreshes, and the
+ * credential-free readings it takes. Inference with an access token is FlexHarness's `/openai`, not this.
+ */
+/** Whether a failed request reached the provider: `notSent` never did, `outcomeUnknown` may have. */
+export type TOpenAiRequestOutcome = 'notSent' | 'outcomeUnknown';
+/**
+ * A ChatGPT sign-in with its rotating refresh token. This exact shape is what the authority seals, so a stored
+ * credential keeps reading back across releases.
+ */
+export interface IOpenAiOAuthCredential {
+    kind: 'chatgptOAuth';
+    providerId: 'openai';
+    accessToken: string;
+    refreshToken: string;
+    idToken: string;
+    /** When this credential was last refreshed; strictly increasing across refreshes. */
+    lastRefreshAt?: string;
+}
+/** Access to one ChatGPT workspace, with the workspace and residency its issuer states. */
+export interface IOpenAiAccess {
+    accessToken: string;
+    accountId: string;
+    isFedrampAccount: boolean;
+}
+/** What a sign-in's claims say about its account; no token. */
+export interface IOpenAiAccountSummary {
+    providerId: 'openai';
+    authKind: 'chatgptOAuth';
+    accountId?: string;
+    email?: string;
+    plan?: string;
+}
+export interface IOpenAiProviderDescriptor {
+    providerId: 'openai';
+    displayName: string;
+    loginFlows: readonly ['device'];
+}
+/** What the person signing in does: open the URL and enter the code. */
+export interface IOpenAiDevicePrompt {
+    flow: 'device';
+    verificationUrl: string;
+    userCode: string;
+}
+export interface IOpenAiLoginResult {
+    credential: IOpenAiOAuthCredential;
+    account: IOpenAiAccountSummary;
+}
+export type TOpenAiLoginCancelStatus = 'canceled' | 'notFound';
+/** One device sign-in in flight. `completion` settles once the person approved it, or it failed or was cancelled. */
+export interface IOpenAiLoginHandle {
+    readonly prompt: IOpenAiDevicePrompt;
+    readonly completion: Promise<IOpenAiLoginResult>;
+    cancel(): Promise<TOpenAiLoginCancelStatus>;
+    close(): Promise<void>;
+}
+export interface IOpenAiOperationOptions {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+}
+export interface IOpenAiLoginOptions extends IOpenAiOperationOptions {
+    flow: 'device';
+}
+export type TOpenAiOperationErrorCode = 'ABORTED' | 'TIMEOUT';
+export interface IOpenAiRefreshSuccess {
+    success: true;
+    credential: IOpenAiOAuthCredential;
+    account: IOpenAiAccountSummary;
+}
+export interface IOpenAiRefreshFailure {
+    success: false;
+    credential: IOpenAiOAuthCredential;
+    errorCode: TOpenAiOperationErrorCode | 'REFRESH_FAILED';
+    /** Never replay a rotating grant when this is `outcomeUnknown`. */
+    requestOutcome: TOpenAiRequestOutcome;
+    /** The response status, when an HTTP response was observed. */
+    responseStatus?: number;
+    /** Bounded Retry-After delay from the observed response. */
+    retryAfterMs?: number;
+}
+export type TOpenAiRefreshResult = IOpenAiRefreshSuccess | IOpenAiRefreshFailure;
+export interface IOpenAiRateLimitWindow {
+    usedPercent: number;
+    limitWindowSeconds: number;
+    resetAfterSeconds: number;
+    /** Unix timestamp in seconds. */
+    resetsAt: number;
+}
+export interface IOpenAiRateLimitDetails {
+    allowed: boolean;
+    limitReached: boolean;
+    primaryWindow?: IOpenAiRateLimitWindow;
+    secondaryWindow?: IOpenAiRateLimitWindow;
+}
+export interface IOpenAiAdditionalRateLimit {
+    limitName: string;
+    meteredFeature: string;
+    rateLimit?: IOpenAiRateLimitDetails;
+}
+/** An account's usage limits as `wham/usage` reports them, credential-free; the authority stores this shape. */
+export interface IOpenAiAccountRateLimits {
+    providerId: 'openai';
+    plan: string;
+    observedAt: string;
+    rateLimit?: IOpenAiRateLimitDetails;
+    additionalRateLimits: IOpenAiAdditionalRateLimit[];
+    rateLimitReachedType?: string;
+    rateLimitResetCreditsAvailableCount?: number;
+}
+export interface IOpenAiAccountRateLimitsSuccess {
+    success: true;
+    rateLimits: IOpenAiAccountRateLimits;
+}
+export interface IOpenAiAccountRateLimitsFailure {
+    success: false;
+    errorCode: TOpenAiOperationErrorCode | 'CREDENTIAL_REFRESH_REQUIRED' | 'ACCOUNT_RATE_LIMITS_FAILED';
+}
+export type TOpenAiAccountRateLimitsResult = IOpenAiAccountRateLimitsSuccess | IOpenAiAccountRateLimitsFailure;

package/dist_ts/interfaces.openai.js

@@ -0,0 +1,3 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW50ZXJmYWNlcy5vcGVuYWkuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9pbnRlcmZhY2VzLm9wZW5haS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSwySkFBMkoifQ==

package/dist_ts/openaiauth.d.ts

@@ -0,0 +1,76 @@
+import type { TOpenAiRequestOutcome } from './interfaces.openai.js';
+/**
+ * The ChatGPT sign-in protocol Codex uses (`codex-rs/login`: `device_code_auth.rs`, `auth/manager.rs`,
+ * `auth/revoke.rs`, `oauth/client.rs`), which the authority runs as the one party that signs in and refreshes:
+ * the device code, its poll, the authorization-code exchange, the refresh-token grant, the revocation and the
+ * claims of the tokens. Every failure is a fixed message: no response body, token or header crosses an error.
+ */
+export declare const OPENAI_AUTH_ISSUER = "https://auth.openai.com";
+export declare const OPENAI_AUTH_CLIENT_ID = "app_EMoamEEZ73f0CkXaXp7hrann";
+export declare class OpenAiAuthError extends Error {
+    readonly status?: number;
+    readonly requestOutcome?: TOpenAiRequestOutcome;
+    readonly retryAfterMs?: number;
+    constructor(message: string, options?: {
+        status?: number;
+        requestOutcome?: TOpenAiRequestOutcome;
+        retryAfterMs?: number;
+    });
+}
+export interface IOpenAiAuthOptions {
+    fetch?: typeof fetch;
+    /** Aborts network requests and device-code polling. */
+    signal?: AbortSignal;
+}
+export interface IOpenAiDeviceCodePollOptions extends IOpenAiAuthOptions {
+    timeoutMs?: number;
+    sleep?: (ms: number) => Promise<void>;
+}
+/** What the claims of a ChatGPT token say about its account; never the token itself. */
+export interface IOpenAiTokenClaims {
+    email?: string;
+    chatgptPlanType?: string;
+    chatgptUserId?: string;
+    chatgptAccountId?: string;
+    chatgptAccountIsFedramp: boolean;
+    expiresAt?: string;
+}
+export interface IOpenAiDeviceCode {
+    verificationUrl: string;
+    userCode: string;
+    deviceAuthId: string;
+    intervalSeconds: number;
+}
+export interface IOpenAiDeviceAuthorization {
+    authorizationCode: string;
+    codeChallenge: string;
+    codeVerifier: string;
+}
+/** The tokens one exchange or refresh produced, with the claims of the ID token (or access token). */
+export interface IOpenAiTokenSet {
+    accessToken: string;
+    refreshToken: string;
+    idToken?: string;
+    claims: IOpenAiTokenClaims;
+}
+/** Reads the account claims of a ChatGPT ID or access token. Throws `OpenAiAuthError` for anything but a JWT. */
+export declare const parseOpenAiTokenClaims: (token: string) => IOpenAiTokenClaims;
+/** Starts a device sign-in (`POST {issuer}/api/accounts/deviceauth/usercode`). */
+export declare const requestOpenAiDeviceCode: (options?: IOpenAiAuthOptions) => Promise<IOpenAiDeviceCode>;
+/**
+ * Polls until the person approved the sign-in (`POST {issuer}/api/accounts/deviceauth/token`): 403 and 404 mean
+ * pending, as in Codex, and the poll gives up after at most fifteen minutes.
+ */
+export declare const pollOpenAiDeviceCode: (deviceCode: IOpenAiDeviceCode, options?: IOpenAiDeviceCodePollOptions) => Promise<IOpenAiDeviceAuthorization>;
+/** Exchanges an approved device sign-in for tokens (`POST {issuer}/oauth/token`, PKCE, form-encoded). */
+export declare const exchangeOpenAiDeviceAuthorization: (authorization: IOpenAiDeviceAuthorization, options?: IOpenAiAuthOptions) => Promise<IOpenAiTokenSet>;
+/**
+ * Sends one refresh-token grant (`POST {issuer}/oauth/token`, JSON). A response without a new refresh token keeps
+ * the one that was sent, as Codex does.
+ */
+export declare const refreshOpenAiTokens: (tokens: IOpenAiTokenSet, options?: IOpenAiAuthOptions) => Promise<IOpenAiTokenSet>;
+/**
+ * Revokes a refresh token (`POST {issuer}/oauth/revoke`, JSON), as Codex does when it logs out: the grant then
+ * refreshes nothing anywhere. It resolves only once the service accepted the revocation.
+ */
+export declare const revokeOpenAiRefreshToken: (refreshToken: string, options?: IOpenAiAuthOptions) => Promise<void>;

package/dist_ts/openaiauth.js

@@ -0,0 +1,371 @@
+// OpenAI protocol portions are adapted in TypeScript from OpenAI Codex (Apache-2.0) and modified by Task Venture Capital GmbH; see third-party-notices.md.
+/**
+ * The ChatGPT sign-in protocol Codex uses (`codex-rs/login`: `device_code_auth.rs`, `auth/manager.rs`,
+ * `auth/revoke.rs`, `oauth/client.rs`), which the authority runs as the one party that signs in and refreshes:
+ * the device code, its poll, the authorization-code exchange, the refresh-token grant, the revocation and the
+ * claims of the tokens. Every failure is a fixed message: no response body, token or header crosses an error.
+ */
+export const OPENAI_AUTH_ISSUER = 'https://auth.openai.com';
+export const OPENAI_AUTH_CLIENT_ID = 'app_EMoamEEZ73f0CkXaXp7hrann';
+const DEVICE_CODE_TIMEOUT_MS = 15 * 60 * 1000;
+/** Codex's `REVOKE_HTTP_TIMEOUT`. */
+const REVOKE_TIMEOUT_MS = 10_000;
+const MAX_RESPONSE_BYTES = 64 * 1024;
+const MAX_TOKEN_BYTES = 16 * 1024;
+const MAX_AUTHORIZATION_CODE_BYTES = 8 * 1024;
+const MAX_IDENTIFIER_BYTES = 1024;
+const REQUEST_TIMEOUT_MS = 30_000;
+const textEncoder = new TextEncoder();
+const textDecoder = new TextDecoder();
+const utf8ByteLength = (valueArg) => textEncoder.encode(valueArg).byteLength;
+export class OpenAiAuthError extends Error {
+    status;
+    requestOutcome;
+    retryAfterMs;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = 'OpenAiAuthError';
+        this.status = options.status;
+        this.requestOutcome = options.requestOutcome;
+        this.retryAfterMs = options.retryAfterMs;
+    }
+}
+const getFetch = (options) => {
+    const fetchFunction = options.fetch ?? globalThis.fetch;
+    if (!fetchFunction)
+        throw new OpenAiAuthError('fetch is not available for OpenAI authentication.');
+    return fetchFunction;
+};
+const throwIfAborted = (options) => {
+    if (options.signal?.aborted)
+        throw new OpenAiAuthError('OpenAI authentication was aborted.');
+};
+const asString = (value, name, maximumBytes = MAX_IDENTIFIER_BYTES) => {
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new OpenAiAuthError(`OpenAI auth response is missing ${name}.`);
+    }
+    if (utf8ByteLength(value) > maximumBytes)
+        throw new OpenAiAuthError(`OpenAI auth response contains an invalid ${name}.`);
+    return value;
+};
+const asOptionalString = (value, maximumBytes = MAX_IDENTIFIER_BYTES) => {
+    if (typeof value !== 'string' || value.length === 0)
+        return undefined;
+    if (utf8ByteLength(value) > maximumBytes)
+        throw new OpenAiAuthError('OpenAI auth response contains an oversized string.');
+    return value;
+};
+/** Codex reads the interval as a string (`deserialize_interval`); both a number and a numeric string are taken. */
+const asIntervalSeconds = (value) => {
+    const interval = typeof value === 'number' ? value : Number.parseInt(String(value ?? ''), 10);
+    if (!Number.isFinite(interval) || interval <= 0 || interval > 300) {
+        throw new OpenAiAuthError('OpenAI device-code response has an invalid interval.');
+    }
+    return interval;
+};
+const readResponseText = async (response, options) => {
+    const contentLength = response.headers.get('content-length');
+    if (contentLength !== null && (!/^\d+$/.test(contentLength) || Number(contentLength) > MAX_RESPONSE_BYTES)) {
+        await response.body?.cancel().catch(() => undefined);
+        throw new OpenAiAuthError('OpenAI auth response exceeded its size limit.', { status: response.status });
+    }
+    if (!response.body)
+        return '';
+    const reader = response.body.getReader();
+    const chunks = [];
+    let byteLength = 0;
+    let completed = false;
+    const onAbort = () => { void reader.cancel().catch(() => undefined); };
+    options.signal?.addEventListener('abort', onAbort, { once: true });
+    if (options.signal?.aborted)
+        onAbort();
+    try {
+        while (true) {
+            throwIfAborted(options);
+            const { done, value } = await reader.read();
+            throwIfAborted(options);
+            if (done)
+                break;
+            byteLength += value.byteLength;
+            if (byteLength > MAX_RESPONSE_BYTES) {
+                await reader.cancel().catch(() => undefined);
+                throw new OpenAiAuthError('OpenAI auth response exceeded its size limit.', { status: response.status });
+            }
+            chunks.push(value);
+        }
+        completed = true;
+    }
+    finally {
+        options.signal?.removeEventListener('abort', onAbort);
+        if (!completed)
+            void reader.cancel().catch(() => undefined);
+        reader.releaseLock();
+    }
+    const bytes = new Uint8Array(byteLength);
+    let offset = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.byteLength;
+    }
+    return textDecoder.decode(bytes);
+};
+const readJson = async (response, context, options) => {
+    const body = await readResponseText(response, options);
+    if (!response.ok)
+        throw new OpenAiAuthError(`${context} failed with status ${response.status}.`, { status: response.status });
+    try {
+        return body ? JSON.parse(body) : {};
+    }
+    catch {
+        throw new OpenAiAuthError(`${context} returned invalid JSON.`, { status: response.status });
+    }
+};
+const parseRetryAfterMs = (header) => {
+    if (!header || header.length > 128)
+        return undefined;
+    const maximumDelayMs = 24 * 60 * 60 * 1000;
+    if (/^\d{1,10}$/.test(header))
+        return Math.min(Number(header) * 1000, maximumDelayMs);
+    const retryAt = Date.parse(header);
+    if (!Number.isFinite(retryAt))
+        return undefined;
+    return Math.min(Math.max(0, retryAt - Date.now()), maximumDelayMs);
+};
+/**
+ * One bounded request. Its failure says whether the request was handed to fetch at all: a refresh whose outcome
+ * is `outcomeUnknown` may have rotated the grant and is never sent again.
+ */
+const runFetch = async (url, init, options, handle, timeoutMs = REQUEST_TIMEOUT_MS) => {
+    if (options.signal?.aborted) {
+        throw new OpenAiAuthError('OpenAI authentication was aborted.', { requestOutcome: 'notSent' });
+    }
+    const controller = new AbortController();
+    let response;
+    let requestStarted = false;
+    const onExternalAbort = () => controller.abort();
+    const onRequestAbort = () => { void response?.body?.cancel().catch(() => undefined); };
+    options.signal?.addEventListener('abort', onExternalAbort, { once: true });
+    let rejectOnAbort;
+    const aborted = new Promise((_resolve, reject) => {
+        rejectOnAbort = () => reject(new Error('OpenAI authentication request aborted.'));
+        controller.signal.addEventListener('abort', rejectOnAbort, { once: true });
+    });
+    controller.signal.addEventListener('abort', onRequestAbort, { once: true });
+    if (options.signal?.aborted)
+        controller.abort();
+    const timer = setTimeout(() => controller.abort(), Math.min(timeoutMs, REQUEST_TIMEOUT_MS));
+    const requestOptions = { ...options, signal: controller.signal };
+    try {
+        return await Promise.race([
+            (async () => {
+                const fetchImplementation = getFetch(options);
+                requestStarted = true;
+                response = await fetchImplementation(url, { ...init, redirect: 'error', signal: controller.signal });
+                if (controller.signal.aborted)
+                    await response.body?.cancel().catch(() => undefined);
+                throwIfAborted(requestOptions);
+                return handle(response, requestOptions);
+            })(),
+            aborted,
+        ]);
+    }
+    catch (error) {
+        const requestOutcome = requestStarted ? 'outcomeUnknown' : 'notSent';
+        const retryAfterMs = response ? parseRetryAfterMs(response.headers.get('retry-after')) : undefined;
+        const status = error instanceof OpenAiAuthError && error.status !== undefined ? error.status : response?.status;
+        throw new OpenAiAuthError(error instanceof OpenAiAuthError ? error.message
+            : options.signal?.aborted ? 'OpenAI authentication was aborted.' : 'OpenAI authentication request failed.', {
+            requestOutcome,
+            ...(status !== undefined ? { status } : {}),
+            ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+        });
+    }
+    finally {
+        clearTimeout(timer);
+        options.signal?.removeEventListener('abort', onExternalAbort);
+        controller.signal.removeEventListener('abort', rejectOnAbort);
+        controller.signal.removeEventListener('abort', onRequestAbort);
+    }
+};
+const postJson = (url, body, options) => runFetch(url, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) }, options, (response, requestOptions) => readJson(response, `POST ${url}`, requestOptions));
+const postForm = (url, body, options) => runFetch(url, { method: 'POST', headers: { 'Content-Type': 'application/x-www-form-urlencoded' }, body: body.toString() }, options, (response, requestOptions) => readJson(response, `POST ${url}`, requestOptions));
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+const sleepWithAbort = async (milliseconds, options) => {
+    throwIfAborted(options);
+    const signal = options.signal;
+    if (!signal) {
+        await (options.sleep ?? sleep)(milliseconds);
+        return;
+    }
+    let abortListener;
+    let timer;
+    try {
+        await Promise.race([
+            options.sleep ? options.sleep(milliseconds) : new Promise(resolve => { timer = setTimeout(resolve, milliseconds); }),
+            new Promise((_resolve, reject) => {
+                abortListener = () => reject(new OpenAiAuthError('OpenAI authentication was aborted.'));
+                signal.addEventListener('abort', abortListener, { once: true });
+                if (signal.aborted)
+                    abortListener();
+            }),
+        ]);
+    }
+    finally {
+        if (timer)
+            clearTimeout(timer);
+        if (abortListener)
+            signal.removeEventListener('abort', abortListener);
+    }
+};
+const parseJwtPayload = (jwt) => {
+    const parts = jwt.split('.');
+    if (parts.length !== 3 || !parts[1])
+        throw new OpenAiAuthError('OpenAI auth returned an invalid token.');
+    try {
+        const base64 = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        const binary = atob(base64.padEnd(Math.ceil(base64.length / 4) * 4, '='));
+        const value = JSON.parse(textDecoder.decode(Uint8Array.from(binary, character => character.charCodeAt(0))));
+        if (value === null || typeof value !== 'object' || Array.isArray(value))
+            throw new Error();
+        return value;
+    }
+    catch {
+        throw new OpenAiAuthError('OpenAI token claims could not be parsed.');
+    }
+};
+const claimRecord = (value) => value !== null && typeof value === 'object' && !Array.isArray(value) ? value : undefined;
+/** Reads the account claims of a ChatGPT ID or access token. Throws `OpenAiAuthError` for anything but a JWT. */
+export const parseOpenAiTokenClaims = (token) => {
+    const claims = parseJwtPayload(token);
+    const profile = claimRecord(claims['https://api.openai.com/profile']);
+    const auth = claimRecord(claims['https://api.openai.com/auth']);
+    const expiresAtSeconds = typeof claims.exp === 'number' ? claims.exp : undefined;
+    return {
+        email: asOptionalString(claims.email) ?? asOptionalString(profile?.email),
+        chatgptPlanType: asOptionalString(auth?.chatgpt_plan_type),
+        chatgptUserId: asOptionalString(auth?.chatgpt_user_id) ?? asOptionalString(auth?.user_id),
+        chatgptAccountId: asOptionalString(auth?.chatgpt_account_id),
+        chatgptAccountIsFedramp: auth?.chatgpt_account_is_fedramp === true,
+        expiresAt: expiresAtSeconds !== undefined ? new Date(expiresAtSeconds * 1000).toISOString() : undefined,
+    };
+};
+const createTokenSet = (response, existing) => {
+    const accessToken = asOptionalString(response.access_token, MAX_TOKEN_BYTES) ?? existing?.accessToken;
+    const refreshToken = asOptionalString(response.refresh_token, MAX_TOKEN_BYTES) ?? existing?.refreshToken;
+    const idToken = asOptionalString(response.id_token, MAX_TOKEN_BYTES) ?? existing?.idToken;
+    if (!accessToken)
+        throw new OpenAiAuthError('OpenAI auth response is missing access_token.');
+    if (!refreshToken)
+        throw new OpenAiAuthError('OpenAI auth response is missing refresh_token.');
+    let claims;
+    try {
+        claims = parseOpenAiTokenClaims(idToken ?? accessToken);
+    }
+    catch {
+        throw new OpenAiAuthError('OpenAI auth returned an invalid token.');
+    }
+    return { accessToken, refreshToken, ...(idToken ? { idToken } : {}), claims };
+};
+/** Starts a device sign-in (`POST {issuer}/api/accounts/deviceauth/usercode`). */
+export const requestOpenAiDeviceCode = async (options = {}) => {
+    const response = await postJson(`${OPENAI_AUTH_ISSUER}/api/accounts/deviceauth/usercode`, { client_id: OPENAI_AUTH_CLIENT_ID }, options);
+    return {
+        verificationUrl: `${OPENAI_AUTH_ISSUER}/codex/device`,
+        userCode: asString(response.user_code ?? response.usercode, 'user_code'),
+        deviceAuthId: asString(response.device_auth_id, 'device_auth_id'),
+        intervalSeconds: asIntervalSeconds(response.interval),
+    };
+};
+/**
+ * Polls until the person approved the sign-in (`POST {issuer}/api/accounts/deviceauth/token`): 403 and 404 mean
+ * pending, as in Codex, and the poll gives up after at most fifteen minutes.
+ */
+export const pollOpenAiDeviceCode = async (deviceCode, options = {}) => {
+    const pollUrl = `${OPENAI_AUTH_ISSUER}/api/accounts/deviceauth/token`;
+    const timeoutMs = options.timeoutMs ?? DEVICE_CODE_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > DEVICE_CODE_TIMEOUT_MS) {
+        throw new OpenAiAuthError('OpenAI device-code timeout is invalid.');
+    }
+    if (utf8ByteLength(deviceCode.deviceAuthId) > MAX_IDENTIFIER_BYTES
+        || utf8ByteLength(deviceCode.userCode) > MAX_IDENTIFIER_BYTES
+        || !Number.isSafeInteger(deviceCode.intervalSeconds) || deviceCode.intervalSeconds < 1
+        || deviceCode.intervalSeconds > 300) {
+        throw new OpenAiAuthError('OpenAI device-code input is invalid.');
+    }
+    const startedAt = Date.now();
+    while (Date.now() - startedAt < timeoutMs) {
+        const remainingBeforeRequest = timeoutMs - (Date.now() - startedAt);
+        const pollResult = await runFetch(pollUrl, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ device_auth_id: deviceCode.deviceAuthId, user_code: deviceCode.userCode }),
+        }, options, async (response, requestOptions) => {
+            if (response.ok) {
+                return { status: 'complete',
+                    body: await readJson(response, `POST ${pollUrl}`, requestOptions) };
+            }
+            await readResponseText(response, requestOptions);
+            if (response.status !== 403 && response.status !== 404) {
+                throw new OpenAiAuthError(`OpenAI device-code polling failed with status ${response.status}.`, { status: response.status });
+            }
+            return { status: 'pending' };
+        }, Math.max(remainingBeforeRequest, 1));
+        if (pollResult.status === 'complete') {
+            return {
+                authorizationCode: asString(pollResult.body.authorization_code, 'authorization_code', MAX_AUTHORIZATION_CODE_BYTES),
+                codeChallenge: asString(pollResult.body.code_challenge, 'code_challenge'),
+                codeVerifier: asString(pollResult.body.code_verifier, 'code_verifier'),
+            };
+        }
+        const remaining = timeoutMs - (Date.now() - startedAt);
+        await sleepWithAbort(Math.min(deviceCode.intervalSeconds * 1000, Math.max(remaining, 0)), options);
+    }
+    throw new OpenAiAuthError('OpenAI device-code login timed out.');
+};
+/** Exchanges an approved device sign-in for tokens (`POST {issuer}/oauth/token`, PKCE, form-encoded). */
+export const exchangeOpenAiDeviceAuthorization = async (authorization, options = {}) => {
+    const response = await postForm(`${OPENAI_AUTH_ISSUER}/oauth/token`, new URLSearchParams({
+        grant_type: 'authorization_code',
+        code: authorization.authorizationCode,
+        redirect_uri: `${OPENAI_AUTH_ISSUER}/deviceauth/callback`,
+        client_id: OPENAI_AUTH_CLIENT_ID,
+        code_verifier: authorization.codeVerifier,
+    }), options);
+    return createTokenSet(response);
+};
+/**
+ * Sends one refresh-token grant (`POST {issuer}/oauth/token`, JSON). A response without a new refresh token keeps
+ * the one that was sent, as Codex does.
+ */
+export const refreshOpenAiTokens = async (tokens, options = {}) => {
+    const response = await postJson(`${OPENAI_AUTH_ISSUER}/oauth/token`, {
+        client_id: OPENAI_AUTH_CLIENT_ID,
+        grant_type: 'refresh_token',
+        refresh_token: tokens.refreshToken,
+    }, options);
+    return createTokenSet({
+        id_token: response.id_token ?? tokens.idToken,
+        access_token: response.access_token ?? tokens.accessToken,
+        refresh_token: response.refresh_token ?? tokens.refreshToken,
+    }, tokens);
+};
+/**
+ * Revokes a refresh token (`POST {issuer}/oauth/revoke`, JSON), as Codex does when it logs out: the grant then
+ * refreshes nothing anywhere. It resolves only once the service accepted the revocation.
+ */
+export const revokeOpenAiRefreshToken = async (refreshToken, options = {}) => {
+    if (typeof refreshToken !== 'string' || !refreshToken || utf8ByteLength(refreshToken) > MAX_TOKEN_BYTES) {
+        throw new OpenAiAuthError('OpenAI revocation input is invalid.', { requestOutcome: 'notSent' });
+    }
+    const url = `${OPENAI_AUTH_ISSUER}/oauth/revoke`;
+    await runFetch(url, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({ token: refreshToken, token_type_hint: 'refresh_token', client_id: OPENAI_AUTH_CLIENT_ID }),
+    }, options, async (response, requestOptions) => {
+        await readResponseText(response, requestOptions);
+        if (!response.ok)
+            throw new OpenAiAuthError(`POST ${url} failed with status ${response.status}.`, { status: response.status });
+    }, REVOKE_TIMEOUT_MS);
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoib3BlbmFpYXV0aC5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL29wZW5haWF1dGgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsMkpBQTJKO0FBSTNKOzs7OztHQUtHO0FBRUgsTUFBTSxDQUFDLE1BQU0sa0JBQWtCLEdBQUcseUJBQXlCLENBQUM7QUFDNUQsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsOEJBQThCLENBQUM7QUFFcEUsTUFBTSxzQkFBc0IsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztBQUM5QyxxQ0FBcUM7QUFDckMsTUFBTSxpQkFBaUIsR0FBRyxNQUFNLENBQUM7QUFDakMsTUFBTSxrQkFBa0IsR0FBRyxFQUFFLEdBQUcsSUFBSSxDQUFDO0FBQ3JDLE1BQU0sZUFBZSxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUM7QUFDbEMsTUFBTSw0QkFBNEIsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDO0FBQzlDLE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDO0FBQ2xDLE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxDQUFDO0FBQ2xDLE1BQU0sV0FBVyxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7QUFDdEMsTUFBTSxXQUFXLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQztBQUN0QyxNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWdCLEVBQVUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsVUFBVSxDQUFDO0FBRTdGLE1BQU0sT0FBTyxlQUFnQixTQUFRLEtBQUs7SUFDeEIsTUFBTSxDQUFVO0lBQ2hCLGNBQWMsQ0FBeUI7SUFDdkMsWUFBWSxDQUFVO0lBRXRDLFlBQVksT0FBZSxFQUFFLFVBQ0QsRUFBRTtRQUM1QixLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDZixJQUFJLENBQUMsSUFBSSxHQUFHLGlCQUFpQixDQUFDO1FBQzlCLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQztRQUM3QixJQUFJLENBQUMsY0FBYyxHQUFHLE9BQU8sQ0FBQyxjQUFjLENBQUM7UUFDN0MsSUFBSSxDQUFDLFlBQVksR0FBRyxPQUFPLENBQUMsWUFBWSxDQUFDO0lBQzNDLENBQUM7Q0FDRjtBQWtERCxNQUFNLFFBQVEsR0FBRyxDQUFDLE9BQTJCLEVBQWdCLEVBQUU7SUFDN0QsTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLEtBQUssSUFBSSxVQUFVLENBQUMsS0FBSyxDQUFDO0lBQ3hELElBQUksQ0FBQyxhQUFhO1FBQUUsTUFBTSxJQUFJLGVBQWUsQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25HLE9BQU8sYUFBYSxDQUFDO0FBQ3ZCLENBQUMsQ0FBQztBQUVGLE1BQU0sY0FBYyxHQUFHLENBQUMsT0FBMkIsRUFBUSxFQUFFO0lBQzNELElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPO1FBQUUsTUFBTSxJQUFJLGVBQWUsQ0FBQyxvQ0FBb0MsQ0FBQyxDQUFDO0FBQy9GLENBQUMsQ0FBQztBQUVGLE1BQU0sUUFBUSxHQUFHLENBQUMsS0FBYyxFQUFFLElBQVksRUFBRSxZQUFZLEdBQUcsb0JBQW9CLEVBQVUsRUFBRTtJQUM3RixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3BELE1BQU0sSUFBSSxlQUFlLENBQUMsbUNBQW1DLElBQUksR0FBRyxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksY0FBYyxDQUFDLEtBQUssQ0FBQyxHQUFHLFlBQVk7UUFBRSxNQUFNLElBQUksZUFBZSxDQUFDLDRDQUE0QyxJQUFJLEdBQUcsQ0FBQyxDQUFDO0lBQ3pILE9BQU8sS0FBSyxDQUFDO0FBQ2YsQ0FBQyxDQUFDO0FBRUYsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLEtBQWMsRUFBRSxZQUFZLEdBQUcsb0JBQW9CLEVBQXNCLEVBQUU7SUFDbkcsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDdEUsSUFBSSxjQUFjLENBQUMsS0FBSyxDQUFDLEdBQUcsWUFBWTtRQUFFLE1BQU0sSUFBSSxlQUFlLENBQUMsb0RBQW9ELENBQUMsQ0FBQztJQUMxSCxPQUFPLEtBQUssQ0FBQztBQUNmLENBQUMsQ0FBQztBQUVGLG1IQUFtSDtBQUNuSCxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYyxFQUFVLEVBQUU7SUFDbkQsTUFBTSxRQUFRLEdBQUcsT0FBTyxLQUFLLEtBQUssUUFBUSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEtBQUssSUFBSSxFQUFFLENBQUMsRUFBRSxFQUFFLENBQUMsQ0FBQztJQUM5RixJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSSxRQUFRLElBQUksQ0FBQyxJQUFJLFFBQVEsR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUNsRSxNQUFNLElBQUksZUFBZSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELE9BQU8sUUFBUSxDQUFDO0FBQ2xCLENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsS0FBSyxFQUFFLFFBQWtCLEVBQUUsT0FBMkIsRUFBbUIsRUFBRTtJQUNsRyxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQzdELElBQUksYUFBYSxLQUFLLElBQUksSUFBSSxDQUFDLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEdBQUcsa0JBQWtCLENBQUMsRUFBRSxDQUFDO1FBQzNHLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDckQsTUFBTSxJQUFJLGVBQWUsQ0FBQywrQ0FBK0MsRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztJQUMxRyxDQUFDO0lBQ0QsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDOUIsTUFBTSxNQUFNLEdBQUcsUUFBUSxDQUFDLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUN6QyxNQUFNLE1BQU0sR0FBaUIsRUFBRSxDQUFDO0lBQ2hDLElBQUksVUFBVSxHQUFHLENBQUMsQ0FBQztJQUNuQixJQUFJLFNBQVMsR0FBRyxLQUFLLENBQUM7SUFDdEIsTUFBTSxPQUFPLEdBQUcsR0FBUyxFQUFFLEdBQUcsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdFLE9BQU8sQ0FBQyxNQUFNLEVBQUUsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLE9BQU8sRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQ25FLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDdkMsSUFBSSxDQUFDO1FBQ0gsT0FBTyxJQUFJLEVBQUUsQ0FBQztZQUNaLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN4QixNQUFNLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxHQUFHLE1BQU0sTUFBTSxDQUFDLElBQUksRUFBRSxDQUFDO1lBQzVDLGNBQWMsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN4QixJQUFJLElBQUk7Z0JBQUUsTUFBTTtZQUNoQixVQUFVLElBQUksS0FBSyxDQUFDLFVBQVUsQ0FBQztZQUMvQixJQUFJLFVBQVUsR0FBRyxrQkFBa0IsRUFBRSxDQUFDO2dCQUNwQyxNQUFNLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQzdDLE1BQU0sSUFBSSxlQUFlLENBQUMsK0NBQStDLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDMUcsQ0FBQztZQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDckIsQ0FBQztRQUNELFNBQVMsR0FBRyxJQUFJLENBQUM7SUFDbkIsQ0FBQztZQUFTLENBQUM7UUFDVCxPQUFPLENBQUMsTUFBTSxFQUFFLG1CQUFtQixDQUFDLE9BQU8sRUFBRSxPQUFPLENBQUMsQ0FBQztRQUN0RCxJQUFJLENBQUMsU0FBUztZQUFFLEtBQUssTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUM1RCxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7SUFDdkIsQ0FBQztJQUNELE1BQU0sS0FBSyxHQUFHLElBQUksVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3pDLElBQUksTUFBTSxHQUFHLENBQUMsQ0FBQztJQUNmLEtBQUssTUFBTSxLQUFLLElBQUksTUFBTSxFQUFFLENBQUM7UUFDM0IsS0FBSyxDQUFDLEdBQUcsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDekIsTUFBTSxJQUFJLEtBQUssQ0FBQyxVQUFVLENBQUM7SUFDN0IsQ0FBQztJQUNELE9BQU8sV0FBVyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztBQUNuQyxDQUFDLENBQUM7QUFFRixNQUFNLFFBQVEsR0FBRyxLQUFLLEVBQUUsUUFBa0IsRUFBRSxPQUFlLEVBQUUsT0FBMkIsRUFBb0IsRUFBRTtJQUM1RyxNQUFNLElBQUksR0FBRyxNQUFNLGdCQUFnQixDQUFDLFFBQVEsRUFBRSxPQUFPLENBQUMsQ0FBQztJQUN2RCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUU7UUFBRSxNQUFNLElBQUksZUFBZSxDQUFDLEdBQUcsT0FBTyx1QkFBdUIsUUFBUSxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQzlILElBQUksQ0FBQztRQUFDLE9BQU8sSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFBQyxDQUFDO0lBQzVDLE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxlQUFlLENBQUMsR0FBRyxPQUFPLHlCQUF5QixFQUFFLEVBQUUsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDO0lBQUMsQ0FBQztBQUN4RyxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsTUFBcUIsRUFBc0IsRUFBRTtJQUN0RSxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEdBQUcsR0FBRztRQUFFLE9BQU8sU0FBUyxDQUFDO0lBQ3JELE1BQU0sY0FBYyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQztJQUMzQyxJQUFJLFlBQVksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBQUUsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsR0FBRyxJQUFJLEVBQUUsY0FBYyxDQUFDLENBQUM7SUFDdEYsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUM7UUFBRSxPQUFPLFNBQVMsQ0FBQztJQUNoRCxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsT0FBTyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQyxFQUFFLGNBQWMsQ0FBQyxDQUFDO0FBQ3JFLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sUUFBUSxHQUFHLEtBQUssRUFBVyxHQUFXLEVBQUUsSUFBaUIsRUFBRSxPQUEyQixFQUMxRixNQUFvRixFQUNwRixTQUFTLEdBQUcsa0JBQWtCLEVBQW9CLEVBQUU7SUFDcEQsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLE9BQU8sRUFBRSxDQUFDO1FBQzVCLE1BQU0sSUFBSSxlQUFlLENBQUMsb0NBQW9DLEVBQUUsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNqRyxDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztJQUN6QyxJQUFJLFFBQThCLENBQUM7SUFDbkMsSUFBSSxjQUFjLEdBQUcsS0FBSyxDQUFDO0lBQzNCLE1BQU0sZUFBZSxHQUFHLEdBQVMsRUFBRSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztJQUN2RCxNQUFNLGNBQWMsR0FBRyxHQUFTLEVBQUUsR0FBRyxLQUFLLFFBQVEsRUFBRSxJQUFJLEVBQUUsTUFBTSxFQUFFLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzdGLE9BQU8sQ0FBQyxNQUFNLEVBQUUsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLGVBQWUsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzNFLElBQUksYUFBMEIsQ0FBQztJQUMvQixNQUFNLE9BQU8sR0FBRyxJQUFJLE9BQU8sQ0FBUSxDQUFDLFFBQVEsRUFBRSxNQUFNLEVBQUUsRUFBRTtRQUN0RCxhQUFhLEdBQUcsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksS0FBSyxDQUFDLHdDQUF3QyxDQUFDLENBQUMsQ0FBQztRQUNsRixVQUFVLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxhQUFhLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztJQUM3RSxDQUFDLENBQUMsQ0FBQztJQUNILFVBQVUsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLENBQUMsT0FBTyxFQUFFLGNBQWMsRUFBRSxFQUFFLElBQUksRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDO0lBQzVFLElBQUksT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPO1FBQUUsVUFBVSxDQUFDLEtBQUssRUFBRSxDQUFDO0lBQ2hELE1BQU0sS0FBSyxHQUFHLFVBQVUsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxVQUFVLENBQUMsS0FBSyxFQUFFLEVBQUUsSUFBSSxDQUFDLEdBQUcsQ0FBQyxTQUFTLEVBQUUsa0JBQWtCLENBQUMsQ0FBQyxDQUFDO0lBQzVGLE1BQU0sY0FBYyxHQUFHLEVBQUUsR0FBRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQVUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztJQUNqRSxJQUFJLENBQUM7UUFDSCxPQUFPLE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQztZQUN4QixDQUFDLEtBQUssSUFBSSxFQUFFO2dCQUNWLE1BQU0sbUJBQW1CLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUM5QyxjQUFjLEdBQUcsSUFBSSxDQUFDO2dCQUN0QixRQUFRLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxHQUFHLEVBQUUsRUFBRSxHQUFHLElBQUksRUFBRSxRQUFRLEVBQUUsT0FBTyxFQUFFLE1BQU0sRUFBRSxVQUFVLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDckcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLE9BQU87b0JBQUUsTUFBTSxRQUFRLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDcEYsY0FBYyxDQUFDLGNBQWMsQ0FBQyxDQUFDO2dCQUMvQixPQUFPLE1BQU0sQ0FBQyxRQUFRLEVBQUUsY0FBYyxDQUFDLENBQUM7WUFDMUMsQ0FBQyxDQUFDLEVBQUU7WUFDSixPQUFPO1NBQ1IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7UUFDZixNQUFNLGNBQWMsR0FBMEIsY0FBYyxDQUFDLENBQUMsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQzVGLE1BQU0sWUFBWSxHQUFHLFFBQVEsQ0FBQyxDQUFDLENBQUMsaUJBQWlCLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ25HLE1BQU0sTUFBTSxHQUFHLEtBQUssWUFBWSxlQUFlLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUM7UUFDaEgsTUFBTSxJQUFJLGVBQWUsQ0FBQyxLQUFLLFlBQVksZUFBZSxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTztZQUN4RSxDQUFDLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDLG9DQUFvQyxDQUFDLENBQUMsQ0FBQyx1Q0FBdUMsRUFBRTtZQUM1RyxjQUFjO1lBQ2QsR0FBRyxDQUFDLE1BQU0sS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUMzQyxHQUFHLENBQUMsWUFBWSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQ3hELENBQUMsQ0FBQztJQUNMLENBQUM7WUFBUyxDQUFDO1FBQ1QsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ3BCLE9BQU8sQ0FBQyxNQUFNLEVBQUUsbUJBQW1CLENBQUMsT0FBTyxFQUFFLGVBQWUsQ0FBQyxDQUFDO1FBQzlELFVBQVUsQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLGFBQWEsQ0FBQyxDQUFDO1FBQzlELFVBQVUsQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLGNBQWMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQVcsRUFBRSxJQUFhLEVBQUUsT0FBMkIsRUFBb0IsRUFBRSxDQUM3RixRQUFRLENBQUMsR0FBRyxFQUFFLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsRUFBRSxjQUFjLEVBQUUsa0JBQWtCLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUMzRyxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsY0FBYyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLFFBQVEsR0FBRyxFQUFFLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztBQUU5RixNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQVcsRUFBRSxJQUFxQixFQUFFLE9BQTJCLEVBQW9CLEVBQUUsQ0FDckcsUUFBUSxDQUFDLEdBQUcsRUFBRSxFQUFFLE1BQU0sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLG1DQUFtQyxFQUFFLEVBQUUsSUFBSSxFQUFFLElBQUksQ0FBQyxRQUFRLEVBQUUsRUFBRSxFQUN2SCxPQUFPLEVBQUUsQ0FBQyxRQUFRLEVBQUUsY0FBYyxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLFFBQVEsR0FBRyxFQUFFLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztBQUU5RixNQUFNLEtBQUssR0FBRyxDQUFDLEVBQVUsRUFBaUIsRUFBRSxDQUFDLElBQUksT0FBTyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsQ0FBQyxDQUFDO0FBRTdGLE1BQU0sY0FBYyxHQUFHLEtBQUssRUFBRSxZQUFvQixFQUFFLE9BQXFDLEVBQWlCLEVBQUU7SUFDMUcsY0FBYyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ3hCLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUM7SUFDOUIsSUFBSSxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQ1osTUFBTSxDQUFDLE9BQU8sQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDN0MsT0FBTztJQUNULENBQUM7SUFDRCxJQUFJLGFBQXVDLENBQUM7SUFDNUMsSUFBSSxLQUFpQyxDQUFDO0lBQ3RDLElBQUksQ0FBQztRQUNILE1BQU0sT0FBTyxDQUFDLElBQUksQ0FBQztZQUNqQixPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJLE9BQU8sQ0FBTyxPQUFPLENBQUMsRUFBRSxHQUFHLEtBQUssR0FBRyxVQUFVLENBQUMsT0FBTyxFQUFFLFlBQVksQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQzFILElBQUksT0FBTyxDQUFRLENBQUMsUUFBUSxFQUFFLE1BQU0sRUFBRSxFQUFFO2dCQUN0QyxhQUFhLEdBQUcsR0FBRyxFQUFFLENBQUMsTUFBTSxDQUFDLElBQUksZUFBZSxDQUFDLG9DQUFvQyxDQUFDLENBQUMsQ0FBQztnQkFDeEYsTUFBTSxDQUFDLGdCQUFnQixDQUFDLE9BQU8sRUFBRSxhQUFhLEVBQUUsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztnQkFDaEUsSUFBSSxNQUFNLENBQUMsT0FBTztvQkFBRSxhQUFhLEVBQUUsQ0FBQztZQUN0QyxDQUFDLENBQUM7U0FDSCxDQUFDLENBQUM7SUFDTCxDQUFDO1lBQVMsQ0FBQztRQUNULElBQUksS0FBSztZQUFFLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQixJQUFJLGFBQWE7WUFBRSxNQUFNLENBQUMsbUJBQW1CLENBQUMsT0FBTyxFQUFFLGFBQWEsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLGVBQWUsR0FBRyxDQUFDLEdBQVcsRUFBMkIsRUFBRTtJQUMvRCxNQUFNLEtBQUssR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQzdCLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDO1FBQUUsTUFBTSxJQUFJLGVBQWUsQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQ3pHLElBQUksQ0FBQztRQUNILE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLEdBQUcsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDOUQsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzFFLE1BQU0sS0FBSyxHQUFZLElBQUksQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxTQUFTLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDckgsSUFBSSxLQUFLLEtBQUssSUFBSSxJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQztZQUFFLE1BQU0sSUFBSSxLQUFLLEVBQUUsQ0FBQztRQUMzRixPQUFPLEtBQWdDLENBQUM7SUFDMUMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxlQUFlLENBQUMsMENBQTBDLENBQUMsQ0FBQztJQUFDLENBQUM7QUFDcEYsQ0FBQyxDQUFDO0FBRUYsTUFBTSxXQUFXLEdBQUcsQ0FBQyxLQUFjLEVBQXVDLEVBQUUsQ0FDMUUsS0FBSyxLQUFLLElBQUksSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFnQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFFdEgsaUhBQWlIO0FBQ2pILE1BQU0sQ0FBQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsS0FBYSxFQUFzQixFQUFFO0lBQzFFLE1BQU0sTUFBTSxHQUFHLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUN0QyxNQUFNLE9BQU8sR0FBRyxXQUFXLENBQUMsTUFBTSxDQUFDLGdDQUFnQyxDQUFDLENBQUMsQ0FBQztJQUN0RSxNQUFNLElBQUksR0FBRyxXQUFXLENBQUMsTUFBTSxDQUFDLDZCQUE2QixDQUFDLENBQUMsQ0FBQztJQUNoRSxNQUFNLGdCQUFnQixHQUFHLE9BQU8sTUFBTSxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQztJQUNqRixPQUFPO1FBQ0wsS0FBSyxFQUFFLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxPQUFPLEVBQUUsS0FBSyxDQUFDO1FBQ3pFLGVBQWUsRUFBRSxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsaUJBQWlCLENBQUM7UUFDMUQsYUFBYSxFQUFFLGdCQUFnQixDQUFDLElBQUksRUFBRSxlQUFlLENBQUMsSUFBSSxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsT0FBTyxDQUFDO1FBQ3pGLGdCQUFnQixFQUFFLGdCQUFnQixDQUFDLElBQUksRUFBRSxrQkFBa0IsQ0FBQztRQUM1RCx1QkFBdUIsRUFBRSxJQUFJLEVBQUUsMEJBQTBCLEtBQUssSUFBSTtRQUNsRSxTQUFTLEVBQUUsZ0JBQWdCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUMsU0FBUztLQUN4RyxDQUFDO0FBQ0osQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUF3QixFQUFFLFFBQTBCLEVBQW1CLEVBQUU7SUFDL0YsTUFBTSxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsUUFBUSxDQUFDLFlBQVksRUFBRSxlQUFlLENBQUMsSUFBSSxRQUFRLEVBQUUsV0FBVyxDQUFDO0lBQ3RHLE1BQU0sWUFBWSxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxhQUFhLEVBQUUsZUFBZSxDQUFDLElBQUksUUFBUSxFQUFFLFlBQVksQ0FBQztJQUN6RyxNQUFNLE9BQU8sR0FBRyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsUUFBUSxFQUFFLGVBQWUsQ0FBQyxJQUFJLFFBQVEsRUFBRSxPQUFPLENBQUM7SUFDMUYsSUFBSSxDQUFDLFdBQVc7UUFBRSxNQUFNLElBQUksZUFBZSxDQUFDLCtDQUErQyxDQUFDLENBQUM7SUFDN0YsSUFBSSxDQUFDLFlBQVk7UUFBRSxNQUFNLElBQUksZUFBZSxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDL0YsSUFBSSxNQUEwQixDQUFDO0lBQy9CLElBQUksQ0FBQztRQUFDLE1BQU0sR0FBRyxzQkFBc0IsQ0FBQyxPQUFPLElBQUksV0FBVyxDQUFDLENBQUM7SUFBQyxDQUFDO0lBQ2hFLE1BQU0sQ0FBQztRQUFDLE1BQU0sSUFBSSxlQUFlLENBQUMsd0NBQXdDLENBQUMsQ0FBQztJQUFDLENBQUM7SUFDOUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxZQUFZLEVBQUUsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUM7QUFDaEYsQ0FBQyxDQUFDO0FBRUYsa0ZBQWtGO0FBQ2xGLE1BQU0sQ0FBQyxNQUFNLHVCQUF1QixHQUFHLEtBQUssRUFBRSxVQUE4QixFQUFFLEVBQThCLEVBQUU7SUFDNUcsTUFBTSxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxrQkFBa0IsbUNBQW1DLEVBQ3RGLEVBQUUsU0FBUyxFQUFFLHFCQUFxQixFQUFFLEVBQUUsT0FBTyxDQUE0QixDQUFDO0lBQzVFLE9BQU87UUFDTCxlQUFlLEVBQUUsR0FBRyxrQkFBa0IsZUFBZTtRQUNyRCxRQUFRLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLElBQUksUUFBUSxDQUFDLFFBQVEsRUFBRSxXQUFXLENBQUM7UUFDeEUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsY0FBYyxFQUFFLGdCQUFnQixDQUFDO1FBQ2pFLGVBQWUsRUFBRSxpQkFBaUIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO0tBQ3RELENBQUM7QUFDSixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxLQUFLLEVBQUUsVUFBNkIsRUFDdEUsVUFBd0MsRUFBRSxFQUF1QyxFQUFFO0lBQ25GLE1BQU0sT0FBTyxHQUFHLEdBQUcsa0JBQWtCLGdDQUFnQyxDQUFDO0lBQ3RFLE1BQU0sU0FBUyxHQUFHLE9BQU8sQ0FBQyxTQUFTLElBQUksc0JBQXNCLENBQUM7SUFDOUQsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLElBQUksU0FBUyxHQUFHLENBQUMsSUFBSSxTQUFTLEdBQUcsc0JBQXNCLEVBQUUsQ0FBQztRQUM1RixNQUFNLElBQUksZUFBZSxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELElBQUksY0FBYyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsR0FBRyxvQkFBb0I7V0FDN0QsY0FBYyxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxvQkFBb0I7V0FDMUQsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsSUFBSSxVQUFVLENBQUMsZUFBZSxHQUFHLENBQUM7V0FDbkYsVUFBVSxDQUFDLGVBQWUsR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUN0QyxNQUFNLElBQUksZUFBZSxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztJQUM3QixPQUFPLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxTQUFTLEdBQUcsU0FBUyxFQUFFLENBQUM7UUFDMUMsTUFBTSxzQkFBc0IsR0FBRyxTQUFTLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsU0FBUyxDQUFDLENBQUM7UUFDcEUsTUFBTSxVQUFVLEdBQUcsTUFBTSxRQUFRLENBQUMsT0FBTyxFQUFFO1lBQ3pDLE1BQU0sRUFBRSxNQUFNO1lBQ2QsT0FBTyxFQUFFLEVBQUUsY0FBYyxFQUFFLGtCQUFrQixFQUFFO1lBQy9DLElBQUksRUFBRSxJQUFJLENBQUMsU0FBUyxDQUFDLEVBQUUsY0FBYyxFQUFFLFVBQVUsQ0FBQyxZQUFZLEVBQUUsU0FBUyxFQUFFLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQztTQUNsRyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxFQUFFO1lBQzdDLElBQUksUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO2dCQUNoQixPQUFPLEVBQUUsTUFBTSxFQUFFLFVBQW1CO29CQUNsQyxJQUFJLEVBQUUsTUFBTSxRQUFRLENBQUMsUUFBUSxFQUFFLFFBQVEsT0FBTyxFQUFFLEVBQUUsY0FBYyxDQUE0QixFQUFFLENBQUM7WUFDbkcsQ0FBQztZQUNELE1BQU0sZ0JBQWdCLENBQUMsUUFBUSxFQUFFLGNBQWMsQ0FBQyxDQUFDO1lBQ2pELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxHQUFHLEVBQUUsQ0FBQztnQkFDdkQsTUFBTSxJQUFJLGVBQWUsQ0FBQyxpREFBaUQsUUFBUSxDQUFDLE1BQU0sR0FBRyxFQUMzRixFQUFFLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztZQUNqQyxDQUFDO1lBQ0QsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFrQixFQUFFLENBQUM7UUFDeEMsQ0FBQyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsc0JBQXNCLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN4QyxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDckMsT0FBTztnQkFDTCxpQkFBaUIsRUFBRSxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsRUFBRSxvQkFBb0IsRUFBRSw0QkFBNEIsQ0FBQztnQkFDbkgsYUFBYSxFQUFFLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLGNBQWMsRUFBRSxnQkFBZ0IsQ0FBQztnQkFDekUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRSxlQUFlLENBQUM7YUFDdkUsQ0FBQztRQUNKLENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxTQUFTLEdBQUcsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFLEdBQUcsU0FBUyxDQUFDLENBQUM7UUFDdkQsTUFBTSxjQUFjLENBQUMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsZUFBZSxHQUFHLElBQUksRUFBRSxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxDQUFDO0lBQ3JHLENBQUM7SUFDRCxNQUFNLElBQUksZUFBZSxDQUFDLHFDQUFxQyxDQUFDLENBQUM7QUFDbkUsQ0FBQyxDQUFDO0FBRUYseUdBQXlHO0FBQ3pHLE1BQU0sQ0FBQyxNQUFNLGlDQUFpQyxHQUFHLEtBQUssRUFBRSxhQUF5QyxFQUMvRixVQUE4QixFQUFFLEVBQTRCLEVBQUU7SUFDOUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxrQkFBa0IsY0FBYyxFQUFFLElBQUksZUFBZSxDQUFDO1FBQ3ZGLFVBQVUsRUFBRSxvQkFBb0I7UUFDaEMsSUFBSSxFQUFFLGFBQWEsQ0FBQyxpQkFBaUI7UUFDckMsWUFBWSxFQUFFLEdBQUcsa0JBQWtCLHNCQUFzQjtRQUN6RCxTQUFTLEVBQUUscUJBQXFCO1FBQ2hDLGFBQWEsRUFBRSxhQUFhLENBQUMsWUFBWTtLQUMxQyxDQUFDLEVBQUUsT0FBTyxDQUFtQixDQUFDO0lBQy9CLE9BQU8sY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0FBQ2xDLENBQUMsQ0FBQztBQUVGOzs7R0FHRztBQUNILE1BQU0sQ0FBQyxNQUFNLG1CQUFtQixHQUFHLEtBQUssRUFBRSxNQUF1QixFQUMvRCxVQUE4QixFQUFFLEVBQTRCLEVBQUU7SUFDOUQsTUFBTSxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsR0FBRyxrQkFBa0IsY0FBYyxFQUFFO1FBQ25FLFNBQVMsRUFBRSxxQkFBcUI7UUFDaEMsVUFBVSxFQUFFLGVBQWU7UUFDM0IsYUFBYSxFQUFFLE1BQU0sQ0FBQyxZQUFZO0tBQ25DLEVBQUUsT0FBTyxDQUFtQixDQUFDO0lBQzlCLE9BQU8sY0FBYyxDQUFDO1FBQ3BCLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxJQUFJLE1BQU0sQ0FBQyxPQUFPO1FBQzdDLFlBQVksRUFBRSxRQUFRLENBQUMsWUFBWSxJQUFJLE1BQU0sQ0FBQyxXQUFXO1FBQ3pELGFBQWEsRUFBRSxRQUFRLENBQUMsYUFBYSxJQUFJLE1BQU0sQ0FBQyxZQUFZO0tBQzdELEVBQUUsTUFBTSxDQUFDLENBQUM7QUFDYixDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx3QkFBd0IsR0FBRyxLQUFLLEVBQUUsWUFBb0IsRUFBRSxVQUE4QixFQUFFLEVBQWlCLEVBQUU7SUFDdEgsSUFBSSxPQUFPLFlBQVksS0FBSyxRQUFRLElBQUksQ0FBQyxZQUFZLElBQUksY0FBYyxDQUFDLFlBQVksQ0FBQyxHQUFHLGVBQWUsRUFBRSxDQUFDO1FBQ3hHLE1BQU0sSUFBSSxlQUFlLENBQUMscUNBQXFDLEVBQUUsRUFBRSxjQUFjLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztJQUNsRyxDQUFDO0lBQ0QsTUFBTSxHQUFHLEdBQUcsR0FBRyxrQkFBa0IsZUFBZSxDQUFDO0lBQ2pELE1BQU0sUUFBUSxDQUFDLEdBQUcsRUFBRTtRQUNsQixNQUFNLEVBQUUsTUFBTTtRQUNkLE9BQU8sRUFBRSxFQUFFLGNBQWMsRUFBRSxrQkFBa0IsRUFBRTtRQUMvQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEtBQUssRUFBRSxZQUFZLEVBQUUsZUFBZSxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQUUscUJBQXFCLEVBQUUsQ0FBQztLQUNsSCxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLGNBQWMsRUFBRSxFQUFFO1FBQzdDLE1BQU0sZ0JBQWdCLENBQUMsUUFBUSxFQUFFLGNBQWMsQ0FBQyxDQUFDO1FBQ2pELElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUFFLE1BQU0sSUFBSSxlQUFlLENBQUMsUUFBUSxHQUFHLHVCQUF1QixRQUFRLENBQUMsTUFBTSxHQUFHLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7SUFDakksQ0FBQyxFQUFFLGlCQUFpQixDQUFDLENBQUM7QUFDeEIsQ0FBQyxDQUFDIn0=