@nlabs/reaktor 1.18.0 → 1.20.0-reactorbox.1

package/README.md

@@ -1702,3 +1702,293 @@ Each operation takes `input: JSONObject!` and returns JSON at `data.assistant.<o
 Support requires user confirmation, valid contact details and a stable `web-UUID` request ID. Queued acceptance means durable storage for retry, not confirmed email delivery. Read GraphQL `errors` even for HTTP 200 responses. The server selects approved knowledge, origins, database and delivery configuration; caller metadata cannot grant access.
 
 The backend factories are exported from the server-only `@nlabs/reaktor/assistant` subpath in the release containing the extraction. See [assistant endpoint, configuration and rollout](docs/ASSISTANT.md) for complete requests/responses, validation, limits, adapters and publication/deployment status.
+
+## Minimized CRM and Support aggregate reads (source extension)
+
+`crm.merchantInsights(appId: ID!, from: String!, to: String!, productId: ID)` returns `crm_merchant_insights_v1` JSON for a timezone-qualified window of at most 90 days. It reads bounded source contact/marketing-opt-in and Support type/status counters. Counts below five are withheld; source windows exceeding 10,000 records are marked truncated. No identities, ticket text, emails, customer values, campaign attribution or lead pipeline are returned. Product-scoped reads do not imply product-related contact acquisition.
+
+Administrators issue an explicit scoped key with `crm.createInsightsReadKey(appId: ID!, scopes: [String!]!, expiresAt: String!)`; allowed scopes are `crm:aggregates` and `support:aggregates`. The host must provide its existing authorized application database resolver. The API returns the secret once and stores only its SHA256 hash, exact app/database scope, administrator owner and expiry in the owner API database. Expiry must be future and at most 365 days. `crm.revokeInsightsReadKey(appId: ID!, id: ID!)` revokes that credential. No customer records or graph edges change.
+
+Send the opaque key as `Authorization: Bearer <readKey>` only to the verified owner GraphQL endpoint. It is isolated from ordinary session authentication; it grants no other CRM/Support/user actions. Reads check scope, hash, expiry and revocation before and after aggregation. Public package helpers are `createCrmInsightsReadKey`, `getCrmMerchantInsights` and `revokeCrmInsightsReadKey`. Keep keys server-side; rotate/revoke through the owner API and clear consumer caches when grants or projects are removed.
+
+This extension needs a reviewed compatible package build adopted by the owner host and deployment of those fields before a consumer can connect. It does not establish a live service merely because a local source checkout exports it. Existing email campaigns, private ticket messages, appointments and merchant invoices need their separate consent, source, frozen-action and execution/reconciliation contracts.
+
+
+## Account-scoped multipart S3 primitives
+
+`s3Head`, `s3Delete`, `s3CreateMultipartUpload`, `s3CompleteMultipartUpload`, and `s3AbortMultipartUpload` accept an optional second `S3Client` argument. `s3ListParts(params, client?)` returns exactly one raw SDK page, including truncation, markers, ordering and checksums. All propagate original errors; none retry, paginate or translate missing/denied errors.
+
+Explicit truthy buckets with an injected client never read global configuration/credentials. Empty/missing buckets fall back to `aws.s3.Bucket || aws.s3.bucket`. Injected branches copy caller inputs. Existing no-client helpers retain their legacy bucket mutations; new ListParts copies in both branches.
+
+`s3GetUploadPartSignedUrl(params, client?, signingOptions?)` exports `S3UploadPartSigningOptions` derived from the presigner options excluding `expiresIn`. Options are forwarded; `params.Expires || 3600` is applied last and cannot be overridden. Legacy calls delete Expires and fill Bucket on caller input; injected calls modify only a copy. Account expiry/part sizing/checksum validation and reconciliation remain application policy.
+
+```ts
+await s3GetUploadPartSignedUrl({Bucket: bucket, ChecksumSHA256: checksum,
+  ContentLength: bytes, Expires: 900, Key: key, PartNumber: part, UploadId: uploadId},
+client, {unhoistableHeaders: new Set(['x-amz-checksum-sha256'])});
+```
+
+These additions require a verified compatible release before registry adoption. Local compatible archives preserve the installed baseline manifest/dependencies and replace only the S3 module/declarations; source checkout version alone is not a release guarantee.
+
+## Scoped merchant lead follow-up and Support operations
+
+`generateCrmLeadFollowupCandidates` and GraphQL `crm.leadFollowupCandidates(input:JSON!)` read bounded native new/qualified lead opportunities from current consented campaign associations. Administrator-issued `crm:lead_followup` requires separate `crm:outreach` and exact organization/project/campaign bounds. Candidates expire within 15 minutes and source/grant/consent expiry. Existing exact execution previews accept a frozen candidate/revision binding; native source validation and once-only opportunity claims prevent concurrent or different-request-key duplicate sending. Unknown submission stays held. Generation alone sends nothing; these are current source opportunities, not fabricated historical events or inactivity cohorts.
+
+`readSupportInbox` and GraphQL `crm.supportInbox(input:JSON!)` require native `support:read` and return bounded ticket status/priority/type/revision and eligible operator identifiers, with truncation and expiry. `support:manage` separately authorizes reviewed assignment, priority and internal escalation through the existing preview/decision/execution ledger with source and operator revisions. Escalation updates native ticket metadata without external notifications. `summarizeCampaignSupport` uses existing consented campaign associations for suppressed operational topic/status/resolution counters; it exposes no ticket text or customer testimonials. New pure public policy helpers include `supportPriorities`, `validSupportManagement` and `supportOperatorRevision`. Portable consumer adoption still requires compatible owner deployment and real granted source configuration.
+
+## Trusted native SES delivery relay
+
+`ingestCrmDeliveryEvent(context,input)` and GraphQL mutation `crm.ingestDeliveryEvent(input:JSON!)`
+require a separately administrator-issued `crm:delivery_events` execution key. Keep that key on an
+explicitly trusted server relay; it is not an ordinary Ads customer-execution scope and does not grant
+outreach or target access. The relay must establish authentic AWS/provider event provenance before
+calling the owner operation. This operation does not verify raw SNS signatures, subscriptions or
+anonymous browser claims. Bridge deployment and SES event-destination configuration remain separate.
+
+The exact normalized input is `{appId,eventId,receiptId,providerMessageId,kind,occurredAt,bounceType?}`.
+`kind` is `delivered`, `bounce` or `complaint`; bounce classification must be exactly `Permanent`,
+`Transient` or `Undetermined` when kind is bounce. No email, recipient/body, SNS envelope or additional
+properties are accepted. `receiptId` identifies the actual native execution receipt returned by the
+sending workflow, and `providerMessageId` must match its accepted SES MessageId. Native sends now
+persist `providerAcceptedAt`. Legacy records lacking that timestamp and submitting/unknown sends
+remain held; delivery claims cannot repair uncertain submission or trigger retry.
+
+Events are bounded to thirty days, no more than one minute ahead of the owner clock or before recorded
+provider acceptance, and no more than thirty days after acceptance. Each receipt accepts at most 32
+unique events. Same app/event-ID payload replay is idempotent across key rotation; conflicting reuse is
+rejected. Minimized event metadata and receipt/user graph edges commit atomically with suppression.
+An exact current recipient is required; changed/deleted recipients hold. Bounce of any classification
+sets a delivery hold without claiming permanent rejection; complaint is monotonic over later bounces.
+Delivered events and replays never clear existing delivery holds or marketing opt-out. The returned
+`suppressed` value reflects the current delivery hold, not marketing permission. No sends or retries
+occur. Relay authority is rechecked before writes and immediately before transaction commit; native
+app writes use an exclusive transaction while the platform grant registry remains its existing separate
+authority boundary. Compatible owner deployment and real source relay acceptance remain outstanding.
+
+Native administrator action `eraseCrmDeliveryEvidence(context,appId,userId)` and GraphQL mutation
+`crm.eraseDeliveryEvidence(appId:ID!,userId:ID!)` atomically remove that user's delivery event records and
+both event edges in the current owned app database. They preserve a hash-only tombstone and original
+send receipts; previously accepted messages cannot be reingested across relay key rotation. A genuinely
+new accepted send after erasure may start new evidence. This action does not clear suppression or consent,
+remove users, resend or change unknown submissions. Call it only from a configured authorized native
+privacy workflow; it is not granted by a relay key or exposed through ordinary Ads execution sources.
+
+
+Ordinary receipt inspection now includes optional minimized `deliveryEvidence` only for actual applied
+SES receipts. Its exact shape is `{schemaVersion:'crm_delivery_evidence_v1',status,generatedAt,validUntil,
+negativeHold,events:[{kind,occurredAt,bounceType?}]}`. Status is `available`, `unavailable` or `erased`;
+only available evidence supplies a boolean current native delivery hold. Other statuses supply null and
+an empty timeline. Reports contain no event IDs, relay key, recipient, message body or raw provider data.
+The snapshot expires within fifteen minutes and no later than ordinary receipt authority expiry.
+Inspection rechecks the same current grant after reading the native ledger. Missing, corrupt, erased or
+changed-recipient evidence does not imply delivery success or permission. Available delivered reports
+do not clear suppression or consent; transient bounce remains a hold rather than proven permanent rejection.
+
+Ads accepts this strict projection through its existing ordinary receipt-read path, rejects nested private
+fields before persistence, clears cached evidence on failed or revoked refresh, and withholds the timeline
+after its deadline or source withdrawal. No relay-write scope is exposed through Ads and no retry follows
+a delivery report. A configured source bridge, compatible native deployment, provider event-destination
+configuration and administrator privacy-workflow adoption remain separate live acceptance requirements.
+
+### Canonical CRM lifecycle and verified settlement source
+
+Public actions `createCrmCanonicalReadKey`, `getCrmCanonicalOutcomes`,
+`correctCrmCanonicalObservation`, and `registerCrmCanonicalFinanceBinding` are exposed through
+`crm.canonicalOutcomes(input: JSON!)` and the corresponding CRM administrator mutations.
+`crm:canonical_outcomes` is a distinct read scope bound to app, organization, project and campaigns.
+`crm:canonical_finance` additionally requires exact existing owned issuer IDs. Keys remain actor bound and expiring.
+
+A campaign association must separately record `canonicalConsent` with purpose `canonical_campaign_outcomes`,
+explicit evidence reference and expiry no later than its campaign association consent. New native stage records
+contain actual occurrence time, immutable event ID and version. Legacy unversioned or truncated histories are
+explicitly incomplete; this API never invents an occurrence or silently deletes prior history from such a read.
+Corrections target an actual existing observation and retain its occurrence time under source/event/association CAS.
+A completed read emits versioned tombstones for consent/source withdrawal. Source snapshot metadata is bounded
+at 1,000 events and has a 30-day TTL; it contains minimized references, not form or ticket text.
+
+Financial registration only binds existing native invoice, payment evidence, customer order, user and native
+payment documents under exact source revisions. It does not issue invoices or establish settlement authenticity.
+A financial read verifies the actual existing Stripe charge, bound customer and complete refund evidence using
+GET operations only, requires captured paid live settlement and matching immutable legal amounts/currency,
+and rechecks current native evidence and grant bounds after transport. Failed/uncertain verification is held.
+Stripe evidence alone does not prove a Shopify order namespace: financial observations remain
+`verified_settlement_namespace_unproven` until a consumer independently reads the current owned Shopify
+order and matches its exact provider payment/refund identities. Never sum these rows with Shopify revenue
+without that proof. No charge, refund, invoice issuance or external send is performed by this contract.
+
+### Advisory external calendar busy reads
+
+`readMerchantCalendarBusy(context,{appId,from,resourceId,sourceId,to})` and
+`crm.merchantCalendarBusy(input: JSON!)` provide a separate Scheduling-owned Google Calendar busy-time
+read. Require an actual current `scheduling:read` grant, exact current native resource and explicit
+server-only `MERCHANT_CALENDAR_SOURCES` configuration (`appId,calendarId,expiresAt,id,resourceId,scopes,token`).
+Configure the actual obtained Google free/busy or read scope and finite token expiry; source rotation
+and native resource/grant changes invalidate an in-flight read. No native provider credential creation,
+OAuth refresh controller or token persistence API is implied by this configuration.
+
+Only at most seven days within the next ninety days are read, with at most500 busy ranges and one
+configured calendar. Return minimized UTC intervals, resource timezone, revision and at most five-minute
+freshness. Group expansion, partial provider errors, absent calendars and mismatched time ranges hold
+evidence. Empty busy ranges mean no busy intervals were returned for this source/window; they do not
+establish complete availability. No event names, participant/email/calendar identities or keys are returned.
+This advisory read never creates an external event or native reservation, sends invitations or changes
+booking execution. Combining external availability with native reservation needs a separately validated
+collision and provider-race contract. Official operation:
+https://developers.google.com/workspace/calendar/api/v3/reference/freebusy/query
+
+### Native consented checkout recovery
+
+`generateCrmCheckoutRecoveryCandidates` reads only registered, current Shopify abandoned checkout identities. It requires
+independent `crm:checkout_recovery` plus `crm:outreach` authority and exact `recoveryBounds` (organization, project,
+campaigns, source IDs, 24–720 hour recipient cooldown). Lead follow-up authority cannot enumerate recovery candidates.
+`recordCrmCheckoutRecoveryConsent` accepts only the authenticated native customer's own revision and explicit independent
+`checkout_recovery` purpose (at most 30 days); administrators cannot register consent on somebody else's behalf.
+`registerCrmCheckoutRecoveryBinding` is administrator-only and binds an existing consented campaign association, current
+native recipient and independently read current Shopify customer/checkout. Registration sends nothing.
+
+Owner-only `CRM_CHECKOUT_RECOVERY_SOURCES` configuration contains exact app/organization/project/source ID, shop domain,
+server-held Shopify token, token expiry and explicit protected orders/customers access approval. Reads target fixed Shopify
+Admin API 2026-10, verify actual shop and current installed `read_orders`/`read_customers` scopes, and query the exact
+checkout with `status:open recovery_state:not_recovered email_state:not_sent`. Completed, absent, ambiguous, recovered,
+externally emailed, unsubscribed, suppressed, expired, changed or unavailable evidence is held. Candidate data is bounded
+and expires within 15 minutes; registration metadata and graph edges have at most the customer's 30-day consent lifetime.
+
+Existing `previewCrmExecution` accepts independent `recovery: {candidateId, revision}` for `crm_outreach`. The native preview
+freezes one recipient and exact plain-text body with unsubscribe capability; exact approval remains a separate operation.
+Execution repeats provider completion/consent/source token and native recipient/association checks, atomically claims the
+stable shop/checkout/customer/campaign opportunity, and uses the existing durable SES ledger. Actual recent provider
+acceptance and every unknown/submitting marketing receipt enforce recipient cadence. Unknown submission outcomes remain
+claimed and cannot be retried automatically or bypassed by rotating grants. No paid operations, bookings, financial
+movements, implicit consent, automatic recovery sends, inferred inactivity or unsupported win-back eligibility are added.
+
+GraphQL exposes `crm.checkoutRecoveryCandidates(input: JSON!)`, `crm.checkoutRecoveryConsent(input: JSON!)` and
+`crm.registerCheckoutRecoveryBinding(input: JSON!)`; the existing exact preview/approval/execution fields remain in use.
+
+### Permitted native Support order/product context
+
+`readSupportContext(context, {appId, ticketId, ticketRevision})` and GraphQL `crm.supportContext(input: JSON!)` require a separately issued `support:context` execution-key scope plus `support:read`. The owner checks current app/database authorization, exact actionable ticket revision, explicit app-stamped native customer identity, and exact order/product references. Missing, ambiguous, deleted, legacy-unscoped and cross-customer references are held. Source and grant revisions are checked again before returning minimized IDs/revisions, native product title, recorded currency/date, held/reference status and a snapshot lasting at most 15 minutes. Contact details, amounts and ticket/conversation content are excluded. Provenance is `native_recorded_unverified_shop`: it does not verify a Shopify shop/customer namespace, live order/delivery state or settlement, and grants no reply/refund/payment authority.
+
+For genuine newly owned source records, `ingestShopifyCustomerOrder(context, input, {appId})` and `createSupportTicket(context, input, {appId})` reauthorize administrator/app scope inside the owner helper. Their existing GraphQL mutations pass explicit `appId` to this supported path. New order/product/customer keys are app-scoped; customer lookup uses exact app and source customer ID rather than email matching. New records receive immutable app labels. Existing conflicting/deleted/unscoped labels are rejected; legacy records are not retroactively stamped or joined. Product ingestion is bounded to 50 referenced products. Scope-less legacy helper calls preserve their prior behavior, but those unscoped records are ineligible for this context read. Customer/order/product relationships remain native graph edges; this path is source registration, not proof of financial settlement. Deployed owner adoption and genuinely authorized source ingestion are required before real context exists.
+
+### Explicit verified recovery links and content retention
+
+Recovery candidates can expose `recoveryLinkHash`, never the checkout capability URL.
+The source proof reads Shopify's `abandonedCheckoutUrl` plus actual shop identity and primary domain;
+only exact bounded HTTPS provider-owned URLs are supported. `includeVerifiedRecoveryLink: true`
+in a recovery preview explicitly appends that exact current URL before the native unsubscribe capability.
+The reviewed body has a hard 5000-character bound; an unsupported URL or changed source is held.
+Ordinary previews and older candidates without a link hash keep their existing behavior.
+
+Recovery receipts carry `contentStatus: current | redacted`. Redacted receipts omit `body`, `subject`,
+and `recipient.email`; absence never represents an unchanged approved message. Reads recheck the
+current source, purpose consent, suppression and expiry before retaining content. Rejection, expiry,
+and grant revocation remove capability-bearing content without deleting source hashes, unsubscribe
+verification, exact receipt revision, provider acceptance or durable opportunity claims. Unknown outcomes
+remain unknown and cannot retry. Redacted content cannot be approved or submitted.
+
+Native hosts can call administrator-only `retainCrmCheckoutRecoveryContent(context, appId)`
+(or `crm.retainCheckoutRecoveryContent`) for bounded 100-row expired/rejected content cleanup.
+A host maintenance worker should continue until it returns fewer than 100. The public receipt never
+exports the private payload/grant/unsubscribe hashes. Existing unsubscribe verification keeps working
+after content redaction or sending-grant expiry/revocation. Non-recovery content is unchanged.
+
+### Bounded Amazon Connect Support metadata (unreleased)
+
+`configureSupportConnectSource`, `bindSupportConnectConversation` and
+`eraseSupportConnectEvidence` require ordinary native administrator authority. Configure an exact
+app database, Connect instance ARN, path-free IAM relay role and expiry. Binding requires a current,
+explicitly app-owned ticket and native user revision; legacy unscoped records are held. Contact IDs
+remain private. Erasure preserves opaque replay tombstones and does not send or retry anything.
+
+`ingestSupportConnectMetadata` is a private host adapter API, requiring a current native
+`support:channel_ingest` grant and the AWS gateway-owned IAM principal. It performs one bounded
+`DescribeContact` call, verifies the exact contact ARN and VOICE channel, and records only actual
+initiation/disconnect timestamps. Claimed milestones, identity matching, transcripts and reply
+operations are unsupported. The relay scope is deliberately excluded from ordinary Ads credentials.
+
+`readSupportConnectEvidence` / `crm.supportChannelEvidence` require current `support:read` authority.
+The minimized result contains source/ticket revision, channel, observed/ended timestamps, provenance,
+generation time and validity deadline; no contact/customer IDs, bodies, amounts or relay credentials.
+Validity is clamped to current read, source, contributing binding and relay authority expiries, at most
+15 minutes. Current source/binding/grant/ticket changes hold old evidence. Completion is not resolution,
+message delivery, consent, settlement or a sale.
+
+Core source/binding/event/grant checks and replay insertion share one native transaction. Tickets and
+users reside in the app database: their revisions are checked before the provider read, after it,
+immediately before core commit, and independently during inspection. Those checks do not lock the
+app database across the core transaction. A residual cross-database read-to-commit race remains;
+this metadata-only API must not be used as an atomic customer-action authorization proof.
+
+Authenticated reads perform bounded retention cleanup (100 expired bindings and 200 events per read;
+events retain at most 30 days). Dormant sources require an owner-operated cleanup schedule; no live
+schedule or deployment is installed here. Tombstones retain only opaque hashes required to prevent
+re-ingestion after privacy erasure.
+
+The host route is `POST /crm/support/channels/connect`, requiring AWS_IAM and exact qualified-Lambda
+invoke permissions. `apps/api/config/support-connect-route.yaml` is a review-only CloudFormation
+plan, not an automatic deployment. It separates the relay's exact execute-api route from the runtime's
+exact instance/contact `connect:DescribeContact` resource and documented `connect:Channel=VOICE`
+condition. Existing broader invocation policies must be reviewed separately. Local trusted-gateway
+fixtures do not implement or certify live SigV4 verification. Installed provisioning descriptors lack
+HTTP API IAM-route planning; deployment and cloud acceptance remain required before enabling intake.
+
+### Private scheduled recovery/win-back content expiry (unreleased)
+
+`processCrmRecoveryRetention({databaseName, environment}, limit)` is a server maintenance entry,
+not a public GraphQL action or execution-key scope. The database comes only from private host
+configuration. No session or administrator is synthesized. It uses current explicit active `apps`
+registry entries and the public deterministic app/database mapping; legacy inferred names, duplicate
+namespaces, changed revisions, unsupported environments and the control database itself are held.
+
+A domain checkpoint and sixty-second lease serialize workers and rotate discovery beyond the first
+page. One invocation checks at most ten apps and redacts at most one hundred due receipts per app.
+Only `crm_outreach` receipts with an explicit recovery or win-back object and expired/rejected content
+qualify. A single app-database query clears body, subject, unsubscribe token and recipient email,
+with revision conflict checks. It preserves the current document's review/source/purpose proof,
+provider acceptance, unsubscribe hash, unknown/submitting state and opportunity claim edges.
+Ordinary outreach, Support messages, financial records and unexpired content remain unchanged.
+A database/revision failure holds that app; cleanup is idempotent and never sends or retries customers.
+
+`crmRecoveryRetentionWorker.ts` is a private scheduled host entry. The SAM configuration defines a
+fifteen-minute schedule, disabled by default, concurrency one and no public API event or provider/send
+IAM policy. Enable it only after reviewing the actual control registry, per-app database permissions
+and cloud transaction acceptance. At-rest scheduled expiry happens only after deployment and opt-in;
+large receipt/app backlogs need successive bounded passes. Local tests do not certify deployed IAM.
+Registry fencing and app receipt mutation span separate databases; the final registry read does not
+lock the registry across the app transaction. Receipt redaction itself is atomic with revision guards;
+this residual namespace read-to-mutation window cannot authorize customer operations.
+
+### Conditional verified-purchase win-back
+
+`createCrmExecutionKey` accepts a separate `crm:winback` scope only with `crm:outreach` and strict
+`winbackBounds`: exact organization/project/campaign/source IDs, current app-owned issuer IDs,
+`quietDays` 30–365 and cross-outreach `cooldownHours` 24–720. These do not reuse lead-followup or
+checkout-recovery authority. Server-only `CRM_WINBACK_SOURCES` entries require explicit current
+orders/customer/all-orders access approvals and an expiring protected Shopify token. Default 60-day
+order coverage is insufficient.
+
+A customer calls `getOwnCrmWinbackConsent` / `recordCrmWinbackConsent` under their own native session,
+with exact user and independent purpose-document revisions. Merchant administrator intent cannot
+substitute for this consent. The purpose document leaves the user's financial-evidence revision unchanged.
+An administrator can associate it with an existing current canonical financial binding using
+`registerCrmWinbackBinding`; registration never asserts settlement. Actual issued/native evidence,
+current Stripe customer/charge/refunds, positive remaining settlement and exact current Shopify
+shop/customer/order/payment namespace must independently agree. Unsupported gateways, namespace,
+protected access, refunds, suppression or uncertain evidence remain held.
+
+`getCrmWinbackCandidates` / GraphQL `crm.winbackCandidates(input:JSON!)` enumerate at most 25 current
+review candidates from exact registered purchase associations. `complete` and `truncated` describe
+this bounded enumeration, not a customer's global history. Eligibility only proves no recent order
+updates in the verified shop using protected all-order access and its maximum updated order; it never
+claims global inactivity or invents a lifecycle event. Cached candidates contain no provider charge,
+financial binding, source token or recovery URL. A preview uses `winback:{candidateId,revision}`, freezes
+one exact recipient/body/unsubscribe capability and requires separate approval and execution.
+
+All action boundaries recheck purpose, protected source, native financial CAS, actual settlement,
+current recipient/suppression and cadence. The once-only purchase opportunity namespace is actual
+app/shop/customer/charge/purpose, independent of grant, token, campaign and binding aliases. Unknown
+submissions keep their durable claim and cannot retry; CRM's default SES transport explicitly permits
+one SDK attempt. Expired/rejected/withdrawn candidate content is redacted while state, receipt revision,
+provider acceptance and once-only accounting remain. The separate host retention worker covers
+explicit recovery/win-back outreach receipts; deployment/credentials and real provider acceptance
+remain unexercised by the mocked verification suite.

package/docs/GENERATION.md

@@ -127,9 +127,11 @@ const memories = JSON.parse(result.text); // Validate application-specific data
 `responseFormat` supports `{type: 'text'}`, `{type: 'json_object'}`, or
 `{type: 'json_schema', name, schema, strict?, description?}`. `reasoningEffort` accepts
 `none`, `minimal`, `low`, `medium`, `high`, `xhigh`, or `max`; model support is checked by the
-provider. These fields and `messages` are currently OpenAI-only; other providers reject
-them before submitting instead of silently dropping them. Image messages and tools are not
-supported by this text action. Gemini's existing `images` input remains available.
+provider. `reasoningEffort` is OpenAI-only. OpenAI and Gemini support text-only
+`messages`; Gemini supports text and JSON-object response formats, while JSON-schema
+response formats remain OpenAI-only. Unsupported combinations reject before submission.
+Image messages and tools are not supported by this text action. Gemini's existing
+`images` input remains available with prompt input, separately from `messages`.
 
 `timeoutMs` applies to all providers and defaults to 120000. It must be a positive
 32-bit integer. A timeout does not prove the provider stopped working or did not charge.
@@ -211,8 +213,9 @@ callers own model-specific defaults. Existing prompt/system handling, token budg
 timeouts, and completion validation are unchanged. Requests still use one submission.
 
 Gemini JSON schemas, image-generation output controls, and temperature on other
-providers are rejected before submission, rather than silently discarded. Messages
-and reasoning effort remain OpenAI-only. This addition is generic provider transport;
+providers are rejected before submission, rather than silently discarded. Reasoning
+effort remains OpenAI-only; Gemini text conversations are described in the 1.19
+section below. This addition is generic provider transport;
 it contains no application prompts, reviewer choices, or writing policies.
 
 Reference: [Gemini generation configuration](https://ai.google.dev/api/generate-content#v1beta.GenerationConfig).
@@ -308,14 +311,37 @@ policy belongs to callers; Reaktor adds no defaults or application prompts.
 ## Output whitespace
 
 The server-side `generateContent` action accepts `outputTextMode: 'preserve'`
-for Claude Messages and OpenAI/Grok Responses calls. Preserve mode concatenates
-text blocks exactly, adding no separators and keeping surrounding whitespace.
-Claude thinking/redacted-thinking blocks are excluded; unsupported blocks or
-malformed text are rejected in preserve mode. A normally completed, nonblank
-text response is still required.
-
-Omit the option or use `'trim'` to keep existing behavior: OpenAI/Grok trim their
-concatenated text; Claude inserts newlines between text blocks before trimming.
-Other providers reject the option before submission. It is local output policy
-and is never sent to a provider; GraphQL input does not expose it. The option does
-not enable or select Claude thinking settings or alter provider request bodies.
+for Claude Messages, Gemini text, and OpenAI/Grok Responses calls. Preserve mode
+concatenates text blocks exactly by default, retaining surrounding whitespace.
+Claude thinking/redacted-thinking blocks and Gemini thought parts are excluded;
+unsupported or malformed exact output rejects. Normally completed, nonblank
+text remains required.
+
+Omit the option or use trim to keep prior behavior: OpenAI/Grok trim concatenated
+text; Claude/Gemini insert newlines between text blocks before trimming. Ollama
+and image requests reject this option. It is local output policy, never sent to
+providers, and GraphQL input does not expose it. Separate explicit thinking controls
+are described below; output preservation does not select them.
+
+### Exact text parts and Gemini conversations (1.19.0)
+
+`generateContent` accepts `outputTextMode: 'preserve'` for Claude, Gemini,
+OpenAI and Grok text output. Defaults retain existing trimming. For Claude/Gemini
+preserve mode, `outputTextSeparator: '' | '\n'` selects text-block concatenation
+(the default is empty), and `outputTextFilter: 'nonblank'` omits blank blocks
+without trimming retained strings. These controls are never provider request fields.
+Unsupported, incomplete or blank exact output rejects; callers own durable claims
+and must not automatically replay an uncertain submission.
+
+Gemini also accepts text-only `messages` with user/assistant roles. String content
+becomes one text part; arrays of `{type: 'text', text}` preserve text part boundaries.
+Assistant maps to the provider's model role. Supply either prompt or messages;
+`system` remains a separate instruction. Image content and system/developer message
+roles are rejected for this conversation profile. `thinkingLevel` can explicitly
+select minimal, low, medium or high on Gemini text requests; no level is injected
+by default. Model-specific capability/account availability is caller-owned.
+See [Google's thinking controls](https://ai.google.dev/gemini-api/docs/thinking).
+
+## Explicit URL evidence (1.20.0)
+
+Gemini 2.5 Flash text requests with prompt input accept bounded explicit `urlContext` URLs, optionally combined with search. The action exposes verified `grounding` and URL retrieval metadata plus validated provider `usage` counts. Missing or malformed counts remain absent. URL context with `messages` rejects before submission; URLs must never be silently ignored. Output preservation options remain supported. Callers own authorization, durable paid-operation claims, source interpretation and uncertain-outcome reconciliation.

package/lib/actions/alfredFaq.js

@@ -203,4 +203,4 @@ export const faqAction = async (context, operation, value = {})=>{
     }
 };
 
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9Vc2Vycy9uaXRyb2c3L0RldmVsb3BtZW50L3JlYWt0b3IvcGFja2FnZXMvcmVha3Rvci9zcmMvYWN0aW9ucy9hbGZyZWRGYXEudHMiXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtjcmVhdGVIYXNofSBmcm9tICdub2RlOmNyeXB0byc7XG5pbXBvcnQge2FxbH0gZnJvbSAnYXJhbmdvanMnO1xuaW1wb3J0IHt1c2VEYn0gZnJvbSAnLi4vdXRpbHMvYXJhbmdvZGJVdGlscy5qcyc7XG5pbXBvcnQgdHlwZSB7QXBpQ29udGV4dH0gZnJvbSAnLi4vdHlwZXMvYXV0aC50eXBlcy5qcyc7XG5cbmludGVyZmFjZSBGYXFTb3VyY2Uge3RpdGxlOiBzdHJpbmc7IHVybDogc3RyaW5nfVxuaW50ZXJmYWNlIFRvcGljIHsgX2tleTogc3RyaW5nOyBhbnN3ZXI/OiBzdHJpbmc7IGFuc3dlckV4cGlyZXM/OiBudW1iZXI7IGFwcElkOiBzdHJpbmc7IGVtYmVkZGluZz86IG51bWJlcltdOyBraW5kOiBzdHJpbmc7IGxhc3RBc2tlZDogbnVtYmVyOyBwcm9kdWN0Pzogc3RyaW5nOyBxdWVzdGlvbjogc3RyaW5nOyBzb3VyY2VzPzogRmFxU291cmNlW107IHdlaWdodDogbnVtYmVyfVxuaW50ZXJmYWNlIEZhcUlucHV0IHtjaGFubmVsOiAnd2Vic2l0ZScgfCAncGhvbmUnOyBlbWJlZGRpbmc6IG51bWJlcltdOyBldmVudElkOiBzdHJpbmc7IHByb2R1Y3Q6IHN0cmluZzsgcXVlc3Rpb246IHN0cmluZzsgcmV2aXNpb246IG51bWJlcjsgdG9waWNJZDogc3RyaW5nfVxuY29uc3QgaGFzaCA9ICh2YWx1ZTogc3RyaW5nKTogc3RyaW5nID0+IGNyZWF0ZUhhc2goJ3NoYTI1NicpLnVwZGF0ZSh2YWx1ZSkuZGlnZXN0KCdoZXgnKTtcbmNvbnN0IHByb2R1Y3RzID0gbmV3IFNldChbJ2FsZnJlZCcsICduaXRyb2dlbicsICduaXRyb2dlbi1sYWJzJywgJ25pdHJvZ2VuLXN0dWRpb3MnLCAncmVha3RvcicsICdnb3RoYW11aScsICdsYW50ZXJudWknLCAnbWV0cm9wb2xpc2pzJywgJ2Fya2hhbWpzJywgJ2xleCcsICd0b3JjaG9uZScsICdwdWxzaWZ5JywgJ3BoYW50YXplJywgJ3JlYWN0b3Jib3gnXSk7XG5jb25zdCBzYWZlVGV4dCA9ICh2YWx1ZTogdW5rbm93biwgbWF4OiBudW1iZXIpOiB2YWx1ZSBpcyBzdHJpbmcgPT4gdHlwZW9mIHZhbHVlID09PSAnc3RyaW5nJyAmJiB2YWx1ZS50cmltKCkubGVuZ3RoID49IDggJiYgdmFsdWUubGVuZ3RoIDw9IG1heCAmJiAhL1tAPD5dfFxcYig/OnNrX3xBS0lBKXwoPzpcXGRbXFxzKCktXSopezd9L2kudGVzdCh2YWx1ZSk7XG5jb25zdCB2ZWN0b3JWYWxpZCA9ICh2YWx1ZTogdW5rbm93bik6IHZhbHVlIGlzIG51bWJlcltdID0+IEFycmF5LmlzQXJyYXkodmFsdWUpICYmIHZhbHVlLmxlbmd0aCA9PT0gMjU2ICYmIHZhbHVlLmV2ZXJ5KChuKSA9PiB0eXBlb2YgbiA9PT0gJ251bWJlcicgJiYgTnVtYmVyLmlzRmluaXRlKG4pKSAmJiB2YWx1ZS5zb21lKChuKSA9PiBuICE9PSAwKTtcbmNvbnN0IHNvdXJjZVZhbGlkID0gKHNvdXJjZTogRmFxU291cmNlKTogYm9vbGVhbiA9PiB7XG4gIHRyeSB7Y29uc3QgdXJsID0gbmV3IFVSTChzb3VyY2UudXJsKTsgcmV0dXJuIHR5cGVvZiBzb3VyY2UudGl0bGUgPT09ICdzdHJpbmcnICYmIHNvdXJjZS50aXRsZS5sZW5ndGggPD0gMjAwICYmIHVybC5wcm90b2NvbCA9PT0gJ2h0dHBzOicgJiYgIXVybC51c2VybmFtZSAmJiAhdXJsLnBhc3N3b3JkICYmICF1cmwuc2VhcmNoICYmIFsnbml0cm9nZW54LmNvJywgJ3d3dy5uaXRyb2dlbnguY28nLCAncmVha3Rvci5pbycsICd0b3JjaC5vbmUnLCAncHVsc2lmeS5jb20nLCAncGhhbnRhemUuY29tJywgJ3JlYWN0b3Jib3guY29tJywgLi4uWydhbGZyZWQnLCAncmVha3RvcicsICdnb3RoYW11aScsICdsYW50ZXJudWknLCAnbWV0cm9wb2xpc2pzJywgJ2Fya2hhbWpzJywgJ2xleCddLm1hcCgobmFtZSkgPT4gYCR7bmFtZX0ubml0cm9nZW54LmNvYCldLmluY2x1ZGVzKHVybC5ob3N0bmFtZSk7fSBjYXRjaCB7cmV0dXJuIGZhbHNlO31cbn07XG5leHBvcnQgY29uc3QgdmFsaWRhdGVGYXFJbnB1dCA9ICh2YWx1ZTogdW5rbm93bik6IEZhcUlucHV0ID0+IHtcbiAgY29uc3QgdiA9IHZhbHVlIGFzIEZhcUlucHV0O1xuICBpZighdiB8fCAhc2FmZVRleHQodi5xdWVzdGlvbiwgNTAwKSB8fCAhcHJvZHVjdHMuaGFzKHYucHJvZHVjdCkgfHwgIVsnd2Vic2l0ZScsICdwaG9uZSddLmluY2x1ZGVzKHYuY2hhbm5lbCkgfHwgIS9eW2EtZjAtOV17NjR9JC8udGVzdCh2LmV2ZW50SWQpIHx8ICF2ZWN0b3JWYWxpZCh2LmVtYmVkZGluZykgfHwgIU51bWJlci5pc1NhZmVJbnRlZ2VyKHYucmV2aXNpb24pIHx8IHYucmV2aXNpb24gPCAwIHx8IHR5cGVvZiB2LnRvcGljSWQgIT09ICdzdHJpbmcnIHx8ICh2LnRvcGljSWQgJiYgIS9edG9waWMtW2EtZjAtOV17NjR9JC8udGVzdCh2LnRvcGljSWQpKSkgdGhyb3cgbmV3IEVycm9yKCdpbnZhbGlkX2ZhcV9pbnB1dCcpO1xuICByZXR1cm4ge2NoYW5uZWw6IHYuY2hhbm5lbCwgZW1iZWRkaW5nOiB2LmVtYmVkZGluZywgZXZlbnRJZDogdi5ldmVudElkLCBwcm9kdWN0OiB2LnByb2R1Y3QsIHF1ZXN0aW9uOiB2LnF1ZXN0aW9uLnRyaW0oKSwgcmV2aXNpb246IHYucmV2aXNpb24sIHRvcGljSWQ6IHYudG9waWNJZH07XG59O1xuZXhwb3J0IGNvbnN0IHB1YmxpY0ZhcSA9ICh0b3BpY3M6IFRvcGljW10sIG5vdzogbnVtYmVyKSA9PiB0b3BpY3MuZmlsdGVyKCh0b3BpYykgPT4gdG9waWMuYXBwSWQgPT09ICduaXRyb2dlbngnICYmIHRvcGljLmtpbmQgPT09ICd0b3BpYycgJiYgdG9waWMud2VpZ2h0ID49IDMgJiYgc2FmZVRleHQodG9waWMuYW5zd2VyLCAyNTAwKSAmJiAodG9waWMuYW5zd2VyRXhwaXJlcyB8fCAwKSA+IG5vdyAmJiB0b3BpYy5zb3VyY2VzPy5sZW5ndGggJiYgdG9waWMuc291cmNlcy5ldmVyeShzb3VyY2VWYWxpZCkpLnNvcnQoKGEsIGIpID0+IGIud2VpZ2h0IC0gYS53ZWlnaHQgfHwgYi5sYXN0QXNrZWQgLSBhLmxhc3RBc2tlZCB8fCBhLl9rZXkubG9jYWxlQ29tcGFyZShiLl9rZXkpKS5zbGljZSgwLCAxNSkubWFwKCh7X2tleSwgYW5zd2VyLCBxdWVzdGlvbiwgc291cmNlc30pID0+ICh7YW5zd2VyLCBpZDogX2tleSwgcXVlc3Rpb24sIHNvdXJjZXN9KSk7XG5jb25zdCBjb3NpbmUgPSAoYTogbnVtYmVyW10sIGI6IG51bWJlcltdKTogbnVtYmVyID0+IHtcbiAgaWYoIXZlY3RvclZhbGlkKGIpKSByZXR1cm4gLTE7XG4gIHJldHVybiBhLnJlZHVjZSgoc3VtLCBuLCBpKSA9PiBzdW0gKyBuICogYltpXSwgMCkgLyBNYXRoLnNxcnQoYS5yZWR1Y2UoKHN1bSwgbikgPT4gc3VtICsgbiAqIG4sIDApICogYi5yZWR1Y2UoKHN1bSwgbikgPT4gc3VtICsgbiAqIG4sIDApKTtcbn07XG5leHBvcnQgY29uc3QgZmFxQWN0aW9uID0gYXN5bmMgKGNvbnRleHQ6IEFwaUNvbnRleHQsIG9wZXJhdGlvbjogc3RyaW5nLCB2YWx1ZTogdW5rbm93biA9IHt9KSA9PiB7XG4gIGNvbnN0IGRiID0gdXNlRGIoY29udGV4dC5kYXRhYmFzZU5hbWUpO1xuICBjb25zdCBjb2xsZWN0aW9uID0gZGIuY29sbGVjdGlvbignYWxmcmVkRmFxJyk7XG4gIGlmKCFhd2FpdCBjb2xsZWN0aW9uLmV4aXN0cygpKSB7dHJ5IHthd2FpdCBjb2xsZWN0aW9uLmNyZWF0ZSgpO30gY2F0Y2goZXJyb3IpIHtpZighYXdhaXQgY29sbGVjdGlvbi5leGlzdHMoKSkgdGhyb3cgZXJyb3I7fX1cbiAgYXdhaXQgY29sbGVjdGlvbi5lbnN1cmVJbmRleCh7ZmllbGRzOiBbJ2FwcElkJywgJ2tpbmQnLCAncHJvZHVjdCddLCB0eXBlOiAncGVyc2lzdGVudCd9KTtcbiAgY29uc3QgaW5wdXQgPSB2YWx1ZSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgaWYob3BlcmF0aW9uID09PSAnbGlzdCcgfHwgb3BlcmF0aW9uID09PSAncmVmcmVzaC1saXN0Jykge1xuICAgIGNvbnN0IHRvcGljcyA9IGF3YWl0IGRiLnF1ZXJ5KGFxbGBGT1IgdCBJTiBhbGZyZWRGYXEgRklMVEVSIHQuYXBwSWQgPT0gJ25pdHJvZ2VueCcgQU5EIHQua2luZCA9PSAndG9waWMnIEFORCB0LndlaWdodCA+PSAzIFNPUlQgdC53ZWlnaHQgREVTQywgdC5sYXN0QXNrZWQgREVTQywgdC5fa2V5IEFTQyBSRVRVUk4gdGApLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLmFsbCgpKSBhcyBUb3BpY1tdO1xuICAgIHJldHVybiBvcGVyYXRpb24gPT09ICdsaXN0JyA/IHtpdGVtczogcHVibGljRmFxKHRvcGljcy5maWx0ZXIoKHRvcGljKSA9PiAodG9waWMgYXMgVG9waWMgJiB7c291cmNlUmV2aXNpb24/OiBzdHJpbmd9KS5zb3VyY2VSZXZpc2lvbiA9PT0gaW5wdXQuc291cmNlUmV2aXNpb24pLCBEYXRlLm5vdygpKX0gOiB7aXRlbXM6IHRvcGljc307XG4gIH1cbiAgaWYob3BlcmF0aW9uID09PSAncmVmcmVzaCcpIHtcbiAgICBpZih0eXBlb2YgaW5wdXQudG9waWNJZCAhPT0gJ3N0cmluZycgfHwgIS9edG9waWMtW2EtZjAtOV17NjR9JC8udGVzdChpbnB1dC50b3BpY0lkKSkgdGhyb3cgbmV3IEVycm9yKCdpbnZhbGlkX2ZhcV9pbnB1dCcpO1xuICAgIGNvbnN0IHZhbGlkID0gc2FmZVRleHQoaW5wdXQuYW5zd2VyLCAyNTAwKSAmJiBBcnJheS5pc0FycmF5KGlucHV0LnNvdXJjZXMpICYmIGlucHV0LnNvdXJjZXMubGVuZ3RoID4gMCAmJiBpbnB1dC5zb3VyY2VzLmxlbmd0aCA8PSAzICYmIGlucHV0LnNvdXJjZXMuZXZlcnkoc291cmNlVmFsaWQpICYmIHR5cGVvZiBpbnB1dC5hbnN3ZXJFeHBpcmVzID09PSAnbnVtYmVyJyAmJiBpbnB1dC5hbnN3ZXJFeHBpcmVzID4gRGF0ZS5ub3coKSAmJiBpbnB1dC5hbnN3ZXJFeHBpcmVzIDw9IERhdGUubm93KCkgKyAxNCAqIDg2NDAwMDAwO1xuICAgIGF3YWl0IGRiLnF1ZXJ5KGFxbGBGT1IgdCBJTiBhbGZyZWRGYXEgRklMVEVSIHQuX2tleSA9PSAke2lucHV0LnRvcGljSWR9IEFORCB0LmFwcElkID09ICduaXRyb2dlbngnIEFORCB0LmtpbmQgPT0gJ3RvcGljJyBVUERBVEUgdCBXSVRIICR7dmFsaWQgPyB7YW5zd2VyOiBpbnB1dC5hbnN3ZXIsIGFuc3dlckV4cGlyZXM6IGlucHV0LmFuc3dlckV4cGlyZXMsIHJlZnJlc2hBZnRlcjogRGF0ZS5ub3coKSArIDEyICogMzYwMDAwMCwgc291cmNlUmV2aXNpb246IGlucHV0LnNvdXJjZVJldmlzaW9uLCBzb3VyY2VzOiBpbnB1dC5zb3VyY2VzfSA6IHthbnN3ZXI6IG51bGwsIGFuc3dlckV4cGlyZXM6IDAsIHJlZnJlc2hBZnRlcjogRGF0ZS5ub3coKSArIDEyICogMzYwMDAwMCwgc291cmNlUmV2aXNpb246IGlucHV0LnNvdXJjZVJldmlzaW9uLCBzb3VyY2VzOiBbXX19IElOIGFsZnJlZEZhcWApO1xuICAgIHJldHVybiB7b2s6IHRydWV9O1xuICB9XG4gIGlmKG9wZXJhdGlvbiAhPT0gJ3JlY29yZCcgJiYgb3BlcmF0aW9uICE9PSAnY2FuZGlkYXRlcycpIHRocm93IG5ldyBFcnJvcignaW52YWxpZF9mYXFfaW5wdXQnKTtcbiAgY29uc3QgZXZlbnQgPSB2YWxpZGF0ZUZhcUlucHV0KHZhbHVlKTtcbiAgY29uc3QgbWV0YUtleSA9IGBjYXRhbG9nLSR7ZXZlbnQucHJvZHVjdH1gO1xuICBjb25zdCB0eCA9IGF3YWl0IGRiLmJlZ2luVHJhbnNhY3Rpb24oe2V4Y2x1c2l2ZTogWydhbGZyZWRGYXEnXX0sIHtsb2NrVGltZW91dDogMTB9KTtcbiAgY29uc3QgbmV4dCA9IGFzeW5jIChxdWVyeTogUmV0dXJuVHlwZTx0eXBlb2YgYXFsPikgPT4gdHguc3RlcCgoKSA9PiBkYi5xdWVyeShxdWVyeSkpLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLm5leHQoKSBhcyBQcm9taXNlPHthcHBJZD86IHN0cmluZzsga2luZD86IHN0cmluZzsgcHJvZHVjdD86IHN0cmluZzsgcmV2aXNpb24/OiBudW1iZXI7IHRvcGljSWQ/OiBzdHJpbmd9IHwgbnVsbD4pO1xuICB0cnkge1xuICAgIGlmKG9wZXJhdGlvbiA9PT0gJ2NhbmRpZGF0ZXMnKSB7XG4gICAgICBjb25zdCBtZXRhID0gYXdhaXQgbmV4dChhcWxgUkVUVVJOIERPQ1VNRU5UKCdhbGZyZWRGYXEnLCAke21ldGFLZXl9KWApO1xuICAgICAgY29uc3QgdG9waWNzID0gYXdhaXQgdHguc3RlcCgoKSA9PiBkYi5xdWVyeShhcWxgRk9SIHQgSU4gYWxmcmVkRmFxIEZJTFRFUiB0LmFwcElkID09ICduaXRyb2dlbngnIEFORCB0LmtpbmQgPT0gJ3RvcGljJyBBTkQgdC5wcm9kdWN0ID09ICR7ZXZlbnQucHJvZHVjdH0gUkVUVVJOIHRgKSkudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IuYWxsKCkpIGFzIFRvcGljW107XG4gICAgICBhd2FpdCB0eC5jb21taXQoKTtcbiAgICAgIHJldHVybiB7Y2FuZGlkYXRlczogdG9waWNzLm1hcCgodG9waWMpID0+ICh7aWQ6IHRvcGljLl9rZXksIHF1ZXN0aW9uOiB0b3BpYy5xdWVzdGlvbiwgc2NvcmU6IGNvc2luZShldmVudC5lbWJlZGRpbmcsIHRvcGljLmVtYmVkZGluZyB8fCBbXSl9KSkuZmlsdGVyKCh0b3BpYykgPT4gdG9waWMuc2NvcmUgPj0gMC41NSkuc29ydCgoYSwgYikgPT4gYi5zY29yZSAtIGEuc2NvcmUpLnNsaWNlKDAsIDgpLCByZXZpc2lvbjogbWV0YT8ucmV2aXNpb24gfHwgMH07XG4gICAgfVxuICAgIGNvbnN0IGtleSA9IGBxdWVzdGlvbi0ke2V2ZW50LmV2ZW50SWR9YDtcbiAgICBjb25zdCBleGlzdGluZyA9IGF3YWl0IG5leHQoYXFsYFJFVFVSTiBET0NVTUVOVCgnYWxmcmVkRmFxJywgJHtrZXl9KWApO1xuICAgIGlmKGV4aXN0aW5nKSB7YXdhaXQgdHguY29tbWl0KCk7IHJldHVybiB7ZHVwbGljYXRlOiB0cnVlLCB0b3BpY0lkOiBleGlzdGluZy50b3BpY0lkfTt9XG4gICAgY29uc3QgbWV0YSA9IGF3YWl0IG5leHQoYXFsYFJFVFVSTiBET0NVTUVOVCgnYWxmcmVkRmFxJywgJHttZXRhS2V5fSlgKTtcbiAgICBpZigobWV0YT8ucmV2aXNpb24gfHwgMCkgIT09IGV2ZW50LnJldmlzaW9uKSB0aHJvdyBuZXcgRXJyb3IoJ2ZhcV9yZXZpc2lvbl9jb25mbGljdCcpO1xuICAgIGNvbnN0IHRvcGljSWQgPSBldmVudC50b3BpY0lkIHx8IGB0b3BpYy0ke2hhc2goYCR7ZXZlbnQucHJvZHVjdH06JHtldmVudC5xdWVzdGlvbi50b0xvd2VyQ2FzZSgpfWApfWA7XG4gICAgY29uc3QgdGltZXN0YW1wID0gRGF0ZS5ub3coKTtcbiAgICBpZihldmVudC50b3BpY0lkKSB7XG4gICAgICBjb25zdCB0b3BpYyA9IGF3YWl0IG5leHQoYXFsYFJFVFVSTiBET0NVTUVOVCgnYWxmcmVkRmFxJywgJHt0b3BpY0lkfSlgKTtcbiAgICAgIGlmKCF0b3BpYyB8fCB0b3BpYy5hcHBJZCAhPT0gJ25pdHJvZ2VueCcgfHwgdG9waWMucHJvZHVjdCAhPT0gZXZlbnQucHJvZHVjdCB8fCB0b3BpYy5raW5kICE9PSAndG9waWMnKSB0aHJvdyBuZXcgRXJyb3IoJ2ludmFsaWRfZmFxX2lucHV0Jyk7XG4gICAgfVxuICAgIGF3YWl0IG5leHQoYXFsYFVQU0VSVCB7X2tleTogJHt0b3BpY0lkfX0gSU5TRVJUICR7e19rZXk6IHRvcGljSWQsIGFuc3dlckV4cGlyZXM6IDAsIGFwcElkOiAnbml0cm9nZW54JywgZW1iZWRkaW5nOiBldmVudC5lbWJlZGRpbmcsIGVtYmVkZGluZ01vZGVsOiAnYW1hem9uLnRpdGFuLWVtYmVkLXRleHQtdjI6MC8yNTYnLCBmaXJzdEFza2VkOiB0aW1lc3RhbXAsIGtpbmQ6ICd0b3BpYycsIGxhc3RBc2tlZDogdGltZXN0YW1wLCBwaG9uZUNvdW50OiBldmVudC5jaGFubmVsID09PSAncGhvbmUnID8gMSA6IDAsIHByb2R1Y3Q6IGV2ZW50LnByb2R1Y3QsIHF1ZXN0aW9uOiBldmVudC5xdWVzdGlvbiwgd2Vic2l0ZUNvdW50OiBldmVudC5jaGFubmVsID09PSAnd2Vic2l0ZScgPyAxIDogMCwgd2VpZ2h0OiAxfX0gVVBEQVRFIHtsYXN0QXNrZWQ6ICR7dGltZXN0YW1wfSwgd2VpZ2h0OiBPTEQud2VpZ2h0ICsgMSwgcGhvbmVDb3VudDogT0xELnBob25lQ291bnQgKyAke2V2ZW50LmNoYW5uZWwgPT09ICdwaG9uZScgPyAxIDogMH0sIHdlYnNpdGVDb3VudDogT0xELndlYnNpdGVDb3VudCArICR7ZXZlbnQuY2hhbm5lbCA9PT0gJ3dlYnNpdGUnID8gMSA6IDB9fSBJTiBhbGZyZWRGYXFgKTtcbiAgICBhd2FpdCBuZXh0KGFxbGBJTlNFUlQgJHt7X2tleToga2V5LCBhcHBJZDogJ25pdHJvZ2VueCcsIGNoYW5uZWw6IGV2ZW50LmNoYW5uZWwsIGNsYXNzaWZpZXJWZXJzaW9uOiAxLCBjcmVhdGVkOiB0aW1lc3RhbXAsIGtpbmQ6ICdxdWVzdGlvbicsIHByb2R1Y3Q6IGV2ZW50LnByb2R1Y3QsIHF1ZXN0aW9uOiBldmVudC5xdWVzdGlvbiwgdG9waWNJZH19IElOIGFsZnJlZEZhcWApO1xuICAgIGF3YWl0IG5leHQoYXFsYFVQU0VSVCB7X2tleTogJHttZXRhS2V5fX0gSU5TRVJUICR7e19rZXk6IG1ldGFLZXksIGFwcElkOiAnbml0cm9nZW54Jywga2luZDogJ2NhdGFsb2cnLCByZXZpc2lvbjogZXZlbnQucmV2aXNpb24gKyAxfX0gVVBEQVRFIHtyZXZpc2lvbjogJHtldmVudC5yZXZpc2lvbiArIDF9fSBJTiBhbGZyZWRGYXFgKTtcbiAgICBhd2FpdCB0eC5jb21taXQoKTtcbiAgICByZXR1cm4ge2R1cGxpY2F0ZTogZmFsc2UsIHRvcGljSWR9O1xuICB9IGNhdGNoKGVycm9yKSB7YXdhaXQgdHguYWJvcnQoKTsgdGhyb3cgZXJyb3I7fVxufTtcbiJdLCJuYW1lcyI6WyJjcmVhdGVIYXNoIiwiYXFsIiwidXNlRGIiLCJoYXNoIiwidmFsdWUiLCJ1cGRhdGUiLCJkaWdlc3QiLCJwcm9kdWN0cyIsIlNldCIsInNhZmVUZXh0IiwibWF4IiwidHJpbSIsImxlbmd0aCIsInRlc3QiLCJ2ZWN0b3JWYWxpZCIsIkFycmF5IiwiaXNBcnJheSIsImV2ZXJ5IiwibiIsIk51bWJlciIsImlzRmluaXRlIiwic29tZSIsInNvdXJjZVZhbGlkIiwic291cmNlIiwidXJsIiwiVVJMIiwidGl0bGUiLCJwcm90b2NvbCIsInVzZXJuYW1lIiwicGFzc3dvcmQiLCJzZWFyY2giLCJtYXAiLCJuYW1lIiwiaW5jbHVkZXMiLCJob3N0bmFtZSIsInZhbGlkYXRlRmFxSW5wdXQiLCJ2IiwicXVlc3Rpb24iLCJoYXMiLCJwcm9kdWN0IiwiY2hhbm5lbCIsImV2ZW50SWQiLCJlbWJlZGRpbmciLCJpc1NhZmVJbnRlZ2VyIiwicmV2aXNpb24iLCJ0b3BpY0lkIiwiRXJyb3IiLCJwdWJsaWNGYXEiLCJ0b3BpY3MiLCJub3ciLCJmaWx0ZXIiLCJ0b3BpYyIsImFwcElkIiwia2luZCIsIndlaWdodCIsImFuc3dlciIsImFuc3dlckV4cGlyZXMiLCJzb3VyY2VzIiwic29ydCIsImEiLCJiIiwibGFzdEFza2VkIiwiX2tleSIsImxvY2FsZUNvbXBhcmUiLCJzbGljZSIsImlkIiwiY29zaW5lIiwicmVkdWNlIiwic3VtIiwiaSIsIk1hdGgiLCJzcXJ0IiwiZmFxQWN0aW9uIiwiY29udGV4dCIsIm9wZXJhdGlvbiIsImRiIiwiZGF0YWJhc2VOYW1lIiwiY29sbGVjdGlvbiIsImV4aXN0cyIsImNyZWF0ZSIsImVycm9yIiwiZW5zdXJlSW5kZXgiLCJmaWVsZHMiLCJ0eXBlIiwiaW5wdXQiLCJxdWVyeSIsInRoZW4iLCJjdXJzb3IiLCJhbGwiLCJpdGVtcyIsInNvdXJjZVJldmlzaW9uIiwiRGF0ZSIsInZhbGlkIiwicmVmcmVzaEFmdGVyIiwib2siLCJldmVudCIsIm1ldGFLZXkiLCJ0eCIsImJlZ2luVHJhbnNhY3Rpb24iLCJleGNsdXNpdmUiLCJsb2NrVGltZW91dCIsIm5leHQiLCJzdGVwIiwibWV0YSIsImNvbW1pdCIsImNhbmRpZGF0ZXMiLCJzY29yZSIsImtleSIsImV4aXN0aW5nIiwiZHVwbGljYXRlIiwidG9Mb3dlckNhc2UiLCJ0aW1lc3RhbXAiLCJlbWJlZGRpbmdNb2RlbCIsImZpcnN0QXNrZWQiLCJwaG9uZUNvdW50Iiwid2Vic2l0ZUNvdW50IiwiY2xhc3NpZmllclZlcnNpb24iLCJjcmVhdGVkIiwiYWJvcnQiXSwibWFwcGluZ3MiOiJBQUFBLFNBQVFBLFVBQVUsUUFBTyxjQUFjO0FBQ3ZDLFNBQVFDLEdBQUcsUUFBTyxXQUFXO0FBQzdCLFNBQVFDLEtBQUssUUFBTyw0QkFBNEI7QUFNaEQsTUFBTUMsT0FBTyxDQUFDQyxRQUEwQkosV0FBVyxVQUFVSyxNQUFNLENBQUNELE9BQU9FLE1BQU0sQ0FBQztBQUNsRixNQUFNQyxXQUFXLElBQUlDLElBQUk7SUFBQztJQUFVO0lBQVk7SUFBaUI7SUFBb0I7SUFBVztJQUFZO0lBQWE7SUFBZ0I7SUFBWTtJQUFPO0lBQVk7SUFBVztJQUFZO0NBQWE7QUFDNU0sTUFBTUMsV0FBVyxDQUFDTCxPQUFnQk0sTUFBaUMsT0FBT04sVUFBVSxZQUFZQSxNQUFNTyxJQUFJLEdBQUdDLE1BQU0sSUFBSSxLQUFLUixNQUFNUSxNQUFNLElBQUlGLE9BQU8sQ0FBQywwQ0FBMENHLElBQUksQ0FBQ1Q7QUFDbk0sTUFBTVUsY0FBYyxDQUFDVixRQUFzQ1csTUFBTUMsT0FBTyxDQUFDWixVQUFVQSxNQUFNUSxNQUFNLEtBQUssT0FBT1IsTUFBTWEsS0FBSyxDQUFDLENBQUNDLElBQU0sT0FBT0EsTUFBTSxZQUFZQyxPQUFPQyxRQUFRLENBQUNGLE9BQU9kLE1BQU1pQixJQUFJLENBQUMsQ0FBQ0gsSUFBTUEsTUFBTTtBQUN0TSxNQUFNSSxjQUFjLENBQUNDO0lBQ25CLElBQUk7UUFBQyxNQUFNQyxNQUFNLElBQUlDLElBQUlGLE9BQU9DLEdBQUc7UUFBRyxPQUFPLE9BQU9ELE9BQU9HLEtBQUssS0FBSyxZQUFZSCxPQUFPRyxLQUFLLENBQUNkLE1BQU0sSUFBSSxPQUFPWSxJQUFJRyxRQUFRLEtBQUssWUFBWSxDQUFDSCxJQUFJSSxRQUFRLElBQUksQ0FBQ0osSUFBSUssUUFBUSxJQUFJLENBQUNMLElBQUlNLE1BQU0sSUFBSTtZQUFDO1lBQWdCO1lBQW9CO1lBQWM7WUFBYTtZQUFlO1lBQWdCO2VBQXFCO2dCQUFDO2dCQUFVO2dCQUFXO2dCQUFZO2dCQUFhO2dCQUFnQjtnQkFBWTthQUFNLENBQUNDLEdBQUcsQ0FBQyxDQUFDQyxPQUFTLEdBQUdBLEtBQUssYUFBYSxDQUFDO1NBQUUsQ0FBQ0MsUUFBUSxDQUFDVCxJQUFJVSxRQUFRO0lBQUUsRUFBRSxPQUFNO1FBQUMsT0FBTztJQUFNO0FBQ3pkO0FBQ0EsT0FBTyxNQUFNQyxtQkFBbUIsQ0FBQy9CO0lBQy9CLE1BQU1nQyxJQUFJaEM7SUFDVixJQUFHLENBQUNnQyxLQUFLLENBQUMzQixTQUFTMkIsRUFBRUMsUUFBUSxFQUFFLFFBQVEsQ0FBQzlCLFNBQVMrQixHQUFHLENBQUNGLEVBQUVHLE9BQU8sS0FBSyxDQUFDO1FBQUM7UUFBVztLQUFRLENBQUNOLFFBQVEsQ0FBQ0csRUFBRUksT0FBTyxLQUFLLENBQUMsaUJBQWlCM0IsSUFBSSxDQUFDdUIsRUFBRUssT0FBTyxLQUFLLENBQUMzQixZQUFZc0IsRUFBRU0sU0FBUyxLQUFLLENBQUN2QixPQUFPd0IsYUFBYSxDQUFDUCxFQUFFUSxRQUFRLEtBQUtSLEVBQUVRLFFBQVEsR0FBRyxLQUFLLE9BQU9SLEVBQUVTLE9BQU8sS0FBSyxZQUFhVCxFQUFFUyxPQUFPLElBQUksQ0FBQyx1QkFBdUJoQyxJQUFJLENBQUN1QixFQUFFUyxPQUFPLEdBQUksTUFBTSxJQUFJQyxNQUFNO0lBQ2xWLE9BQU87UUFBQ04sU0FBU0osRUFBRUksT0FBTztRQUFFRSxXQUFXTixFQUFFTSxTQUFTO1FBQUVELFNBQVNMLEVBQUVLLE9BQU87UUFBRUYsU0FBU0gsRUFBRUcsT0FBTztRQUFFRixVQUFVRCxFQUFFQyxRQUFRLENBQUMxQixJQUFJO1FBQUlpQyxVQUFVUixFQUFFUSxRQUFRO1FBQUVDLFNBQVNULEVBQUVTLE9BQU87SUFBQTtBQUNuSyxFQUFFO0FBQ0YsT0FBTyxNQUFNRSxZQUFZLENBQUNDLFFBQWlCQyxNQUFnQkQsT0FBT0UsTUFBTSxDQUFDLENBQUNDLFFBQVVBLE1BQU1DLEtBQUssS0FBSyxlQUFlRCxNQUFNRSxJQUFJLEtBQUssV0FBV0YsTUFBTUcsTUFBTSxJQUFJLEtBQUs3QyxTQUFTMEMsTUFBTUksTUFBTSxFQUFFLFNBQVMsQUFBQ0osQ0FBQUEsTUFBTUssYUFBYSxJQUFJLENBQUEsSUFBS1AsT0FBT0UsTUFBTU0sT0FBTyxFQUFFN0MsVUFBVXVDLE1BQU1NLE9BQU8sQ0FBQ3hDLEtBQUssQ0FBQ0ssY0FBY29DLElBQUksQ0FBQyxDQUFDQyxHQUFHQyxJQUFNQSxFQUFFTixNQUFNLEdBQUdLLEVBQUVMLE1BQU0sSUFBSU0sRUFBRUMsU0FBUyxHQUFHRixFQUFFRSxTQUFTLElBQUlGLEVBQUVHLElBQUksQ0FBQ0MsYUFBYSxDQUFDSCxFQUFFRSxJQUFJLEdBQUdFLEtBQUssQ0FBQyxHQUFHLElBQUlqQyxHQUFHLENBQUMsQ0FBQyxFQUFDK0IsSUFBSSxFQUFFUCxNQUFNLEVBQUVsQixRQUFRLEVBQUVvQixPQUFPLEVBQUMsR0FBTSxDQUFBO1lBQUNGO1lBQVFVLElBQUlIO1lBQU16QjtZQUFVb0I7UUFBTyxDQUFBLEdBQUk7QUFDbmUsTUFBTVMsU0FBUyxDQUFDUCxHQUFhQztJQUMzQixJQUFHLENBQUM5QyxZQUFZOEMsSUFBSSxPQUFPLENBQUM7SUFDNUIsT0FBT0QsRUFBRVEsTUFBTSxDQUFDLENBQUNDLEtBQUtsRCxHQUFHbUQsSUFBTUQsTUFBTWxELElBQUkwQyxDQUFDLENBQUNTLEVBQUUsRUFBRSxLQUFLQyxLQUFLQyxJQUFJLENBQUNaLEVBQUVRLE1BQU0sQ0FBQyxDQUFDQyxLQUFLbEQsSUFBTWtELE1BQU1sRCxJQUFJQSxHQUFHLEtBQUswQyxFQUFFTyxNQUFNLENBQUMsQ0FBQ0MsS0FBS2xELElBQU1rRCxNQUFNbEQsSUFBSUEsR0FBRztBQUN6STtBQUNBLE9BQU8sTUFBTXNELFlBQVksT0FBT0MsU0FBcUJDLFdBQW1CdEUsUUFBaUIsQ0FBQyxDQUFDO0lBQ3pGLE1BQU11RSxLQUFLekUsTUFBTXVFLFFBQVFHLFlBQVk7SUFDckMsTUFBTUMsYUFBYUYsR0FBR0UsVUFBVSxDQUFDO0lBQ2pDLElBQUcsQ0FBQyxNQUFNQSxXQUFXQyxNQUFNLElBQUk7UUFBQyxJQUFJO1lBQUMsTUFBTUQsV0FBV0UsTUFBTTtRQUFHLEVBQUUsT0FBTUMsT0FBTztZQUFDLElBQUcsQ0FBQyxNQUFNSCxXQUFXQyxNQUFNLElBQUksTUFBTUU7UUFBTTtJQUFDO0lBQzNILE1BQU1ILFdBQVdJLFdBQVcsQ0FBQztRQUFDQyxRQUFRO1lBQUM7WUFBUztZQUFRO1NBQVU7UUFBRUMsTUFBTTtJQUFZO0lBQ3RGLE1BQU1DLFFBQVFoRjtJQUNkLElBQUdzRSxjQUFjLFVBQVVBLGNBQWMsZ0JBQWdCO1FBQ3ZELE1BQU0xQixTQUFTLE1BQU0yQixHQUFHVSxLQUFLLENBQUNwRixHQUFHLENBQUMsa0pBQWtKLENBQUMsRUFBRXFGLElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPQyxHQUFHO1FBQ2xOLE9BQU9kLGNBQWMsU0FBUztZQUFDZSxPQUFPMUMsVUFBVUMsT0FBT0UsTUFBTSxDQUFDLENBQUNDLFFBQVUsQUFBQ0EsTUFBNEN1QyxjQUFjLEtBQUtOLE1BQU1NLGNBQWMsR0FBR0MsS0FBSzFDLEdBQUc7UUFBRyxJQUFJO1lBQUN3QyxPQUFPekM7UUFBTTtJQUMvTDtJQUNBLElBQUcwQixjQUFjLFdBQVc7UUFDMUIsSUFBRyxPQUFPVSxNQUFNdkMsT0FBTyxLQUFLLFlBQVksQ0FBQyx1QkFBdUJoQyxJQUFJLENBQUN1RSxNQUFNdkMsT0FBTyxHQUFHLE1BQU0sSUFBSUMsTUFBTTtRQUNyRyxNQUFNOEMsUUFBUW5GLFNBQVMyRSxNQUFNN0IsTUFBTSxFQUFFLFNBQVN4QyxNQUFNQyxPQUFPLENBQUNvRSxNQUFNM0IsT0FBTyxLQUFLMkIsTUFBTTNCLE9BQU8sQ0FBQzdDLE1BQU0sR0FBRyxLQUFLd0UsTUFBTTNCLE9BQU8sQ0FBQzdDLE1BQU0sSUFBSSxLQUFLd0UsTUFBTTNCLE9BQU8sQ0FBQ3hDLEtBQUssQ0FBQ0ssZ0JBQWdCLE9BQU84RCxNQUFNNUIsYUFBYSxLQUFLLFlBQVk0QixNQUFNNUIsYUFBYSxHQUFHbUMsS0FBSzFDLEdBQUcsTUFBTW1DLE1BQU01QixhQUFhLElBQUltQyxLQUFLMUMsR0FBRyxLQUFLLEtBQUs7UUFDblMsTUFBTTBCLEdBQUdVLEtBQUssQ0FBQ3BGLEdBQUcsQ0FBQyxvQ0FBb0MsRUFBRW1GLE1BQU12QyxPQUFPLENBQUMsZ0VBQWdFLEVBQUUrQyxRQUFRO1lBQUNyQyxRQUFRNkIsTUFBTTdCLE1BQU07WUFBRUMsZUFBZTRCLE1BQU01QixhQUFhO1lBQUVxQyxjQUFjRixLQUFLMUMsR0FBRyxLQUFLLEtBQUs7WUFBU3lDLGdCQUFnQk4sTUFBTU0sY0FBYztZQUFFakMsU0FBUzJCLE1BQU0zQixPQUFPO1FBQUEsSUFBSTtZQUFDRixRQUFRO1lBQU1DLGVBQWU7WUFBR3FDLGNBQWNGLEtBQUsxQyxHQUFHLEtBQUssS0FBSztZQUFTeUMsZ0JBQWdCTixNQUFNTSxjQUFjO1lBQUVqQyxTQUFTLEVBQUU7UUFBQSxFQUFFLGFBQWEsQ0FBQztRQUNoYyxPQUFPO1lBQUNxQyxJQUFJO1FBQUk7SUFDbEI7SUFDQSxJQUFHcEIsY0FBYyxZQUFZQSxjQUFjLGNBQWMsTUFBTSxJQUFJNUIsTUFBTTtJQUN6RSxNQUFNaUQsUUFBUTVELGlCQUFpQi9CO0lBQy9CLE1BQU00RixVQUFVLENBQUMsUUFBUSxFQUFFRCxNQUFNeEQsT0FBTyxFQUFFO0lBQzFDLE1BQU0wRCxLQUFLLE1BQU10QixHQUFHdUIsZ0JBQWdCLENBQUM7UUFBQ0MsV0FBVztZQUFDO1NBQVk7SUFBQSxHQUFHO1FBQUNDLGFBQWE7SUFBRTtJQUNqRixNQUFNQyxPQUFPLE9BQU9oQixRQUFrQ1ksR0FBR0ssSUFBSSxDQUFDLElBQU0zQixHQUFHVSxLQUFLLENBQUNBLFFBQVFDLElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPYyxJQUFJO0lBQ2pILElBQUk7UUFDRixJQUFHM0IsY0FBYyxjQUFjO1lBQzdCLE1BQU02QixPQUFPLE1BQU1GLEtBQUtwRyxHQUFHLENBQUMsNkJBQTZCLEVBQUUrRixRQUFRLENBQUMsQ0FBQztZQUNyRSxNQUFNaEQsU0FBUyxNQUFNaUQsR0FBR0ssSUFBSSxDQUFDLElBQU0zQixHQUFHVSxLQUFLLENBQUNwRixHQUFHLENBQUMsd0ZBQXdGLEVBQUU4RixNQUFNeEQsT0FBTyxDQUFDLFNBQVMsQ0FBQyxHQUFHK0MsSUFBSSxDQUFDLENBQUNDLFNBQVdBLE9BQU9DLEdBQUc7WUFDaE0sTUFBTVMsR0FBR08sTUFBTTtZQUNmLE9BQU87Z0JBQUNDLFlBQVl6RCxPQUFPakIsR0FBRyxDQUFDLENBQUNvQixRQUFXLENBQUE7d0JBQUNjLElBQUlkLE1BQU1XLElBQUk7d0JBQUV6QixVQUFVYyxNQUFNZCxRQUFRO3dCQUFFcUUsT0FBT3hDLE9BQU82QixNQUFNckQsU0FBUyxFQUFFUyxNQUFNVCxTQUFTLElBQUksRUFBRTtvQkFBQyxDQUFBLEdBQUlRLE1BQU0sQ0FBQyxDQUFDQyxRQUFVQSxNQUFNdUQsS0FBSyxJQUFJLE1BQU1oRCxJQUFJLENBQUMsQ0FBQ0MsR0FBR0MsSUFBTUEsRUFBRThDLEtBQUssR0FBRy9DLEVBQUUrQyxLQUFLLEVBQUUxQyxLQUFLLENBQUMsR0FBRztnQkFBSXBCLFVBQVUyRCxNQUFNM0QsWUFBWTtZQUFDO1FBQ3BRO1FBQ0EsTUFBTStELE1BQU0sQ0FBQyxTQUFTLEVBQUVaLE1BQU10RCxPQUFPLEVBQUU7UUFDdkMsTUFBTW1FLFdBQVcsTUFBTVAsS0FBS3BHLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRTBHLElBQUksQ0FBQyxDQUFDO1FBQ3JFLElBQUdDLFVBQVU7WUFBQyxNQUFNWCxHQUFHTyxNQUFNO1lBQUksT0FBTztnQkFBQ0ssV0FBVztnQkFBTWhFLFNBQVMrRCxTQUFTL0QsT0FBTztZQUFBO1FBQUU7UUFDckYsTUFBTTBELE9BQU8sTUFBTUYsS0FBS3BHLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRStGLFFBQVEsQ0FBQyxDQUFDO1FBQ3JFLElBQUcsQUFBQ08sQ0FBQUEsTUFBTTNELFlBQVksQ0FBQSxNQUFPbUQsTUFBTW5ELFFBQVEsRUFBRSxNQUFNLElBQUlFLE1BQU07UUFDN0QsTUFBTUQsVUFBVWtELE1BQU1sRCxPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUxQyxLQUFLLEdBQUc0RixNQUFNeEQsT0FBTyxDQUFDLENBQUMsRUFBRXdELE1BQU0xRCxRQUFRLENBQUN5RSxXQUFXLElBQUksR0FBRztRQUNwRyxNQUFNQyxZQUFZcEIsS0FBSzFDLEdBQUc7UUFDMUIsSUFBRzhDLE1BQU1sRCxPQUFPLEVBQUU7WUFDaEIsTUFBTU0sUUFBUSxNQUFNa0QsS0FBS3BHLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRTRDLFFBQVEsQ0FBQyxDQUFDO1lBQ3RFLElBQUcsQ0FBQ00sU0FBU0EsTUFBTUMsS0FBSyxLQUFLLGVBQWVELE1BQU1aLE9BQU8sS0FBS3dELE1BQU14RCxPQUFPLElBQUlZLE1BQU1FLElBQUksS0FBSyxTQUFTLE1BQU0sSUFBSVAsTUFBTTtRQUN6SDtRQUNBLE1BQU11RCxLQUFLcEcsR0FBRyxDQUFDLGNBQWMsRUFBRTRDLFFBQVEsU0FBUyxFQUFFO1lBQUNpQixNQUFNakI7WUFBU1csZUFBZTtZQUFHSixPQUFPO1lBQWFWLFdBQVdxRCxNQUFNckQsU0FBUztZQUFFc0UsZ0JBQWdCO1lBQW9DQyxZQUFZRjtZQUFXMUQsTUFBTTtZQUFTUSxXQUFXa0Q7WUFBV0csWUFBWW5CLE1BQU12RCxPQUFPLEtBQUssVUFBVSxJQUFJO1lBQUdELFNBQVN3RCxNQUFNeEQsT0FBTztZQUFFRixVQUFVMEQsTUFBTTFELFFBQVE7WUFBRThFLGNBQWNwQixNQUFNdkQsT0FBTyxLQUFLLFlBQVksSUFBSTtZQUFHYyxRQUFRO1FBQUMsRUFBRSxvQkFBb0IsRUFBRXlELFVBQVUsdURBQXVELEVBQUVoQixNQUFNdkQsT0FBTyxLQUFLLFVBQVUsSUFBSSxFQUFFLG1DQUFtQyxFQUFFdUQsTUFBTXZELE9BQU8sS0FBSyxZQUFZLElBQUksRUFBRSxjQUFjLENBQUM7UUFDdG1CLE1BQU02RCxLQUFLcEcsR0FBRyxDQUFDLE9BQU8sRUFBRTtZQUFDNkQsTUFBTTZDO1lBQUt2RCxPQUFPO1lBQWFaLFNBQVN1RCxNQUFNdkQsT0FBTztZQUFFNEUsbUJBQW1CO1lBQUdDLFNBQVNOO1lBQVcxRCxNQUFNO1lBQVlkLFNBQVN3RCxNQUFNeEQsT0FBTztZQUFFRixVQUFVMEQsTUFBTTFELFFBQVE7WUFBRVE7UUFBTyxFQUFFLGFBQWEsQ0FBQztRQUNyTixNQUFNd0QsS0FBS3BHLEdBQUcsQ0FBQyxjQUFjLEVBQUUrRixRQUFRLFNBQVMsRUFBRTtZQUFDbEMsTUFBTWtDO1lBQVM1QyxPQUFPO1lBQWFDLE1BQU07WUFBV1QsVUFBVW1ELE1BQU1uRCxRQUFRLEdBQUc7UUFBQyxFQUFFLG1CQUFtQixFQUFFbUQsTUFBTW5ELFFBQVEsR0FBRyxFQUFFLGNBQWMsQ0FBQztRQUM1TCxNQUFNcUQsR0FBR08sTUFBTTtRQUNmLE9BQU87WUFBQ0ssV0FBVztZQUFPaEU7UUFBTztJQUNuQyxFQUFFLE9BQU1tQyxPQUFPO1FBQUMsTUFBTWlCLEdBQUdxQixLQUFLO1FBQUksTUFBTXRDO0lBQU07QUFDaEQsRUFBRSJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi9wcml2YXRlL3RtcC92YXVsdC1yZWFrdG9yLWNvbXBsZXRpb24vcGFja2FnZXMvcmVha3Rvci9zcmMvYWN0aW9ucy9hbGZyZWRGYXEudHMiXSwic291cmNlc0NvbnRlbnQiOlsiaW1wb3J0IHtjcmVhdGVIYXNofSBmcm9tICdub2RlOmNyeXB0byc7XG5pbXBvcnQge2FxbH0gZnJvbSAnYXJhbmdvanMnO1xuaW1wb3J0IHt1c2VEYn0gZnJvbSAnLi4vdXRpbHMvYXJhbmdvZGJVdGlscy5qcyc7XG5pbXBvcnQgdHlwZSB7QXBpQ29udGV4dH0gZnJvbSAnLi4vdHlwZXMvYXV0aC50eXBlcy5qcyc7XG5cbmludGVyZmFjZSBGYXFTb3VyY2Uge3RpdGxlOiBzdHJpbmc7IHVybDogc3RyaW5nfVxuaW50ZXJmYWNlIFRvcGljIHsgX2tleTogc3RyaW5nOyBhbnN3ZXI/OiBzdHJpbmc7IGFuc3dlckV4cGlyZXM/OiBudW1iZXI7IGFwcElkOiBzdHJpbmc7IGVtYmVkZGluZz86IG51bWJlcltdOyBraW5kOiBzdHJpbmc7IGxhc3RBc2tlZDogbnVtYmVyOyBwcm9kdWN0Pzogc3RyaW5nOyBxdWVzdGlvbjogc3RyaW5nOyBzb3VyY2VzPzogRmFxU291cmNlW107IHdlaWdodDogbnVtYmVyfVxuaW50ZXJmYWNlIEZhcUlucHV0IHtjaGFubmVsOiAnd2Vic2l0ZScgfCAncGhvbmUnOyBlbWJlZGRpbmc6IG51bWJlcltdOyBldmVudElkOiBzdHJpbmc7IHByb2R1Y3Q6IHN0cmluZzsgcXVlc3Rpb246IHN0cmluZzsgcmV2aXNpb246IG51bWJlcjsgdG9waWNJZDogc3RyaW5nfVxuY29uc3QgaGFzaCA9ICh2YWx1ZTogc3RyaW5nKTogc3RyaW5nID0+IGNyZWF0ZUhhc2goJ3NoYTI1NicpLnVwZGF0ZSh2YWx1ZSkuZGlnZXN0KCdoZXgnKTtcbmNvbnN0IHByb2R1Y3RzID0gbmV3IFNldChbJ2FsZnJlZCcsICduaXRyb2dlbicsICduaXRyb2dlbi1sYWJzJywgJ25pdHJvZ2VuLXN0dWRpb3MnLCAncmVha3RvcicsICdnb3RoYW11aScsICdsYW50ZXJudWknLCAnbWV0cm9wb2xpc2pzJywgJ2Fya2hhbWpzJywgJ2xleCcsICd0b3JjaG9uZScsICdwdWxzaWZ5JywgJ3BoYW50YXplJywgJ3JlYWN0b3Jib3gnXSk7XG5jb25zdCBzYWZlVGV4dCA9ICh2YWx1ZTogdW5rbm93biwgbWF4OiBudW1iZXIpOiB2YWx1ZSBpcyBzdHJpbmcgPT4gdHlwZW9mIHZhbHVlID09PSAnc3RyaW5nJyAmJiB2YWx1ZS50cmltKCkubGVuZ3RoID49IDggJiYgdmFsdWUubGVuZ3RoIDw9IG1heCAmJiAhL1tAPD5dfFxcYig/OnNrX3xBS0lBKXwoPzpcXGRbXFxzKCktXSopezd9L2kudGVzdCh2YWx1ZSk7XG5jb25zdCB2ZWN0b3JWYWxpZCA9ICh2YWx1ZTogdW5rbm93bik6IHZhbHVlIGlzIG51bWJlcltdID0+IEFycmF5LmlzQXJyYXkodmFsdWUpICYmIHZhbHVlLmxlbmd0aCA9PT0gMjU2ICYmIHZhbHVlLmV2ZXJ5KChuKSA9PiB0eXBlb2YgbiA9PT0gJ251bWJlcicgJiYgTnVtYmVyLmlzRmluaXRlKG4pKSAmJiB2YWx1ZS5zb21lKChuKSA9PiBuICE9PSAwKTtcbmNvbnN0IHNvdXJjZVZhbGlkID0gKHNvdXJjZTogRmFxU291cmNlKTogYm9vbGVhbiA9PiB7XG4gIHRyeSB7Y29uc3QgdXJsID0gbmV3IFVSTChzb3VyY2UudXJsKTsgcmV0dXJuIHR5cGVvZiBzb3VyY2UudGl0bGUgPT09ICdzdHJpbmcnICYmIHNvdXJjZS50aXRsZS5sZW5ndGggPD0gMjAwICYmIHVybC5wcm90b2NvbCA9PT0gJ2h0dHBzOicgJiYgIXVybC51c2VybmFtZSAmJiAhdXJsLnBhc3N3b3JkICYmICF1cmwuc2VhcmNoICYmIFsnbml0cm9nZW54LmNvJywgJ3d3dy5uaXRyb2dlbnguY28nLCAncmVha3Rvci5pbycsICd0b3JjaC5vbmUnLCAncHVsc2lmeS5jb20nLCAncGhhbnRhemUuY29tJywgJ3JlYWN0b3Jib3guY29tJywgLi4uWydhbGZyZWQnLCAncmVha3RvcicsICdnb3RoYW11aScsICdsYW50ZXJudWknLCAnbWV0cm9wb2xpc2pzJywgJ2Fya2hhbWpzJywgJ2xleCddLm1hcCgobmFtZSkgPT4gYCR7bmFtZX0ubml0cm9nZW54LmNvYCldLmluY2x1ZGVzKHVybC5ob3N0bmFtZSk7fSBjYXRjaCB7cmV0dXJuIGZhbHNlO31cbn07XG5leHBvcnQgY29uc3QgdmFsaWRhdGVGYXFJbnB1dCA9ICh2YWx1ZTogdW5rbm93bik6IEZhcUlucHV0ID0+IHtcbiAgY29uc3QgdiA9IHZhbHVlIGFzIEZhcUlucHV0O1xuICBpZighdiB8fCAhc2FmZVRleHQodi5xdWVzdGlvbiwgNTAwKSB8fCAhcHJvZHVjdHMuaGFzKHYucHJvZHVjdCkgfHwgIVsnd2Vic2l0ZScsICdwaG9uZSddLmluY2x1ZGVzKHYuY2hhbm5lbCkgfHwgIS9eW2EtZjAtOV17NjR9JC8udGVzdCh2LmV2ZW50SWQpIHx8ICF2ZWN0b3JWYWxpZCh2LmVtYmVkZGluZykgfHwgIU51bWJlci5pc1NhZmVJbnRlZ2VyKHYucmV2aXNpb24pIHx8IHYucmV2aXNpb24gPCAwIHx8IHR5cGVvZiB2LnRvcGljSWQgIT09ICdzdHJpbmcnIHx8ICh2LnRvcGljSWQgJiYgIS9edG9waWMtW2EtZjAtOV17NjR9JC8udGVzdCh2LnRvcGljSWQpKSkgdGhyb3cgbmV3IEVycm9yKCdpbnZhbGlkX2ZhcV9pbnB1dCcpO1xuICByZXR1cm4ge2NoYW5uZWw6IHYuY2hhbm5lbCwgZW1iZWRkaW5nOiB2LmVtYmVkZGluZywgZXZlbnRJZDogdi5ldmVudElkLCBwcm9kdWN0OiB2LnByb2R1Y3QsIHF1ZXN0aW9uOiB2LnF1ZXN0aW9uLnRyaW0oKSwgcmV2aXNpb246IHYucmV2aXNpb24sIHRvcGljSWQ6IHYudG9waWNJZH07XG59O1xuZXhwb3J0IGNvbnN0IHB1YmxpY0ZhcSA9ICh0b3BpY3M6IFRvcGljW10sIG5vdzogbnVtYmVyKSA9PiB0b3BpY3MuZmlsdGVyKCh0b3BpYykgPT4gdG9waWMuYXBwSWQgPT09ICduaXRyb2dlbngnICYmIHRvcGljLmtpbmQgPT09ICd0b3BpYycgJiYgdG9waWMud2VpZ2h0ID49IDMgJiYgc2FmZVRleHQodG9waWMuYW5zd2VyLCAyNTAwKSAmJiAodG9waWMuYW5zd2VyRXhwaXJlcyB8fCAwKSA+IG5vdyAmJiB0b3BpYy5zb3VyY2VzPy5sZW5ndGggJiYgdG9waWMuc291cmNlcy5ldmVyeShzb3VyY2VWYWxpZCkpLnNvcnQoKGEsIGIpID0+IGIud2VpZ2h0IC0gYS53ZWlnaHQgfHwgYi5sYXN0QXNrZWQgLSBhLmxhc3RBc2tlZCB8fCBhLl9rZXkubG9jYWxlQ29tcGFyZShiLl9rZXkpKS5zbGljZSgwLCAxNSkubWFwKCh7X2tleSwgYW5zd2VyLCBxdWVzdGlvbiwgc291cmNlc30pID0+ICh7YW5zd2VyLCBpZDogX2tleSwgcXVlc3Rpb24sIHNvdXJjZXN9KSk7XG5jb25zdCBjb3NpbmUgPSAoYTogbnVtYmVyW10sIGI6IG51bWJlcltdKTogbnVtYmVyID0+IHtcbiAgaWYoIXZlY3RvclZhbGlkKGIpKSByZXR1cm4gLTE7XG4gIHJldHVybiBhLnJlZHVjZSgoc3VtLCBuLCBpKSA9PiBzdW0gKyBuICogYltpXSwgMCkgLyBNYXRoLnNxcnQoYS5yZWR1Y2UoKHN1bSwgbikgPT4gc3VtICsgbiAqIG4sIDApICogYi5yZWR1Y2UoKHN1bSwgbikgPT4gc3VtICsgbiAqIG4sIDApKTtcbn07XG5leHBvcnQgY29uc3QgZmFxQWN0aW9uID0gYXN5bmMgKGNvbnRleHQ6IEFwaUNvbnRleHQsIG9wZXJhdGlvbjogc3RyaW5nLCB2YWx1ZTogdW5rbm93biA9IHt9KSA9PiB7XG4gIGNvbnN0IGRiID0gdXNlRGIoY29udGV4dC5kYXRhYmFzZU5hbWUpO1xuICBjb25zdCBjb2xsZWN0aW9uID0gZGIuY29sbGVjdGlvbignYWxmcmVkRmFxJyk7XG4gIGlmKCFhd2FpdCBjb2xsZWN0aW9uLmV4aXN0cygpKSB7dHJ5IHthd2FpdCBjb2xsZWN0aW9uLmNyZWF0ZSgpO30gY2F0Y2goZXJyb3IpIHtpZighYXdhaXQgY29sbGVjdGlvbi5leGlzdHMoKSkgdGhyb3cgZXJyb3I7fX1cbiAgYXdhaXQgY29sbGVjdGlvbi5lbnN1cmVJbmRleCh7ZmllbGRzOiBbJ2FwcElkJywgJ2tpbmQnLCAncHJvZHVjdCddLCB0eXBlOiAncGVyc2lzdGVudCd9KTtcbiAgY29uc3QgaW5wdXQgPSB2YWx1ZSBhcyBSZWNvcmQ8c3RyaW5nLCB1bmtub3duPjtcbiAgaWYob3BlcmF0aW9uID09PSAnbGlzdCcgfHwgb3BlcmF0aW9uID09PSAncmVmcmVzaC1saXN0Jykge1xuICAgIGNvbnN0IHRvcGljcyA9IGF3YWl0IGRiLnF1ZXJ5KGFxbGBGT1IgdCBJTiBhbGZyZWRGYXEgRklMVEVSIHQuYXBwSWQgPT0gJ25pdHJvZ2VueCcgQU5EIHQua2luZCA9PSAndG9waWMnIEFORCB0LndlaWdodCA+PSAzIFNPUlQgdC53ZWlnaHQgREVTQywgdC5sYXN0QXNrZWQgREVTQywgdC5fa2V5IEFTQyBSRVRVUk4gdGApLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLmFsbCgpKSBhcyBUb3BpY1tdO1xuICAgIHJldHVybiBvcGVyYXRpb24gPT09ICdsaXN0JyA/IHtpdGVtczogcHVibGljRmFxKHRvcGljcy5maWx0ZXIoKHRvcGljKSA9PiAodG9waWMgYXMgVG9waWMgJiB7c291cmNlUmV2aXNpb24/OiBzdHJpbmd9KS5zb3VyY2VSZXZpc2lvbiA9PT0gaW5wdXQuc291cmNlUmV2aXNpb24pLCBEYXRlLm5vdygpKX0gOiB7aXRlbXM6IHRvcGljc307XG4gIH1cbiAgaWYob3BlcmF0aW9uID09PSAncmVmcmVzaCcpIHtcbiAgICBpZih0eXBlb2YgaW5wdXQudG9waWNJZCAhPT0gJ3N0cmluZycgfHwgIS9edG9waWMtW2EtZjAtOV17NjR9JC8udGVzdChpbnB1dC50b3BpY0lkKSkgdGhyb3cgbmV3IEVycm9yKCdpbnZhbGlkX2ZhcV9pbnB1dCcpO1xuICAgIGNvbnN0IHZhbGlkID0gc2FmZVRleHQoaW5wdXQuYW5zd2VyLCAyNTAwKSAmJiBBcnJheS5pc0FycmF5KGlucHV0LnNvdXJjZXMpICYmIGlucHV0LnNvdXJjZXMubGVuZ3RoID4gMCAmJiBpbnB1dC5zb3VyY2VzLmxlbmd0aCA8PSAzICYmIGlucHV0LnNvdXJjZXMuZXZlcnkoc291cmNlVmFsaWQpICYmIHR5cGVvZiBpbnB1dC5hbnN3ZXJFeHBpcmVzID09PSAnbnVtYmVyJyAmJiBpbnB1dC5hbnN3ZXJFeHBpcmVzID4gRGF0ZS5ub3coKSAmJiBpbnB1dC5hbnN3ZXJFeHBpcmVzIDw9IERhdGUubm93KCkgKyAxNCAqIDg2NDAwMDAwO1xuICAgIGF3YWl0IGRiLnF1ZXJ5KGFxbGBGT1IgdCBJTiBhbGZyZWRGYXEgRklMVEVSIHQuX2tleSA9PSAke2lucHV0LnRvcGljSWR9IEFORCB0LmFwcElkID09ICduaXRyb2dlbngnIEFORCB0LmtpbmQgPT0gJ3RvcGljJyBVUERBVEUgdCBXSVRIICR7dmFsaWQgPyB7YW5zd2VyOiBpbnB1dC5hbnN3ZXIsIGFuc3dlckV4cGlyZXM6IGlucHV0LmFuc3dlckV4cGlyZXMsIHJlZnJlc2hBZnRlcjogRGF0ZS5ub3coKSArIDEyICogMzYwMDAwMCwgc291cmNlUmV2aXNpb246IGlucHV0LnNvdXJjZVJldmlzaW9uLCBzb3VyY2VzOiBpbnB1dC5zb3VyY2VzfSA6IHthbnN3ZXI6IG51bGwsIGFuc3dlckV4cGlyZXM6IDAsIHJlZnJlc2hBZnRlcjogRGF0ZS5ub3coKSArIDEyICogMzYwMDAwMCwgc291cmNlUmV2aXNpb246IGlucHV0LnNvdXJjZVJldmlzaW9uLCBzb3VyY2VzOiBbXX19IElOIGFsZnJlZEZhcWApO1xuICAgIHJldHVybiB7b2s6IHRydWV9O1xuICB9XG4gIGlmKG9wZXJhdGlvbiAhPT0gJ3JlY29yZCcgJiYgb3BlcmF0aW9uICE9PSAnY2FuZGlkYXRlcycpIHRocm93IG5ldyBFcnJvcignaW52YWxpZF9mYXFfaW5wdXQnKTtcbiAgY29uc3QgZXZlbnQgPSB2YWxpZGF0ZUZhcUlucHV0KHZhbHVlKTtcbiAgY29uc3QgbWV0YUtleSA9IGBjYXRhbG9nLSR7ZXZlbnQucHJvZHVjdH1gO1xuICBjb25zdCB0eCA9IGF3YWl0IGRiLmJlZ2luVHJhbnNhY3Rpb24oe2V4Y2x1c2l2ZTogWydhbGZyZWRGYXEnXX0sIHtsb2NrVGltZW91dDogMTB9KTtcbiAgY29uc3QgbmV4dCA9IGFzeW5jIChxdWVyeTogUmV0dXJuVHlwZTx0eXBlb2YgYXFsPikgPT4gdHguc3RlcCgoKSA9PiBkYi5xdWVyeShxdWVyeSkpLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLm5leHQoKSBhcyBQcm9taXNlPHthcHBJZD86IHN0cmluZzsga2luZD86IHN0cmluZzsgcHJvZHVjdD86IHN0cmluZzsgcmV2aXNpb24/OiBudW1iZXI7IHRvcGljSWQ/OiBzdHJpbmd9IHwgbnVsbD4pO1xuICB0cnkge1xuICAgIGlmKG9wZXJhdGlvbiA9PT0gJ2NhbmRpZGF0ZXMnKSB7XG4gICAgICBjb25zdCBtZXRhID0gYXdhaXQgbmV4dChhcWxgUkVUVVJOIERPQ1VNRU5UKCdhbGZyZWRGYXEnLCAke21ldGFLZXl9KWApO1xuICAgICAgY29uc3QgdG9waWNzID0gYXdhaXQgdHguc3RlcCgoKSA9PiBkYi5xdWVyeShhcWxgRk9SIHQgSU4gYWxmcmVkRmFxIEZJTFRFUiB0LmFwcElkID09ICduaXRyb2dlbngnIEFORCB0LmtpbmQgPT0gJ3RvcGljJyBBTkQgdC5wcm9kdWN0ID09ICR7ZXZlbnQucHJvZHVjdH0gUkVUVVJOIHRgKSkudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IuYWxsKCkpIGFzIFRvcGljW107XG4gICAgICBhd2FpdCB0eC5jb21taXQoKTtcbiAgICAgIHJldHVybiB7Y2FuZGlkYXRlczogdG9waWNzLm1hcCgodG9waWMpID0+ICh7aWQ6IHRvcGljLl9rZXksIHF1ZXN0aW9uOiB0b3BpYy5xdWVzdGlvbiwgc2NvcmU6IGNvc2luZShldmVudC5lbWJlZGRpbmcsIHRvcGljLmVtYmVkZGluZyB8fCBbXSl9KSkuZmlsdGVyKCh0b3BpYykgPT4gdG9waWMuc2NvcmUgPj0gMC41NSkuc29ydCgoYSwgYikgPT4gYi5zY29yZSAtIGEuc2NvcmUpLnNsaWNlKDAsIDgpLCByZXZpc2lvbjogbWV0YT8ucmV2aXNpb24gfHwgMH07XG4gICAgfVxuICAgIGNvbnN0IGtleSA9IGBxdWVzdGlvbi0ke2V2ZW50LmV2ZW50SWR9YDtcbiAgICBjb25zdCBleGlzdGluZyA9IGF3YWl0IG5leHQoYXFsYFJFVFVSTiBET0NVTUVOVCgnYWxmcmVkRmFxJywgJHtrZXl9KWApO1xuICAgIGlmKGV4aXN0aW5nKSB7YXdhaXQgdHguY29tbWl0KCk7IHJldHVybiB7ZHVwbGljYXRlOiB0cnVlLCB0b3BpY0lkOiBleGlzdGluZy50b3BpY0lkfTt9XG4gICAgY29uc3QgbWV0YSA9IGF3YWl0IG5leHQoYXFsYFJFVFVSTiBET0NVTUVOVCgnYWxmcmVkRmFxJywgJHttZXRhS2V5fSlgKTtcbiAgICBpZigobWV0YT8ucmV2aXNpb24gfHwgMCkgIT09IGV2ZW50LnJldmlzaW9uKSB0aHJvdyBuZXcgRXJyb3IoJ2ZhcV9yZXZpc2lvbl9jb25mbGljdCcpO1xuICAgIGNvbnN0IHRvcGljSWQgPSBldmVudC50b3BpY0lkIHx8IGB0b3BpYy0ke2hhc2goYCR7ZXZlbnQucHJvZHVjdH06JHtldmVudC5xdWVzdGlvbi50b0xvd2VyQ2FzZSgpfWApfWA7XG4gICAgY29uc3QgdGltZXN0YW1wID0gRGF0ZS5ub3coKTtcbiAgICBpZihldmVudC50b3BpY0lkKSB7XG4gICAgICBjb25zdCB0b3BpYyA9IGF3YWl0IG5leHQoYXFsYFJFVFVSTiBET0NVTUVOVCgnYWxmcmVkRmFxJywgJHt0b3BpY0lkfSlgKTtcbiAgICAgIGlmKCF0b3BpYyB8fCB0b3BpYy5hcHBJZCAhPT0gJ25pdHJvZ2VueCcgfHwgdG9waWMucHJvZHVjdCAhPT0gZXZlbnQucHJvZHVjdCB8fCB0b3BpYy5raW5kICE9PSAndG9waWMnKSB0aHJvdyBuZXcgRXJyb3IoJ2ludmFsaWRfZmFxX2lucHV0Jyk7XG4gICAgfVxuICAgIGF3YWl0IG5leHQoYXFsYFVQU0VSVCB7X2tleTogJHt0b3BpY0lkfX0gSU5TRVJUICR7e19rZXk6IHRvcGljSWQsIGFuc3dlckV4cGlyZXM6IDAsIGFwcElkOiAnbml0cm9nZW54JywgZW1iZWRkaW5nOiBldmVudC5lbWJlZGRpbmcsIGVtYmVkZGluZ01vZGVsOiAnYW1hem9uLnRpdGFuLWVtYmVkLXRleHQtdjI6MC8yNTYnLCBmaXJzdEFza2VkOiB0aW1lc3RhbXAsIGtpbmQ6ICd0b3BpYycsIGxhc3RBc2tlZDogdGltZXN0YW1wLCBwaG9uZUNvdW50OiBldmVudC5jaGFubmVsID09PSAncGhvbmUnID8gMSA6IDAsIHByb2R1Y3Q6IGV2ZW50LnByb2R1Y3QsIHF1ZXN0aW9uOiBldmVudC5xdWVzdGlvbiwgd2Vic2l0ZUNvdW50OiBldmVudC5jaGFubmVsID09PSAnd2Vic2l0ZScgPyAxIDogMCwgd2VpZ2h0OiAxfX0gVVBEQVRFIHtsYXN0QXNrZWQ6ICR7dGltZXN0YW1wfSwgd2VpZ2h0OiBPTEQud2VpZ2h0ICsgMSwgcGhvbmVDb3VudDogT0xELnBob25lQ291bnQgKyAke2V2ZW50LmNoYW5uZWwgPT09ICdwaG9uZScgPyAxIDogMH0sIHdlYnNpdGVDb3VudDogT0xELndlYnNpdGVDb3VudCArICR7ZXZlbnQuY2hhbm5lbCA9PT0gJ3dlYnNpdGUnID8gMSA6IDB9fSBJTiBhbGZyZWRGYXFgKTtcbiAgICBhd2FpdCBuZXh0KGFxbGBJTlNFUlQgJHt7X2tleToga2V5LCBhcHBJZDogJ25pdHJvZ2VueCcsIGNoYW5uZWw6IGV2ZW50LmNoYW5uZWwsIGNsYXNzaWZpZXJWZXJzaW9uOiAxLCBjcmVhdGVkOiB0aW1lc3RhbXAsIGtpbmQ6ICdxdWVzdGlvbicsIHByb2R1Y3Q6IGV2ZW50LnByb2R1Y3QsIHF1ZXN0aW9uOiBldmVudC5xdWVzdGlvbiwgdG9waWNJZH19IElOIGFsZnJlZEZhcWApO1xuICAgIGF3YWl0IG5leHQoYXFsYFVQU0VSVCB7X2tleTogJHttZXRhS2V5fX0gSU5TRVJUICR7e19rZXk6IG1ldGFLZXksIGFwcElkOiAnbml0cm9nZW54Jywga2luZDogJ2NhdGFsb2cnLCByZXZpc2lvbjogZXZlbnQucmV2aXNpb24gKyAxfX0gVVBEQVRFIHtyZXZpc2lvbjogJHtldmVudC5yZXZpc2lvbiArIDF9fSBJTiBhbGZyZWRGYXFgKTtcbiAgICBhd2FpdCB0eC5jb21taXQoKTtcbiAgICByZXR1cm4ge2R1cGxpY2F0ZTogZmFsc2UsIHRvcGljSWR9O1xuICB9IGNhdGNoKGVycm9yKSB7YXdhaXQgdHguYWJvcnQoKTsgdGhyb3cgZXJyb3I7fVxufTtcbiJdLCJuYW1lcyI6WyJjcmVhdGVIYXNoIiwiYXFsIiwidXNlRGIiLCJoYXNoIiwidmFsdWUiLCJ1cGRhdGUiLCJkaWdlc3QiLCJwcm9kdWN0cyIsIlNldCIsInNhZmVUZXh0IiwibWF4IiwidHJpbSIsImxlbmd0aCIsInRlc3QiLCJ2ZWN0b3JWYWxpZCIsIkFycmF5IiwiaXNBcnJheSIsImV2ZXJ5IiwibiIsIk51bWJlciIsImlzRmluaXRlIiwic29tZSIsInNvdXJjZVZhbGlkIiwic291cmNlIiwidXJsIiwiVVJMIiwidGl0bGUiLCJwcm90b2NvbCIsInVzZXJuYW1lIiwicGFzc3dvcmQiLCJzZWFyY2giLCJtYXAiLCJuYW1lIiwiaW5jbHVkZXMiLCJob3N0bmFtZSIsInZhbGlkYXRlRmFxSW5wdXQiLCJ2IiwicXVlc3Rpb24iLCJoYXMiLCJwcm9kdWN0IiwiY2hhbm5lbCIsImV2ZW50SWQiLCJlbWJlZGRpbmciLCJpc1NhZmVJbnRlZ2VyIiwicmV2aXNpb24iLCJ0b3BpY0lkIiwiRXJyb3IiLCJwdWJsaWNGYXEiLCJ0b3BpY3MiLCJub3ciLCJmaWx0ZXIiLCJ0b3BpYyIsImFwcElkIiwia2luZCIsIndlaWdodCIsImFuc3dlciIsImFuc3dlckV4cGlyZXMiLCJzb3VyY2VzIiwic29ydCIsImEiLCJiIiwibGFzdEFza2VkIiwiX2tleSIsImxvY2FsZUNvbXBhcmUiLCJzbGljZSIsImlkIiwiY29zaW5lIiwicmVkdWNlIiwic3VtIiwiaSIsIk1hdGgiLCJzcXJ0IiwiZmFxQWN0aW9uIiwiY29udGV4dCIsIm9wZXJhdGlvbiIsImRiIiwiZGF0YWJhc2VOYW1lIiwiY29sbGVjdGlvbiIsImV4aXN0cyIsImNyZWF0ZSIsImVycm9yIiwiZW5zdXJlSW5kZXgiLCJmaWVsZHMiLCJ0eXBlIiwiaW5wdXQiLCJxdWVyeSIsInRoZW4iLCJjdXJzb3IiLCJhbGwiLCJpdGVtcyIsInNvdXJjZVJldmlzaW9uIiwiRGF0ZSIsInZhbGlkIiwicmVmcmVzaEFmdGVyIiwib2siLCJldmVudCIsIm1ldGFLZXkiLCJ0eCIsImJlZ2luVHJhbnNhY3Rpb24iLCJleGNsdXNpdmUiLCJsb2NrVGltZW91dCIsIm5leHQiLCJzdGVwIiwibWV0YSIsImNvbW1pdCIsImNhbmRpZGF0ZXMiLCJzY29yZSIsImtleSIsImV4aXN0aW5nIiwiZHVwbGljYXRlIiwidG9Mb3dlckNhc2UiLCJ0aW1lc3RhbXAiLCJlbWJlZGRpbmdNb2RlbCIsImZpcnN0QXNrZWQiLCJwaG9uZUNvdW50Iiwid2Vic2l0ZUNvdW50IiwiY2xhc3NpZmllclZlcnNpb24iLCJjcmVhdGVkIiwiYWJvcnQiXSwibWFwcGluZ3MiOiJBQUFBLFNBQVFBLFVBQVUsUUFBTyxjQUFjO0FBQ3ZDLFNBQVFDLEdBQUcsUUFBTyxXQUFXO0FBQzdCLFNBQVFDLEtBQUssUUFBTyw0QkFBNEI7QUFNaEQsTUFBTUMsT0FBTyxDQUFDQyxRQUEwQkosV0FBVyxVQUFVSyxNQUFNLENBQUNELE9BQU9FLE1BQU0sQ0FBQztBQUNsRixNQUFNQyxXQUFXLElBQUlDLElBQUk7SUFBQztJQUFVO0lBQVk7SUFBaUI7SUFBb0I7SUFBVztJQUFZO0lBQWE7SUFBZ0I7SUFBWTtJQUFPO0lBQVk7SUFBVztJQUFZO0NBQWE7QUFDNU0sTUFBTUMsV0FBVyxDQUFDTCxPQUFnQk0sTUFBaUMsT0FBT04sVUFBVSxZQUFZQSxNQUFNTyxJQUFJLEdBQUdDLE1BQU0sSUFBSSxLQUFLUixNQUFNUSxNQUFNLElBQUlGLE9BQU8sQ0FBQywwQ0FBMENHLElBQUksQ0FBQ1Q7QUFDbk0sTUFBTVUsY0FBYyxDQUFDVixRQUFzQ1csTUFBTUMsT0FBTyxDQUFDWixVQUFVQSxNQUFNUSxNQUFNLEtBQUssT0FBT1IsTUFBTWEsS0FBSyxDQUFDLENBQUNDLElBQU0sT0FBT0EsTUFBTSxZQUFZQyxPQUFPQyxRQUFRLENBQUNGLE9BQU9kLE1BQU1pQixJQUFJLENBQUMsQ0FBQ0gsSUFBTUEsTUFBTTtBQUN0TSxNQUFNSSxjQUFjLENBQUNDO0lBQ25CLElBQUk7UUFBQyxNQUFNQyxNQUFNLElBQUlDLElBQUlGLE9BQU9DLEdBQUc7UUFBRyxPQUFPLE9BQU9ELE9BQU9HLEtBQUssS0FBSyxZQUFZSCxPQUFPRyxLQUFLLENBQUNkLE1BQU0sSUFBSSxPQUFPWSxJQUFJRyxRQUFRLEtBQUssWUFBWSxDQUFDSCxJQUFJSSxRQUFRLElBQUksQ0FBQ0osSUFBSUssUUFBUSxJQUFJLENBQUNMLElBQUlNLE1BQU0sSUFBSTtZQUFDO1lBQWdCO1lBQW9CO1lBQWM7WUFBYTtZQUFlO1lBQWdCO2VBQXFCO2dCQUFDO2dCQUFVO2dCQUFXO2dCQUFZO2dCQUFhO2dCQUFnQjtnQkFBWTthQUFNLENBQUNDLEdBQUcsQ0FBQyxDQUFDQyxPQUFTLEdBQUdBLEtBQUssYUFBYSxDQUFDO1NBQUUsQ0FBQ0MsUUFBUSxDQUFDVCxJQUFJVSxRQUFRO0lBQUUsRUFBRSxPQUFNO1FBQUMsT0FBTztJQUFNO0FBQ3pkO0FBQ0EsT0FBTyxNQUFNQyxtQkFBbUIsQ0FBQy9CO0lBQy9CLE1BQU1nQyxJQUFJaEM7SUFDVixJQUFHLENBQUNnQyxLQUFLLENBQUMzQixTQUFTMkIsRUFBRUMsUUFBUSxFQUFFLFFBQVEsQ0FBQzlCLFNBQVMrQixHQUFHLENBQUNGLEVBQUVHLE9BQU8sS0FBSyxDQUFDO1FBQUM7UUFBVztLQUFRLENBQUNOLFFBQVEsQ0FBQ0csRUFBRUksT0FBTyxLQUFLLENBQUMsaUJBQWlCM0IsSUFBSSxDQUFDdUIsRUFBRUssT0FBTyxLQUFLLENBQUMzQixZQUFZc0IsRUFBRU0sU0FBUyxLQUFLLENBQUN2QixPQUFPd0IsYUFBYSxDQUFDUCxFQUFFUSxRQUFRLEtBQUtSLEVBQUVRLFFBQVEsR0FBRyxLQUFLLE9BQU9SLEVBQUVTLE9BQU8sS0FBSyxZQUFhVCxFQUFFUyxPQUFPLElBQUksQ0FBQyx1QkFBdUJoQyxJQUFJLENBQUN1QixFQUFFUyxPQUFPLEdBQUksTUFBTSxJQUFJQyxNQUFNO0lBQ2xWLE9BQU87UUFBQ04sU0FBU0osRUFBRUksT0FBTztRQUFFRSxXQUFXTixFQUFFTSxTQUFTO1FBQUVELFNBQVNMLEVBQUVLLE9BQU87UUFBRUYsU0FBU0gsRUFBRUcsT0FBTztRQUFFRixVQUFVRCxFQUFFQyxRQUFRLENBQUMxQixJQUFJO1FBQUlpQyxVQUFVUixFQUFFUSxRQUFRO1FBQUVDLFNBQVNULEVBQUVTLE9BQU87SUFBQTtBQUNuSyxFQUFFO0FBQ0YsT0FBTyxNQUFNRSxZQUFZLENBQUNDLFFBQWlCQyxNQUFnQkQsT0FBT0UsTUFBTSxDQUFDLENBQUNDLFFBQVVBLE1BQU1DLEtBQUssS0FBSyxlQUFlRCxNQUFNRSxJQUFJLEtBQUssV0FBV0YsTUFBTUcsTUFBTSxJQUFJLEtBQUs3QyxTQUFTMEMsTUFBTUksTUFBTSxFQUFFLFNBQVMsQUFBQ0osQ0FBQUEsTUFBTUssYUFBYSxJQUFJLENBQUEsSUFBS1AsT0FBT0UsTUFBTU0sT0FBTyxFQUFFN0MsVUFBVXVDLE1BQU1NLE9BQU8sQ0FBQ3hDLEtBQUssQ0FBQ0ssY0FBY29DLElBQUksQ0FBQyxDQUFDQyxHQUFHQyxJQUFNQSxFQUFFTixNQUFNLEdBQUdLLEVBQUVMLE1BQU0sSUFBSU0sRUFBRUMsU0FBUyxHQUFHRixFQUFFRSxTQUFTLElBQUlGLEVBQUVHLElBQUksQ0FBQ0MsYUFBYSxDQUFDSCxFQUFFRSxJQUFJLEdBQUdFLEtBQUssQ0FBQyxHQUFHLElBQUlqQyxHQUFHLENBQUMsQ0FBQyxFQUFDK0IsSUFBSSxFQUFFUCxNQUFNLEVBQUVsQixRQUFRLEVBQUVvQixPQUFPLEVBQUMsR0FBTSxDQUFBO1lBQUNGO1lBQVFVLElBQUlIO1lBQU16QjtZQUFVb0I7UUFBTyxDQUFBLEdBQUk7QUFDbmUsTUFBTVMsU0FBUyxDQUFDUCxHQUFhQztJQUMzQixJQUFHLENBQUM5QyxZQUFZOEMsSUFBSSxPQUFPLENBQUM7SUFDNUIsT0FBT0QsRUFBRVEsTUFBTSxDQUFDLENBQUNDLEtBQUtsRCxHQUFHbUQsSUFBTUQsTUFBTWxELElBQUkwQyxDQUFDLENBQUNTLEVBQUUsRUFBRSxLQUFLQyxLQUFLQyxJQUFJLENBQUNaLEVBQUVRLE1BQU0sQ0FBQyxDQUFDQyxLQUFLbEQsSUFBTWtELE1BQU1sRCxJQUFJQSxHQUFHLEtBQUswQyxFQUFFTyxNQUFNLENBQUMsQ0FBQ0MsS0FBS2xELElBQU1rRCxNQUFNbEQsSUFBSUEsR0FBRztBQUN6STtBQUNBLE9BQU8sTUFBTXNELFlBQVksT0FBT0MsU0FBcUJDLFdBQW1CdEUsUUFBaUIsQ0FBQyxDQUFDO0lBQ3pGLE1BQU11RSxLQUFLekUsTUFBTXVFLFFBQVFHLFlBQVk7SUFDckMsTUFBTUMsYUFBYUYsR0FBR0UsVUFBVSxDQUFDO0lBQ2pDLElBQUcsQ0FBQyxNQUFNQSxXQUFXQyxNQUFNLElBQUk7UUFBQyxJQUFJO1lBQUMsTUFBTUQsV0FBV0UsTUFBTTtRQUFHLEVBQUUsT0FBTUMsT0FBTztZQUFDLElBQUcsQ0FBQyxNQUFNSCxXQUFXQyxNQUFNLElBQUksTUFBTUU7UUFBTTtJQUFDO0lBQzNILE1BQU1ILFdBQVdJLFdBQVcsQ0FBQztRQUFDQyxRQUFRO1lBQUM7WUFBUztZQUFRO1NBQVU7UUFBRUMsTUFBTTtJQUFZO0lBQ3RGLE1BQU1DLFFBQVFoRjtJQUNkLElBQUdzRSxjQUFjLFVBQVVBLGNBQWMsZ0JBQWdCO1FBQ3ZELE1BQU0xQixTQUFTLE1BQU0yQixHQUFHVSxLQUFLLENBQUNwRixHQUFHLENBQUMsa0pBQWtKLENBQUMsRUFBRXFGLElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPQyxHQUFHO1FBQ2xOLE9BQU9kLGNBQWMsU0FBUztZQUFDZSxPQUFPMUMsVUFBVUMsT0FBT0UsTUFBTSxDQUFDLENBQUNDLFFBQVUsQUFBQ0EsTUFBNEN1QyxjQUFjLEtBQUtOLE1BQU1NLGNBQWMsR0FBR0MsS0FBSzFDLEdBQUc7UUFBRyxJQUFJO1lBQUN3QyxPQUFPekM7UUFBTTtJQUMvTDtJQUNBLElBQUcwQixjQUFjLFdBQVc7UUFDMUIsSUFBRyxPQUFPVSxNQUFNdkMsT0FBTyxLQUFLLFlBQVksQ0FBQyx1QkFBdUJoQyxJQUFJLENBQUN1RSxNQUFNdkMsT0FBTyxHQUFHLE1BQU0sSUFBSUMsTUFBTTtRQUNyRyxNQUFNOEMsUUFBUW5GLFNBQVMyRSxNQUFNN0IsTUFBTSxFQUFFLFNBQVN4QyxNQUFNQyxPQUFPLENBQUNvRSxNQUFNM0IsT0FBTyxLQUFLMkIsTUFBTTNCLE9BQU8sQ0FBQzdDLE1BQU0sR0FBRyxLQUFLd0UsTUFBTTNCLE9BQU8sQ0FBQzdDLE1BQU0sSUFBSSxLQUFLd0UsTUFBTTNCLE9BQU8sQ0FBQ3hDLEtBQUssQ0FBQ0ssZ0JBQWdCLE9BQU84RCxNQUFNNUIsYUFBYSxLQUFLLFlBQVk0QixNQUFNNUIsYUFBYSxHQUFHbUMsS0FBSzFDLEdBQUcsTUFBTW1DLE1BQU01QixhQUFhLElBQUltQyxLQUFLMUMsR0FBRyxLQUFLLEtBQUs7UUFDblMsTUFBTTBCLEdBQUdVLEtBQUssQ0FBQ3BGLEdBQUcsQ0FBQyxvQ0FBb0MsRUFBRW1GLE1BQU12QyxPQUFPLENBQUMsZ0VBQWdFLEVBQUUrQyxRQUFRO1lBQUNyQyxRQUFRNkIsTUFBTTdCLE1BQU07WUFBRUMsZUFBZTRCLE1BQU01QixhQUFhO1lBQUVxQyxjQUFjRixLQUFLMUMsR0FBRyxLQUFLLEtBQUs7WUFBU3lDLGdCQUFnQk4sTUFBTU0sY0FBYztZQUFFakMsU0FBUzJCLE1BQU0zQixPQUFPO1FBQUEsSUFBSTtZQUFDRixRQUFRO1lBQU1DLGVBQWU7WUFBR3FDLGNBQWNGLEtBQUsxQyxHQUFHLEtBQUssS0FBSztZQUFTeUMsZ0JBQWdCTixNQUFNTSxjQUFjO1lBQUVqQyxTQUFTLEVBQUU7UUFBQSxFQUFFLGFBQWEsQ0FBQztRQUNoYyxPQUFPO1lBQUNxQyxJQUFJO1FBQUk7SUFDbEI7SUFDQSxJQUFHcEIsY0FBYyxZQUFZQSxjQUFjLGNBQWMsTUFBTSxJQUFJNUIsTUFBTTtJQUN6RSxNQUFNaUQsUUFBUTVELGlCQUFpQi9CO0lBQy9CLE1BQU00RixVQUFVLENBQUMsUUFBUSxFQUFFRCxNQUFNeEQsT0FBTyxFQUFFO0lBQzFDLE1BQU0wRCxLQUFLLE1BQU10QixHQUFHdUIsZ0JBQWdCLENBQUM7UUFBQ0MsV0FBVztZQUFDO1NBQVk7SUFBQSxHQUFHO1FBQUNDLGFBQWE7SUFBRTtJQUNqRixNQUFNQyxPQUFPLE9BQU9oQixRQUFrQ1ksR0FBR0ssSUFBSSxDQUFDLElBQU0zQixHQUFHVSxLQUFLLENBQUNBLFFBQVFDLElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPYyxJQUFJO0lBQ2pILElBQUk7UUFDRixJQUFHM0IsY0FBYyxjQUFjO1lBQzdCLE1BQU02QixPQUFPLE1BQU1GLEtBQUtwRyxHQUFHLENBQUMsNkJBQTZCLEVBQUUrRixRQUFRLENBQUMsQ0FBQztZQUNyRSxNQUFNaEQsU0FBUyxNQUFNaUQsR0FBR0ssSUFBSSxDQUFDLElBQU0zQixHQUFHVSxLQUFLLENBQUNwRixHQUFHLENBQUMsd0ZBQXdGLEVBQUU4RixNQUFNeEQsT0FBTyxDQUFDLFNBQVMsQ0FBQyxHQUFHK0MsSUFBSSxDQUFDLENBQUNDLFNBQVdBLE9BQU9DLEdBQUc7WUFDaE0sTUFBTVMsR0FBR08sTUFBTTtZQUNmLE9BQU87Z0JBQUNDLFlBQVl6RCxPQUFPakIsR0FBRyxDQUFDLENBQUNvQixRQUFXLENBQUE7d0JBQUNjLElBQUlkLE1BQU1XLElBQUk7d0JBQUV6QixVQUFVYyxNQUFNZCxRQUFRO3dCQUFFcUUsT0FBT3hDLE9BQU82QixNQUFNckQsU0FBUyxFQUFFUyxNQUFNVCxTQUFTLElBQUksRUFBRTtvQkFBQyxDQUFBLEdBQUlRLE1BQU0sQ0FBQyxDQUFDQyxRQUFVQSxNQUFNdUQsS0FBSyxJQUFJLE1BQU1oRCxJQUFJLENBQUMsQ0FBQ0MsR0FBR0MsSUFBTUEsRUFBRThDLEtBQUssR0FBRy9DLEVBQUUrQyxLQUFLLEVBQUUxQyxLQUFLLENBQUMsR0FBRztnQkFBSXBCLFVBQVUyRCxNQUFNM0QsWUFBWTtZQUFDO1FBQ3BRO1FBQ0EsTUFBTStELE1BQU0sQ0FBQyxTQUFTLEVBQUVaLE1BQU10RCxPQUFPLEVBQUU7UUFDdkMsTUFBTW1FLFdBQVcsTUFBTVAsS0FBS3BHLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRTBHLElBQUksQ0FBQyxDQUFDO1FBQ3JFLElBQUdDLFVBQVU7WUFBQyxNQUFNWCxHQUFHTyxNQUFNO1lBQUksT0FBTztnQkFBQ0ssV0FBVztnQkFBTWhFLFNBQVMrRCxTQUFTL0QsT0FBTztZQUFBO1FBQUU7UUFDckYsTUFBTTBELE9BQU8sTUFBTUYsS0FBS3BHLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRStGLFFBQVEsQ0FBQyxDQUFDO1FBQ3JFLElBQUcsQUFBQ08sQ0FBQUEsTUFBTTNELFlBQVksQ0FBQSxNQUFPbUQsTUFBTW5ELFFBQVEsRUFBRSxNQUFNLElBQUlFLE1BQU07UUFDN0QsTUFBTUQsVUFBVWtELE1BQU1sRCxPQUFPLElBQUksQ0FBQyxNQUFNLEVBQUUxQyxLQUFLLEdBQUc0RixNQUFNeEQsT0FBTyxDQUFDLENBQUMsRUFBRXdELE1BQU0xRCxRQUFRLENBQUN5RSxXQUFXLElBQUksR0FBRztRQUNwRyxNQUFNQyxZQUFZcEIsS0FBSzFDLEdBQUc7UUFDMUIsSUFBRzhDLE1BQU1sRCxPQUFPLEVBQUU7WUFDaEIsTUFBTU0sUUFBUSxNQUFNa0QsS0FBS3BHLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRTRDLFFBQVEsQ0FBQyxDQUFDO1lBQ3RFLElBQUcsQ0FBQ00sU0FBU0EsTUFBTUMsS0FBSyxLQUFLLGVBQWVELE1BQU1aLE9BQU8sS0FBS3dELE1BQU14RCxPQUFPLElBQUlZLE1BQU1FLElBQUksS0FBSyxTQUFTLE1BQU0sSUFBSVAsTUFBTTtRQUN6SDtRQUNBLE1BQU11RCxLQUFLcEcsR0FBRyxDQUFDLGNBQWMsRUFBRTRDLFFBQVEsU0FBUyxFQUFFO1lBQUNpQixNQUFNakI7WUFBU1csZUFBZTtZQUFHSixPQUFPO1lBQWFWLFdBQVdxRCxNQUFNckQsU0FBUztZQUFFc0UsZ0JBQWdCO1lBQW9DQyxZQUFZRjtZQUFXMUQsTUFBTTtZQUFTUSxXQUFXa0Q7WUFBV0csWUFBWW5CLE1BQU12RCxPQUFPLEtBQUssVUFBVSxJQUFJO1lBQUdELFNBQVN3RCxNQUFNeEQsT0FBTztZQUFFRixVQUFVMEQsTUFBTTFELFFBQVE7WUFBRThFLGNBQWNwQixNQUFNdkQsT0FBTyxLQUFLLFlBQVksSUFBSTtZQUFHYyxRQUFRO1FBQUMsRUFBRSxvQkFBb0IsRUFBRXlELFVBQVUsdURBQXVELEVBQUVoQixNQUFNdkQsT0FBTyxLQUFLLFVBQVUsSUFBSSxFQUFFLG1DQUFtQyxFQUFFdUQsTUFBTXZELE9BQU8sS0FBSyxZQUFZLElBQUksRUFBRSxjQUFjLENBQUM7UUFDdG1CLE1BQU02RCxLQUFLcEcsR0FBRyxDQUFDLE9BQU8sRUFBRTtZQUFDNkQsTUFBTTZDO1lBQUt2RCxPQUFPO1lBQWFaLFNBQVN1RCxNQUFNdkQsT0FBTztZQUFFNEUsbUJBQW1CO1lBQUdDLFNBQVNOO1lBQVcxRCxNQUFNO1lBQVlkLFNBQVN3RCxNQUFNeEQsT0FBTztZQUFFRixVQUFVMEQsTUFBTTFELFFBQVE7WUFBRVE7UUFBTyxFQUFFLGFBQWEsQ0FBQztRQUNyTixNQUFNd0QsS0FBS3BHLEdBQUcsQ0FBQyxjQUFjLEVBQUUrRixRQUFRLFNBQVMsRUFBRTtZQUFDbEMsTUFBTWtDO1lBQVM1QyxPQUFPO1lBQWFDLE1BQU07WUFBV1QsVUFBVW1ELE1BQU1uRCxRQUFRLEdBQUc7UUFBQyxFQUFFLG1CQUFtQixFQUFFbUQsTUFBTW5ELFFBQVEsR0FBRyxFQUFFLGNBQWMsQ0FBQztRQUM1TCxNQUFNcUQsR0FBR08sTUFBTTtRQUNmLE9BQU87WUFBQ0ssV0FBVztZQUFPaEU7UUFBTztJQUNuQyxFQUFFLE9BQU1tQyxPQUFPO1FBQUMsTUFBTWlCLEdBQUdxQixLQUFLO1FBQUksTUFBTXRDO0lBQU07QUFDaEQsRUFBRSJ9