@push.rocks/smartproxy 18.0.2 → 18.2.0

package/dist_ts/proxies/smart-proxy/legacy-smart-proxy.js

@@ -0,0 +1,642 @@
+import * as plugins from '../../plugins.js';
+// Importing required components
+import { ConnectionManager } from './connection-manager.js';
+import { SecurityManager } from './security-manager.js';
+import { TlsManager } from './tls-manager.js';
+import { NetworkProxyBridge } from './network-proxy-bridge.js';
+import { TimeoutManager } from './timeout-manager.js';
+import { PortManager } from './port-manager.js';
+import { RouteManager } from './route-manager.js';
+import { RouteConnectionHandler } from './route-connection-handler.js';
+import { NFTablesManager } from './nftables-manager.js';
+// External dependencies
+import { Port80Handler } from '../../http/port80/port80-handler.js';
+import { CertProvisioner } from '../../certificate/providers/cert-provisioner.js';
+import { buildPort80Handler } from '../../certificate/acme/acme-factory.js';
+import { createPort80HandlerOptions } from '../../common/port80-adapter.js';
+/**
+ * SmartProxy - Pure route-based API
+ *
+ * SmartProxy is a unified proxy system that works with routes to define connection handling behavior.
+ * Each route contains matching criteria (ports, domains, etc.) and an action to take (forward, redirect, block).
+ *
+ * Configuration is provided through a set of routes, with each route defining:
+ * - What to match (ports, domains, paths, client IPs)
+ * - What to do with matching traffic (forward, redirect, block)
+ * - How to handle TLS (passthrough, terminate, terminate-and-reencrypt)
+ * - Security settings (IP restrictions, connection limits)
+ * - Advanced options (timeout, headers, etc.)
+ */
+export class SmartProxy extends plugins.EventEmitter {
+    /**
+     * Constructor for SmartProxy
+     *
+     * @param settingsArg Configuration options containing routes and other settings
+     * Routes define how traffic is matched and handled, with each route having:
+     * - match: criteria for matching traffic (ports, domains, paths, IPs)
+     * - action: what to do with matched traffic (forward, redirect, block)
+     *
+     * Example:
+     * ```ts
+     * const proxy = new SmartProxy({
+     *   routes: [
+     *     {
+     *       match: {
+     *         ports: 443,
+     *         domains: ['example.com', '*.example.com']
+     *       },
+     *       action: {
+     *         type: 'forward',
+     *         target: { host: '10.0.0.1', port: 8443 },
+     *         tls: { mode: 'passthrough' }
+     *       }
+     *     }
+     *   ],
+     *   defaults: {
+     *     target: { host: 'localhost', port: 8080 },
+     *     security: { ipAllowList: ['*'] }
+     *   }
+     * });
+     * ```
+     */
+    constructor(settingsArg) {
+        super();
+        this.connectionLogger = null;
+        this.isShuttingDown = false;
+        // Port80Handler for ACME certificate management
+        this.port80Handler = null;
+        // Set reasonable defaults for all settings
+        this.settings = {
+            ...settingsArg,
+            initialDataTimeout: settingsArg.initialDataTimeout || 120000,
+            socketTimeout: settingsArg.socketTimeout || 3600000,
+            inactivityCheckInterval: settingsArg.inactivityCheckInterval || 60000,
+            maxConnectionLifetime: settingsArg.maxConnectionLifetime || 86400000,
+            inactivityTimeout: settingsArg.inactivityTimeout || 14400000,
+            gracefulShutdownTimeout: settingsArg.gracefulShutdownTimeout || 30000,
+            noDelay: settingsArg.noDelay !== undefined ? settingsArg.noDelay : true,
+            keepAlive: settingsArg.keepAlive !== undefined ? settingsArg.keepAlive : true,
+            keepAliveInitialDelay: settingsArg.keepAliveInitialDelay || 10000,
+            maxPendingDataSize: settingsArg.maxPendingDataSize || 10 * 1024 * 1024,
+            disableInactivityCheck: settingsArg.disableInactivityCheck || false,
+            enableKeepAliveProbes: settingsArg.enableKeepAliveProbes !== undefined ? settingsArg.enableKeepAliveProbes : true,
+            enableDetailedLogging: settingsArg.enableDetailedLogging || false,
+            enableTlsDebugLogging: settingsArg.enableTlsDebugLogging || false,
+            enableRandomizedTimeouts: settingsArg.enableRandomizedTimeouts || false,
+            allowSessionTicket: settingsArg.allowSessionTicket !== undefined ? settingsArg.allowSessionTicket : true,
+            maxConnectionsPerIP: settingsArg.maxConnectionsPerIP || 100,
+            connectionRateLimitPerMinute: settingsArg.connectionRateLimitPerMinute || 300,
+            keepAliveTreatment: settingsArg.keepAliveTreatment || 'extended',
+            keepAliveInactivityMultiplier: settingsArg.keepAliveInactivityMultiplier || 6,
+            extendedKeepAliveLifetime: settingsArg.extendedKeepAliveLifetime || 7 * 24 * 60 * 60 * 1000,
+            networkProxyPort: settingsArg.networkProxyPort || 8443,
+        };
+        // Set default ACME options if not provided
+        this.settings.acme = this.settings.acme || {};
+        if (Object.keys(this.settings.acme).length === 0) {
+            this.settings.acme = {
+                enabled: false,
+                port: 80,
+                accountEmail: 'admin@example.com',
+                useProduction: false,
+                renewThresholdDays: 30,
+                autoRenew: true,
+                certificateStore: './certs',
+                skipConfiguredCerts: false,
+                httpsRedirectPort: 443,
+                renewCheckIntervalHours: 24,
+                routeForwards: []
+            };
+        }
+        // Initialize component managers
+        this.timeoutManager = new TimeoutManager(this.settings);
+        this.securityManager = new SecurityManager(this.settings);
+        this.connectionManager = new ConnectionManager(this.settings, this.securityManager, this.timeoutManager);
+        // Create the route manager
+        this.routeManager = new RouteManager(this.settings);
+        // Create other required components
+        this.tlsManager = new TlsManager(this.settings);
+        this.networkProxyBridge = new NetworkProxyBridge(this.settings);
+        // Initialize connection handler with route support
+        this.routeConnectionHandler = new RouteConnectionHandler(this.settings, this.connectionManager, this.securityManager, this.tlsManager, this.networkProxyBridge, this.timeoutManager, this.routeManager);
+        // Initialize port manager
+        this.portManager = new PortManager(this.settings, this.routeConnectionHandler);
+        // Initialize NFTablesManager
+        this.nftablesManager = new NFTablesManager(this.settings);
+    }
+    /**
+     * Initialize the Port80Handler for ACME certificate management
+     */
+    async initializePort80Handler() {
+        const config = this.settings.acme;
+        if (!config.enabled) {
+            console.log('ACME is disabled in configuration');
+            return;
+        }
+        try {
+            // Build and start the Port80Handler
+            this.port80Handler = buildPort80Handler({
+                ...config,
+                httpsRedirectPort: config.httpsRedirectPort || 443
+            });
+            // Share Port80Handler with NetworkProxyBridge before start
+            this.networkProxyBridge.setPort80Handler(this.port80Handler);
+            await this.port80Handler.start();
+            console.log(`Port80Handler started on port ${config.port}`);
+        }
+        catch (err) {
+            console.log(`Error initializing Port80Handler: ${err}`);
+        }
+    }
+    /**
+     * Start the proxy server with support for both configuration types
+     */
+    async start() {
+        // Don't start if already shutting down
+        if (this.isShuttingDown) {
+            console.log("Cannot start SmartProxy while it's shutting down");
+            return;
+        }
+        // Pure route-based configuration - no domain configs needed
+        // Initialize Port80Handler if enabled
+        await this.initializePort80Handler();
+        // Initialize CertProvisioner for unified certificate workflows
+        if (this.port80Handler) {
+            const acme = this.settings.acme;
+            // Setup route forwards
+            const routeForwards = acme.routeForwards?.map(f => f) || [];
+            // Create CertProvisioner with appropriate parameters
+            // No longer need to support multiple configuration types
+            // Just pass the routes directly
+            this.certProvisioner = new CertProvisioner(this.settings.routes, this.port80Handler, this.networkProxyBridge, this.settings.certProvisionFunction, acme.renewThresholdDays, acme.renewCheckIntervalHours, acme.autoRenew, routeForwards);
+            // Register certificate event handler
+            this.certProvisioner.on('certificate', (certData) => {
+                this.emit('certificate', {
+                    domain: certData.domain,
+                    publicKey: certData.certificate,
+                    privateKey: certData.privateKey,
+                    expiryDate: certData.expiryDate,
+                    source: certData.source,
+                    isRenewal: certData.isRenewal
+                });
+            });
+            await this.certProvisioner.start();
+            console.log('CertProvisioner started');
+        }
+        // Initialize and start NetworkProxy if needed
+        if (this.settings.useNetworkProxy && this.settings.useNetworkProxy.length > 0) {
+            await this.networkProxyBridge.initialize();
+            await this.networkProxyBridge.start();
+        }
+        // Validate the route configuration
+        const configWarnings = this.routeManager.validateConfiguration();
+        if (configWarnings.length > 0) {
+            console.log("Route configuration warnings:");
+            for (const warning of configWarnings) {
+                console.log(` - ${warning}`);
+            }
+        }
+        // Get listening ports from RouteManager
+        const listeningPorts = this.routeManager.getListeningPorts();
+        // Provision NFTables rules for routes that use NFTables
+        for (const route of this.settings.routes) {
+            if (route.action.forwardingEngine === 'nftables') {
+                await this.nftablesManager.provisionRoute(route);
+            }
+        }
+        // Start port listeners using the PortManager
+        await this.portManager.addPorts(listeningPorts);
+        // Set up periodic connection logging and inactivity checks
+        this.connectionLogger = setInterval(() => {
+            // Immediately return if shutting down
+            if (this.isShuttingDown)
+                return;
+            // Perform inactivity check
+            this.connectionManager.performInactivityCheck();
+            // Log connection statistics
+            const now = Date.now();
+            let maxIncoming = 0;
+            let maxOutgoing = 0;
+            let tlsConnections = 0;
+            let nonTlsConnections = 0;
+            let completedTlsHandshakes = 0;
+            let pendingTlsHandshakes = 0;
+            let keepAliveConnections = 0;
+            let networkProxyConnections = 0;
+            // Get connection records for analysis
+            const connectionRecords = this.connectionManager.getConnections();
+            // Analyze active connections
+            for (const record of connectionRecords.values()) {
+                // Track connection stats
+                if (record.isTLS) {
+                    tlsConnections++;
+                    if (record.tlsHandshakeComplete) {
+                        completedTlsHandshakes++;
+                    }
+                    else {
+                        pendingTlsHandshakes++;
+                    }
+                }
+                else {
+                    nonTlsConnections++;
+                }
+                if (record.hasKeepAlive) {
+                    keepAliveConnections++;
+                }
+                if (record.usingNetworkProxy) {
+                    networkProxyConnections++;
+                }
+                maxIncoming = Math.max(maxIncoming, now - record.incomingStartTime);
+                if (record.outgoingStartTime) {
+                    maxOutgoing = Math.max(maxOutgoing, now - record.outgoingStartTime);
+                }
+            }
+            // Get termination stats
+            const terminationStats = this.connectionManager.getTerminationStats();
+            // Log detailed stats
+            console.log(`Active connections: ${connectionRecords.size}. ` +
+                `Types: TLS=${tlsConnections} (Completed=${completedTlsHandshakes}, Pending=${pendingTlsHandshakes}), ` +
+                `Non-TLS=${nonTlsConnections}, KeepAlive=${keepAliveConnections}, NetworkProxy=${networkProxyConnections}. ` +
+                `Longest running: IN=${plugins.prettyMs(maxIncoming)}, OUT=${plugins.prettyMs(maxOutgoing)}. ` +
+                `Termination stats: ${JSON.stringify({
+                    IN: terminationStats.incoming,
+                    OUT: terminationStats.outgoing,
+                })}`);
+        }, this.settings.inactivityCheckInterval || 60000);
+        // Make sure the interval doesn't keep the process alive
+        if (this.connectionLogger.unref) {
+            this.connectionLogger.unref();
+        }
+    }
+    /**
+     * Extract domain configurations from routes for certificate provisioning
+     *
+     * Note: This method has been removed as we now work directly with routes
+     */
+    /**
+     * Stop the proxy server
+     */
+    async stop() {
+        console.log('SmartProxy shutting down...');
+        this.isShuttingDown = true;
+        this.portManager.setShuttingDown(true);
+        // Stop CertProvisioner if active
+        if (this.certProvisioner) {
+            await this.certProvisioner.stop();
+            console.log('CertProvisioner stopped');
+        }
+        // Stop NFTablesManager
+        await this.nftablesManager.stop();
+        console.log('NFTablesManager stopped');
+        // Stop the Port80Handler if running
+        if (this.port80Handler) {
+            try {
+                await this.port80Handler.stop();
+                console.log('Port80Handler stopped');
+                this.port80Handler = null;
+            }
+            catch (err) {
+                console.log(`Error stopping Port80Handler: ${err}`);
+            }
+        }
+        // Stop the connection logger
+        if (this.connectionLogger) {
+            clearInterval(this.connectionLogger);
+            this.connectionLogger = null;
+        }
+        // Stop all port listeners
+        await this.portManager.closeAll();
+        console.log('All servers closed. Cleaning up active connections...');
+        // Clean up all active connections
+        this.connectionManager.clearConnections();
+        // Stop NetworkProxy
+        await this.networkProxyBridge.stop();
+        console.log('SmartProxy shutdown complete.');
+    }
+    /**
+     * Updates the domain configurations for the proxy
+     *
+     * Note: This legacy method has been removed. Use updateRoutes instead.
+     */
+    async updateDomainConfigs() {
+        console.warn('Method updateDomainConfigs() is deprecated. Use updateRoutes() instead.');
+        throw new Error('updateDomainConfigs() is deprecated - use updateRoutes() instead');
+    }
+    /**
+     * Update routes with new configuration
+     *
+     * This method replaces the current route configuration with the provided routes.
+     * It also provisions certificates for routes that require TLS termination and have
+     * `certificate: 'auto'` set in their TLS configuration.
+     *
+     * @param newRoutes Array of route configurations to use
+     *
+     * Example:
+     * ```ts
+     * proxy.updateRoutes([
+     *   {
+     *     match: { ports: 443, domains: 'secure.example.com' },
+     *     action: {
+     *       type: 'forward',
+     *       target: { host: '10.0.0.1', port: 8443 },
+     *       tls: { mode: 'terminate', certificate: 'auto' }
+     *     }
+     *   }
+     * ]);
+     * ```
+     */
+    async updateRoutes(newRoutes) {
+        console.log(`Updating routes (${newRoutes.length} routes)`);
+        // Get existing routes that use NFTables
+        const oldNfTablesRoutes = this.settings.routes.filter(r => r.action.forwardingEngine === 'nftables');
+        // Get new routes that use NFTables
+        const newNfTablesRoutes = newRoutes.filter(r => r.action.forwardingEngine === 'nftables');
+        // Find routes to remove, update, or add
+        for (const oldRoute of oldNfTablesRoutes) {
+            const newRoute = newNfTablesRoutes.find(r => r.name === oldRoute.name);
+            if (!newRoute) {
+                // Route was removed
+                await this.nftablesManager.deprovisionRoute(oldRoute);
+            }
+            else {
+                // Route was updated
+                await this.nftablesManager.updateRoute(oldRoute, newRoute);
+            }
+        }
+        // Find new routes to add
+        for (const newRoute of newNfTablesRoutes) {
+            const oldRoute = oldNfTablesRoutes.find(r => r.name === newRoute.name);
+            if (!oldRoute) {
+                // New route
+                await this.nftablesManager.provisionRoute(newRoute);
+            }
+        }
+        // Update routes in RouteManager
+        this.routeManager.updateRoutes(newRoutes);
+        // Get the new set of required ports
+        const requiredPorts = this.routeManager.getListeningPorts();
+        // Update port listeners to match the new configuration
+        await this.portManager.updatePorts(requiredPorts);
+        // Update settings with the new routes
+        this.settings.routes = newRoutes;
+        // If NetworkProxy is initialized, resync the configurations
+        if (this.networkProxyBridge.getNetworkProxy()) {
+            await this.networkProxyBridge.syncRoutesToNetworkProxy(newRoutes);
+        }
+        // If Port80Handler is running, provision certificates based on routes
+        if (this.port80Handler && this.settings.acme?.enabled) {
+            // Register all eligible domains from routes
+            this.port80Handler.addDomainsFromRoutes(newRoutes);
+            // Handle static certificates from certProvisionFunction if available
+            if (this.settings.certProvisionFunction) {
+                for (const route of newRoutes) {
+                    // Skip routes without domains
+                    if (!route.match.domains)
+                        continue;
+                    // Skip non-forward routes
+                    if (route.action.type !== 'forward')
+                        continue;
+                    // Skip routes without TLS termination
+                    if (!route.action.tls ||
+                        route.action.tls.mode === 'passthrough' ||
+                        !route.action.target)
+                        continue;
+                    // Skip certificate provisioning if certificate is not auto
+                    if (route.action.tls.certificate !== 'auto')
+                        continue;
+                    const domains = Array.isArray(route.match.domains)
+                        ? route.match.domains
+                        : [route.match.domains];
+                    for (const domain of domains) {
+                        try {
+                            const provision = await this.settings.certProvisionFunction(domain);
+                            // Skip http01 as those are handled by Port80Handler
+                            if (provision !== 'http01') {
+                                // Handle static certificate (e.g., DNS-01 provisioned)
+                                const certObj = provision;
+                                const certData = {
+                                    domain: certObj.domainName,
+                                    certificate: certObj.publicKey,
+                                    privateKey: certObj.privateKey,
+                                    expiryDate: new Date(certObj.validUntil),
+                                    routeReference: {
+                                        routeName: route.name
+                                    }
+                                };
+                                this.networkProxyBridge.applyExternalCertificate(certData);
+                                console.log(`Applied static certificate for ${domain} from certProvider`);
+                            }
+                        }
+                        catch (err) {
+                            console.log(`certProvider error for ${domain}: ${err}`);
+                        }
+                    }
+                }
+            }
+            console.log('Provisioned certificates for new routes');
+        }
+    }
+    /**
+     * Request a certificate for a specific domain
+     *
+     * @param domain The domain to request a certificate for
+     * @param routeName Optional route name to associate with the certificate
+     */
+    async requestCertificate(domain, routeName) {
+        // Validate domain format
+        if (!this.isValidDomain(domain)) {
+            console.log(`Invalid domain format: ${domain}`);
+            return false;
+        }
+        // Use Port80Handler if available
+        if (this.port80Handler) {
+            try {
+                // Check if we already have a certificate
+                const cert = this.port80Handler.getCertificate(domain);
+                if (cert) {
+                    console.log(`Certificate already exists for ${domain}, valid until ${cert.expiryDate.toISOString()}`);
+                    return true;
+                }
+                // Register domain for certificate issuance
+                this.port80Handler.addDomain({
+                    domain,
+                    sslRedirect: true,
+                    acmeMaintenance: true,
+                    routeReference: routeName ? { routeName } : undefined
+                });
+                console.log(`Domain ${domain} registered for certificate issuance` + (routeName ? ` for route '${routeName}'` : ''));
+                return true;
+            }
+            catch (err) {
+                console.log(`Error registering domain with Port80Handler: ${err}`);
+                return false;
+            }
+        }
+        // Fall back to NetworkProxyBridge
+        return this.networkProxyBridge.requestCertificate(domain);
+    }
+    /**
+     * Validates if a domain name is valid for certificate issuance
+     */
+    isValidDomain(domain) {
+        // Very basic domain validation
+        if (!domain || domain.length === 0) {
+            return false;
+        }
+        // Check for wildcard domains (they can't get ACME certs)
+        if (domain.includes('*')) {
+            console.log(`Wildcard domains like "${domain}" are not supported for ACME certificates`);
+            return false;
+        }
+        // Check if domain has at least one dot and no invalid characters
+        const validDomainRegex = /^[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/;
+        if (!validDomainRegex.test(domain)) {
+            console.log(`Domain "${domain}" has invalid format`);
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Add a new listening port without changing the route configuration
+     *
+     * This allows you to add a port listener without updating routes.
+     * Useful for preparing to listen on a port before adding routes for it.
+     *
+     * @param port The port to start listening on
+     * @returns Promise that resolves when the port is listening
+     */
+    async addListeningPort(port) {
+        return this.portManager.addPort(port);
+    }
+    /**
+     * Stop listening on a specific port without changing the route configuration
+     *
+     * This allows you to stop a port listener without updating routes.
+     * Useful for temporary maintenance or port changes.
+     *
+     * @param port The port to stop listening on
+     * @returns Promise that resolves when the port is closed
+     */
+    async removeListeningPort(port) {
+        return this.portManager.removePort(port);
+    }
+    /**
+     * Get a list of all ports currently being listened on
+     *
+     * @returns Array of port numbers
+     */
+    getListeningPorts() {
+        return this.portManager.getListeningPorts();
+    }
+    /**
+     * Get statistics about current connections
+     */
+    getStatistics() {
+        const connectionRecords = this.connectionManager.getConnections();
+        const terminationStats = this.connectionManager.getTerminationStats();
+        let tlsConnections = 0;
+        let nonTlsConnections = 0;
+        let keepAliveConnections = 0;
+        let networkProxyConnections = 0;
+        // Analyze active connections
+        for (const record of connectionRecords.values()) {
+            if (record.isTLS)
+                tlsConnections++;
+            else
+                nonTlsConnections++;
+            if (record.hasKeepAlive)
+                keepAliveConnections++;
+            if (record.usingNetworkProxy)
+                networkProxyConnections++;
+        }
+        return {
+            activeConnections: connectionRecords.size,
+            tlsConnections,
+            nonTlsConnections,
+            keepAliveConnections,
+            networkProxyConnections,
+            terminationStats,
+            acmeEnabled: !!this.port80Handler,
+            port80HandlerPort: this.port80Handler ? this.settings.acme?.port : null,
+            routes: this.routeManager.getListeningPorts().length,
+            listeningPorts: this.portManager.getListeningPorts(),
+            activePorts: this.portManager.getListeningPorts().length
+        };
+    }
+    /**
+     * Get a list of eligible domains for ACME certificates
+     */
+    getEligibleDomainsForCertificates() {
+        const domains = [];
+        // Get domains from routes
+        const routes = this.settings.routes || [];
+        for (const route of routes) {
+            if (!route.match.domains)
+                continue;
+            // Skip routes without TLS termination or auto certificates
+            if (route.action.type !== 'forward' ||
+                !route.action.tls ||
+                route.action.tls.mode === 'passthrough' ||
+                route.action.tls.certificate !== 'auto')
+                continue;
+            const routeDomains = Array.isArray(route.match.domains)
+                ? route.match.domains
+                : [route.match.domains];
+            // Skip domains that can't be used with ACME
+            const eligibleDomains = routeDomains.filter(domain => !domain.includes('*') && this.isValidDomain(domain));
+            domains.push(...eligibleDomains);
+        }
+        // Legacy mode is no longer supported
+        return domains;
+    }
+    /**
+     * Get NFTables status
+     */
+    async getNfTablesStatus() {
+        return this.nftablesManager.getStatus();
+    }
+    /**
+     * Get status of certificates managed by Port80Handler
+     */
+    getCertificateStatus() {
+        if (!this.port80Handler) {
+            return {
+                enabled: false,
+                message: 'Port80Handler is not enabled'
+            };
+        }
+        // Get eligible domains
+        const eligibleDomains = this.getEligibleDomainsForCertificates();
+        const certificateStatus = {};
+        // Check each domain
+        for (const domain of eligibleDomains) {
+            const cert = this.port80Handler.getCertificate(domain);
+            if (cert) {
+                const now = new Date();
+                const expiryDate = cert.expiryDate;
+                const daysRemaining = Math.floor((expiryDate.getTime() - now.getTime()) / (24 * 60 * 60 * 1000));
+                certificateStatus[domain] = {
+                    status: 'valid',
+                    expiryDate: expiryDate.toISOString(),
+                    daysRemaining,
+                    renewalNeeded: daysRemaining <= (this.settings.acme?.renewThresholdDays ?? 0)
+                };
+            }
+            else {
+                certificateStatus[domain] = {
+                    status: 'missing',
+                    message: 'No certificate found'
+                };
+            }
+        }
+        const acme = this.settings.acme;
+        return {
+            enabled: true,
+            port: acme.port,
+            useProduction: acme.useProduction,
+            autoRenew: acme.autoRenew,
+            certificates: certificateStatus
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibGVnYWN5LXNtYXJ0LXByb3h5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvcHJveGllcy9zbWFydC1wcm94eS9sZWdhY3ktc21hcnQtcHJveHkudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxnQ0FBZ0M7QUFDaEMsT0FBTyxFQUFFLGlCQUFpQixFQUFFLE1BQU0seUJBQXlCLENBQUM7QUFDNUQsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLHVCQUF1QixDQUFDO0FBQ3hELE9BQU8sRUFBRSxVQUFVLEVBQUUsTUFBTSxrQkFBa0IsQ0FBQztBQUM5QyxPQUFPLEVBQUUsa0JBQWtCLEVBQUUsTUFBTSwyQkFBMkIsQ0FBQztBQUMvRCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDdEQsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLG1CQUFtQixDQUFDO0FBQ2hELE9BQU8sRUFBRSxZQUFZLEVBQUUsTUFBTSxvQkFBb0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsc0JBQXNCLEVBQUUsTUFBTSwrQkFBK0IsQ0FBQztBQUN2RSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0sdUJBQXVCLENBQUM7QUFFeEQsd0JBQXdCO0FBQ3hCLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSxxQ0FBcUMsQ0FBQztBQUNwRSxPQUFPLEVBQUUsZUFBZSxFQUFFLE1BQU0saURBQWlELENBQUM7QUFFbEYsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sd0NBQXdDLENBQUM7QUFDNUUsT0FBTyxFQUFFLDBCQUEwQixFQUFFLE1BQU0sZ0NBQWdDLENBQUM7QUFRNUU7Ozs7Ozs7Ozs7OztHQVlHO0FBQ0gsTUFBTSxPQUFPLFVBQVcsU0FBUSxPQUFPLENBQUMsWUFBWTtJQXFCbEQ7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQThCRztJQUNILFlBQVksV0FBK0I7UUFDekMsS0FBSyxFQUFFLENBQUM7UUFsREYscUJBQWdCLEdBQTBCLElBQUksQ0FBQztRQUMvQyxtQkFBYyxHQUFZLEtBQUssQ0FBQztRQVl4QyxnREFBZ0Q7UUFDeEMsa0JBQWEsR0FBeUIsSUFBSSxDQUFDO1FBc0NqRCwyQ0FBMkM7UUFDM0MsSUFBSSxDQUFDLFFBQVEsR0FBRztZQUNkLEdBQUcsV0FBVztZQUNkLGtCQUFrQixFQUFFLFdBQVcsQ0FBQyxrQkFBa0IsSUFBSSxNQUFNO1lBQzVELGFBQWEsRUFBRSxXQUFXLENBQUMsYUFBYSxJQUFJLE9BQU87WUFDbkQsdUJBQXVCLEVBQUUsV0FBVyxDQUFDLHVCQUF1QixJQUFJLEtBQUs7WUFDckUscUJBQXFCLEVBQUUsV0FBVyxDQUFDLHFCQUFxQixJQUFJLFFBQVE7WUFDcEUsaUJBQWlCLEVBQUUsV0FBVyxDQUFDLGlCQUFpQixJQUFJLFFBQVE7WUFDNUQsdUJBQXVCLEVBQUUsV0FBVyxDQUFDLHVCQUF1QixJQUFJLEtBQUs7WUFDckUsT0FBTyxFQUFFLFdBQVcsQ0FBQyxPQUFPLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ3ZFLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUyxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUM3RSxxQkFBcUIsRUFBRSxXQUFXLENBQUMscUJBQXFCLElBQUksS0FBSztZQUNqRSxrQkFBa0IsRUFBRSxXQUFXLENBQUMsa0JBQWtCLElBQUksRUFBRSxHQUFHLElBQUksR0FBRyxJQUFJO1lBQ3RFLHNCQUFzQixFQUFFLFdBQVcsQ0FBQyxzQkFBc0IsSUFBSSxLQUFLO1lBQ25FLHFCQUFxQixFQUNuQixXQUFXLENBQUMscUJBQXFCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxXQUFXLENBQUMscUJBQXFCLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDNUYscUJBQXFCLEVBQUUsV0FBVyxDQUFDLHFCQUFxQixJQUFJLEtBQUs7WUFDakUscUJBQXFCLEVBQUUsV0FBVyxDQUFDLHFCQUFxQixJQUFJLEtBQUs7WUFDakUsd0JBQXdCLEVBQUUsV0FBVyxDQUFDLHdCQUF3QixJQUFJLEtBQUs7WUFDdkUsa0JBQWtCLEVBQ2hCLFdBQVcsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUN0RixtQkFBbUIsRUFBRSxXQUFXLENBQUMsbUJBQW1CLElBQUksR0FBRztZQUMzRCw0QkFBNEIsRUFBRSxXQUFXLENBQUMsNEJBQTRCLElBQUksR0FBRztZQUM3RSxrQkFBa0IsRUFBRSxXQUFXLENBQUMsa0JBQWtCLElBQUksVUFBVTtZQUNoRSw2QkFBNkIsRUFBRSxXQUFXLENBQUMsNkJBQTZCLElBQUksQ0FBQztZQUM3RSx5QkFBeUIsRUFBRSxXQUFXLENBQUMseUJBQXlCLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7WUFDM0YsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLGdCQUFnQixJQUFJLElBQUk7U0FDdkQsQ0FBQztRQUVGLDJDQUEyQztRQUMzQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksSUFBSSxFQUFFLENBQUM7UUFDOUMsSUFBSSxNQUFNLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2pELElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHO2dCQUNuQixPQUFPLEVBQUUsS0FBSztnQkFDZCxJQUFJLEVBQUUsRUFBRTtnQkFDUixZQUFZLEVBQUUsbUJBQW1CO2dCQUNqQyxhQUFhLEVBQUUsS0FBSztnQkFDcEIsa0JBQWtCLEVBQUUsRUFBRTtnQkFDdEIsU0FBUyxFQUFFLElBQUk7Z0JBQ2YsZ0JBQWdCLEVBQUUsU0FBUztnQkFDM0IsbUJBQW1CLEVBQUUsS0FBSztnQkFDMUIsaUJBQWlCLEVBQUUsR0FBRztnQkFDdEIsdUJBQXVCLEVBQUUsRUFBRTtnQkFDM0IsYUFBYSxFQUFFLEVBQUU7YUFDbEIsQ0FBQztRQUNKLENBQUM7UUFFRCxnQ0FBZ0M7UUFDaEMsSUFBSSxDQUFDLGNBQWMsR0FBRyxJQUFJLGNBQWMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDeEQsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLGVBQWUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUQsSUFBSSxDQUFDLGlCQUFpQixHQUFHLElBQUksaUJBQWlCLENBQzVDLElBQUksQ0FBQyxRQUFRLEVBQ2IsSUFBSSxDQUFDLGVBQWUsRUFDcEIsSUFBSSxDQUFDLGNBQWMsQ0FDcEIsQ0FBQztRQUVGLDJCQUEyQjtRQUMzQixJQUFJLENBQUMsWUFBWSxHQUFHLElBQUksWUFBWSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUdwRCxtQ0FBbUM7UUFDbkMsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLFVBQVUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLGtCQUFrQixHQUFHLElBQUksa0JBQWtCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRWhFLG1EQUFtRDtRQUNuRCxJQUFJLENBQUMsc0JBQXNCLEdBQUcsSUFBSSxzQkFBc0IsQ0FDdEQsSUFBSSxDQUFDLFFBQVEsRUFDYixJQUFJLENBQUMsaUJBQWlCLEVBQ3RCLElBQUksQ0FBQyxlQUFlLEVBQ3BCLElBQUksQ0FBQyxVQUFVLEVBQ2YsSUFBSSxDQUFDLGtCQUFrQixFQUN2QixJQUFJLENBQUMsY0FBYyxFQUNuQixJQUFJLENBQUMsWUFBWSxDQUNsQixDQUFDO1FBRUYsMEJBQTBCO1FBQzFCLElBQUksQ0FBQyxXQUFXLEdBQUcsSUFBSSxXQUFXLENBQUMsSUFBSSxDQUFDLFFBQVEsRUFBRSxJQUFJLENBQUMsc0JBQXNCLENBQUMsQ0FBQztRQUUvRSw2QkFBNkI7UUFDN0IsSUFBSSxDQUFDLGVBQWUsR0FBRyxJQUFJLGVBQWUsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7SUFDNUQsQ0FBQztJQU9EOztPQUVHO0lBQ0ssS0FBSyxDQUFDLHVCQUF1QjtRQUNuQyxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUssQ0FBQztRQUNuQyxJQUFJLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3BCLE9BQU8sQ0FBQyxHQUFHLENBQUMsbUNBQW1DLENBQUMsQ0FBQztZQUNqRCxPQUFPO1FBQ1QsQ0FBQztRQUVELElBQUksQ0FBQztZQUNILG9DQUFvQztZQUNwQyxJQUFJLENBQUMsYUFBYSxHQUFHLGtCQUFrQixDQUFDO2dCQUN0QyxHQUFHLE1BQU07Z0JBQ1QsaUJBQWlCLEVBQUUsTUFBTSxDQUFDLGlCQUFpQixJQUFJLEdBQUc7YUFDbkQsQ0FBQyxDQUFDO1lBRUgsMkRBQTJEO1lBQzNELElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDN0QsTUFBTSxJQUFJLENBQUMsYUFBYSxDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2pDLE9BQU8sQ0FBQyxHQUFHLENBQUMsaUNBQWlDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFBQyxPQUFPLEdBQUcsRUFBRSxDQUFDO1lBQ2IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxxQ0FBcUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUMxRCxDQUFDO0lBQ0gsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLEtBQUs7UUFDaEIsdUNBQXVDO1FBQ3ZDLElBQUksSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3hCLE9BQU8sQ0FBQyxHQUFHLENBQUMsa0RBQWtELENBQUMsQ0FBQztZQUNoRSxPQUFPO1FBQ1QsQ0FBQztRQUVELDREQUE0RDtRQUU1RCxzQ0FBc0M7UUFDdEMsTUFBTSxJQUFJLENBQUMsdUJBQXVCLEVBQUUsQ0FBQztRQUVyQywrREFBK0Q7UUFDL0QsSUFBSSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDdkIsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFLLENBQUM7WUFFakMsdUJBQXVCO1lBQ3ZCLE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1lBRTVELHFEQUFxRDtZQUNyRCx5REFBeUQ7WUFDekQsZ0NBQWdDO1lBQ2hDLElBQUksQ0FBQyxlQUFlLEdBQUcsSUFBSSxlQUFlLENBQ3hDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxFQUNwQixJQUFJLENBQUMsYUFBYSxFQUNsQixJQUFJLENBQUMsa0JBQWtCLEVBQ3ZCLElBQUksQ0FBQyxRQUFRLENBQUMscUJBQXFCLEVBQ25DLElBQUksQ0FBQyxrQkFBbUIsRUFDeEIsSUFBSSxDQUFDLHVCQUF3QixFQUM3QixJQUFJLENBQUMsU0FBVSxFQUNmLGFBQWEsQ0FDZCxDQUFDO1lBRUYscUNBQXFDO1lBQ3JDLElBQUksQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDLGFBQWEsRUFBRSxDQUFDLFFBQVEsRUFBRSxFQUFFO2dCQUNsRCxJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsRUFBRTtvQkFDdkIsTUFBTSxFQUFFLFFBQVEsQ0FBQyxNQUFNO29CQUN2QixTQUFTLEVBQUUsUUFBUSxDQUFDLFdBQVc7b0JBQy9CLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVTtvQkFDL0IsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVO29CQUMvQixNQUFNLEVBQUUsUUFBUSxDQUFDLE1BQU07b0JBQ3ZCLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUztpQkFDOUIsQ0FBQyxDQUFDO1lBQ0wsQ0FBQyxDQUFDLENBQUM7WUFFSCxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDbkMsT0FBTyxDQUFDLEdBQUcsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ3pDLENBQUM7UUFFRCw4Q0FBOEM7UUFDOUMsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDOUUsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDM0MsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDeEMsQ0FBQztRQUVELG1DQUFtQztRQUNuQyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLHFCQUFxQixFQUFFLENBQUM7UUFDakUsSUFBSSxjQUFjLENBQUMsTUFBTSxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzlCLE9BQU8sQ0FBQyxHQUFHLENBQUMsK0JBQStCLENBQUMsQ0FBQztZQUM3QyxLQUFLLE1BQU0sT0FBTyxJQUFJLGNBQWMsRUFBRSxDQUFDO2dCQUNyQyxPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMvQixDQUFDO1FBQ0gsQ0FBQztRQUVELHdDQUF3QztRQUN4QyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFFN0Qsd0RBQXdEO1FBQ3hELEtBQUssTUFBTSxLQUFLLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUN6QyxJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEtBQUssVUFBVSxFQUFFLENBQUM7Z0JBQ2pELE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxjQUFjLENBQUMsS0FBSyxDQUFDLENBQUM7WUFDbkQsQ0FBQztRQUNILENBQUM7UUFFRCw2Q0FBNkM7UUFDN0MsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUVoRCwyREFBMkQ7UUFDM0QsSUFBSSxDQUFDLGdCQUFnQixHQUFHLFdBQVcsQ0FBQyxHQUFHLEVBQUU7WUFDdkMsc0NBQXNDO1lBQ3RDLElBQUksSUFBSSxDQUFDLGNBQWM7Z0JBQUUsT0FBTztZQUVoQywyQkFBMkI7WUFDM0IsSUFBSSxDQUFDLGlCQUFpQixDQUFDLHNCQUFzQixFQUFFLENBQUM7WUFFaEQsNEJBQTRCO1lBQzVCLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN2QixJQUFJLFdBQVcsR0FBRyxDQUFDLENBQUM7WUFDcEIsSUFBSSxXQUFXLEdBQUcsQ0FBQyxDQUFDO1lBQ3BCLElBQUksY0FBYyxHQUFHLENBQUMsQ0FBQztZQUN2QixJQUFJLGlCQUFpQixHQUFHLENBQUMsQ0FBQztZQUMxQixJQUFJLHNCQUFzQixHQUFHLENBQUMsQ0FBQztZQUMvQixJQUFJLG9CQUFvQixHQUFHLENBQUMsQ0FBQztZQUM3QixJQUFJLG9CQUFvQixHQUFHLENBQUMsQ0FBQztZQUM3QixJQUFJLHVCQUF1QixHQUFHLENBQUMsQ0FBQztZQUVoQyxzQ0FBc0M7WUFDdEMsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsY0FBYyxFQUFFLENBQUM7WUFFbEUsNkJBQTZCO1lBQzdCLEtBQUssTUFBTSxNQUFNLElBQUksaUJBQWlCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztnQkFDaEQseUJBQXlCO2dCQUN6QixJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztvQkFDakIsY0FBYyxFQUFFLENBQUM7b0JBQ2pCLElBQUksTUFBTSxDQUFDLG9CQUFvQixFQUFFLENBQUM7d0JBQ2hDLHNCQUFzQixFQUFFLENBQUM7b0JBQzNCLENBQUM7eUJBQU0sQ0FBQzt3QkFDTixvQkFBb0IsRUFBRSxDQUFDO29CQUN6QixDQUFDO2dCQUNILENBQUM7cUJBQU0sQ0FBQztvQkFDTixpQkFBaUIsRUFBRSxDQUFDO2dCQUN0QixDQUFDO2dCQUVELElBQUksTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO29CQUN4QixvQkFBb0IsRUFBRSxDQUFDO2dCQUN6QixDQUFDO2dCQUVELElBQUksTUFBTSxDQUFDLGlCQUFpQixFQUFFLENBQUM7b0JBQzdCLHVCQUF1QixFQUFFLENBQUM7Z0JBQzVCLENBQUM7Z0JBRUQsV0FBVyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLEdBQUcsR0FBRyxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQztnQkFDcEUsSUFBSSxNQUFNLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztvQkFDN0IsV0FBVyxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsV0FBVyxFQUFFLEdBQUcsR0FBRyxNQUFNLENBQUMsaUJBQWlCLENBQUMsQ0FBQztnQkFDdEUsQ0FBQztZQUNILENBQUM7WUFFRCx3QkFBd0I7WUFDeEIsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsbUJBQW1CLEVBQUUsQ0FBQztZQUV0RSxxQkFBcUI7WUFDckIsT0FBTyxDQUFDLEdBQUcsQ0FDVCx1QkFBdUIsaUJBQWlCLENBQUMsSUFBSSxJQUFJO2dCQUNqRCxjQUFjLGNBQWMsZUFBZSxzQkFBc0IsYUFBYSxvQkFBb0IsS0FBSztnQkFDdkcsV0FBVyxpQkFBaUIsZUFBZSxvQkFBb0Isa0JBQWtCLHVCQUF1QixJQUFJO2dCQUM1Ryx1QkFBdUIsT0FBTyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsU0FBUyxPQUFPLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxJQUFJO2dCQUM5RixzQkFBc0IsSUFBSSxDQUFDLFNBQVMsQ0FBQztvQkFDbkMsRUFBRSxFQUFFLGdCQUFnQixDQUFDLFFBQVE7b0JBQzdCLEdBQUcsRUFBRSxnQkFBZ0IsQ0FBQyxRQUFRO2lCQUMvQixDQUFDLEVBQUUsQ0FDTCxDQUFDO1FBQ0osQ0FBQyxFQUFFLElBQUksQ0FBQyxRQUFRLENBQUMsdUJBQXVCLElBQUksS0FBSyxDQUFDLENBQUM7UUFFbkQsd0RBQXdEO1FBQ3hELElBQUksSUFBSSxDQUFDLGdCQUFnQixDQUFDLEtBQUssRUFBRSxDQUFDO1lBQ2hDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUNoQyxDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7O09BSUc7SUFFSDs7T0FFRztJQUNJLEtBQUssQ0FBQyxJQUFJO1FBQ2YsT0FBTyxDQUFDLEdBQUcsQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1FBQzNDLElBQUksQ0FBQyxjQUFjLEdBQUcsSUFBSSxDQUFDO1FBQzNCLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDLElBQUksQ0FBQyxDQUFDO1FBRXZDLGlDQUFpQztRQUNqQyxJQUFJLElBQUksQ0FBQyxlQUFlLEVBQUUsQ0FBQztZQUN6QixNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDbEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ3pDLENBQUM7UUFFRCx1QkFBdUI7UUFDdkIsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2xDLE9BQU8sQ0FBQyxHQUFHLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUV2QyxvQ0FBb0M7UUFDcEMsSUFBSSxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7WUFDdkIsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztnQkFDaEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO2dCQUNyQyxJQUFJLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQztZQUM1QixDQUFDO1lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztnQkFDYixPQUFPLENBQUMsR0FBRyxDQUFDLGlDQUFpQyxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ3RELENBQUM7UUFDSCxDQUFDO1FBRUQsNkJBQTZCO1FBQzdCLElBQUksSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDMUIsYUFBYSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1lBQ3JDLElBQUksQ0FBQyxnQkFBZ0IsR0FBRyxJQUFJLENBQUM7UUFDL0IsQ0FBQztRQUVELDBCQUEwQjtRQUMxQixNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUSxFQUFFLENBQUM7UUFDbEMsT0FBTyxDQUFDLEdBQUcsQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1FBRXJFLGtDQUFrQztRQUNsQyxJQUFJLENBQUMsaUJBQWlCLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztRQUUxQyxvQkFBb0I7UUFDcEIsTUFBTSxJQUFJLENBQUMsa0JBQWtCLENBQUMsSUFBSSxFQUFFLENBQUM7UUFHckMsT0FBTyxDQUFDLEdBQUcsQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLG1CQUFtQjtRQUM5QixPQUFPLENBQUMsSUFBSSxDQUFDLHlFQUF5RSxDQUFDLENBQUM7UUFDeEYsTUFBTSxJQUFJLEtBQUssQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQ3RGLENBQUM7SUFFRDs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztPQXNCRztJQUNJLEtBQUssQ0FBQyxZQUFZLENBQUMsU0FBeUI7UUFDakQsT0FBTyxDQUFDLEdBQUcsQ0FBQyxvQkFBb0IsU0FBUyxDQUFDLE1BQU0sVUFBVSxDQUFDLENBQUM7UUFFNUQsd0NBQXdDO1FBQ3hDLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUNuRCxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxNQUFNLENBQUMsZ0JBQWdCLEtBQUssVUFBVSxDQUM5QyxDQUFDO1FBRUYsbUNBQW1DO1FBQ25DLE1BQU0saUJBQWlCLEdBQUcsU0FBUyxDQUFDLE1BQU0sQ0FDeEMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLGdCQUFnQixLQUFLLFVBQVUsQ0FDOUMsQ0FBQztRQUVGLHdDQUF3QztRQUN4QyxLQUFLLE1BQU0sUUFBUSxJQUFJLGlCQUFpQixFQUFFLENBQUM7WUFDekMsTUFBTSxRQUFRLEdBQUcsaUJBQWlCLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7WUFFdkUsSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUNkLG9CQUFvQjtnQkFDcEIsTUFBTSxJQUFJLENBQUMsZUFBZSxDQUFDLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3hELENBQUM7aUJBQU0sQ0FBQztnQkFDTixvQkFBb0I7Z0JBQ3BCLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQzdELENBQUM7UUFDSCxDQUFDO1FBRUQseUJBQXlCO1FBQ3pCLEtBQUssTUFBTSxRQUFRLElBQUksaUJBQWlCLEVBQUUsQ0FBQztZQUN6QyxNQUFNLFFBQVEsR0FBRyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUV2RSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ2QsWUFBWTtnQkFDWixNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3RELENBQUM7UUFDSCxDQUFDO1FBRUQsZ0NBQWdDO1FBQ2hDLElBQUksQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBRTFDLG9DQUFvQztRQUNwQyxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFFNUQsdURBQXVEO1FBQ3ZELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsYUFBYSxDQUFDLENBQUM7UUFFbEQsc0NBQXNDO1FBQ3RDLElBQUksQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLFNBQVMsQ0FBQztRQUVqQyw0REFBNEQ7UUFDNUQsSUFBSSxJQUFJLENBQUMsa0JBQWtCLENBQUMsZUFBZSxFQUFFLEVBQUUsQ0FBQztZQUM5QyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyx3QkFBd0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNwRSxDQUFDO1FBRUQsc0VBQXNFO1FBQ3RFLElBQUksSUFBSSxDQUFDLGFBQWEsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUN0RCw0Q0FBNEM7WUFDNUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxvQkFBb0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztZQUVuRCxxRUFBcUU7WUFDckUsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLHFCQUFxQixFQUFFLENBQUM7Z0JBQ3hDLEtBQUssTUFBTSxLQUFLLElBQUksU0FBUyxFQUFFLENBQUM7b0JBQzlCLDhCQUE4QjtvQkFDOUIsSUFBSSxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTzt3QkFBRSxTQUFTO29CQUVuQywwQkFBMEI7b0JBQzFCLElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssU0FBUzt3QkFBRSxTQUFTO29CQUU5QyxzQ0FBc0M7b0JBQ3RDLElBQUksQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUc7d0JBQ2pCLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxhQUFhO3dCQUN2QyxDQUFDLEtBQUssQ0FBQyxNQUFNLENBQUMsTUFBTTt3QkFBRSxTQUFTO29CQUVuQywyREFBMkQ7b0JBQzNELElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsV0FBVyxLQUFLLE1BQU07d0JBQUUsU0FBUztvQkFFdEQsTUFBTSxPQUFPLEdBQUcsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQzt3QkFDaEQsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTzt3QkFDckIsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsQ0FBQztvQkFFMUIsS0FBSyxNQUFNLE1BQU0sSUFBSSxPQUFPLEVBQUUsQ0FBQzt3QkFDN0IsSUFBSSxDQUFDOzRCQUNILE1BQU0sU0FBUyxHQUFHLE1BQU0sSUFBSSxDQUFDLFFBQVEsQ0FBQyxxQkFBcUIsQ0FBQyxNQUFNLENBQUMsQ0FBQzs0QkFFcEUsb0RBQW9EOzRCQUNwRCxJQUFJLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQ0FDM0IsdURBQXVEO2dDQUN2RCxNQUFNLE9BQU8sR0FBRyxTQUEwQyxDQUFDO2dDQUMzRCxNQUFNLFFBQVEsR0FBcUI7b0NBQ2pDLE1BQU0sRUFBRSxPQUFPLENBQUMsVUFBVTtvQ0FDMUIsV0FBVyxFQUFFLE9BQU8sQ0FBQyxTQUFTO29DQUM5QixVQUFVLEVBQUUsT0FBTyxDQUFDLFVBQVU7b0NBQzlCLFVBQVUsRUFBRSxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDO29DQUN4QyxjQUFjLEVBQUU7d0NBQ2QsU0FBUyxFQUFFLEtBQUssQ0FBQyxJQUFJO3FDQUN0QjtpQ0FDRixDQUFDO2dDQUNGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsQ0FBQztnQ0FDM0QsT0FBTyxDQUFDLEdBQUcsQ0FBQyxrQ0FBa0MsTUFBTSxvQkFBb0IsQ0FBQyxDQUFDOzRCQUM1RSxDQUFDO3dCQUNILENBQUM7d0JBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQzs0QkFDYixPQUFPLENBQUMsR0FBRyxDQUFDLDBCQUEwQixNQUFNLEtBQUssR0FBRyxFQUFFLENBQUMsQ0FBQzt3QkFDMUQsQ0FBQztvQkFDSCxDQUFDO2dCQUNILENBQUM7WUFDSCxDQUFDO1lBRUQsT0FBTyxDQUFDLEdBQUcsQ0FBQyx5Q0FBeUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7SUFDSCxDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsTUFBYyxFQUFFLFNBQWtCO1FBQ2hFLHlCQUF5QjtRQUN6QixJQUFJLENBQUMsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ2hDLE9BQU8sQ0FBQyxHQUFHLENBQUMsMEJBQTBCLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDaEQsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBRUQsaUNBQWlDO1FBQ2pDLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQ3ZCLElBQUksQ0FBQztnQkFDSCx5Q0FBeUM7Z0JBQ3pDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN2RCxJQUFJLElBQUksRUFBRSxDQUFDO29CQUNULE9BQU8sQ0FBQyxHQUFHLENBQUMsa0NBQWtDLE1BQU0saUJBQWlCLElBQUksQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQyxDQUFDO29CQUN0RyxPQUFPLElBQUksQ0FBQztnQkFDZCxDQUFDO2dCQUVELDJDQUEyQztnQkFDM0MsSUFBSSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUM7b0JBQzNCLE1BQU07b0JBQ04sV0FBVyxFQUFFLElBQUk7b0JBQ2pCLGVBQWUsRUFBRSxJQUFJO29CQUNyQixjQUFjLEVBQUUsU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLFNBQVMsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTO2lCQUN0RCxDQUFDLENBQUM7Z0JBRUgsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLE1BQU0sc0NBQXNDLEdBQUcsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLGVBQWUsU0FBUyxHQUFHLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQ3JILE9BQU8sSUFBSSxDQUFDO1lBQ2QsQ0FBQztZQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7Z0JBQ2IsT0FBTyxDQUFDLEdBQUcsQ0FBQyxnREFBZ0QsR0FBRyxFQUFFLENBQUMsQ0FBQztnQkFDbkUsT0FBTyxLQUFLLENBQUM7WUFDZixDQUFDO1FBQ0gsQ0FBQztRQUVELGtDQUFrQztRQUNsQyxPQUFPLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUM1RCxDQUFDO0lBRUQ7O09BRUc7SUFDSyxhQUFhLENBQUMsTUFBYztRQUNsQywrQkFBK0I7UUFDL0IsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ25DLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELHlEQUF5RDtRQUN6RCxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN6QixPQUFPLENBQUMsR0FBRyxDQUFDLDBCQUEwQixNQUFNLDJDQUEyQyxDQUFDLENBQUM7WUFDekYsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBRUQsaUVBQWlFO1FBQ2pFLE1BQU0sZ0JBQWdCLEdBQUcsK0ZBQStGLENBQUM7UUFDekgsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ25DLE9BQU8sQ0FBQyxHQUFHLENBQUMsV0FBVyxNQUFNLHNCQUFzQixDQUFDLENBQUM7WUFDckQsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7Ozs7Ozs7O09BUUc7SUFDSSxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBWTtRQUN4QyxPQUFPLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQ3hDLENBQUM7SUFFRDs7Ozs7Ozs7T0FRRztJQUNJLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxJQUFZO1FBQzNDLE9BQU8sSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxpQkFBaUI7UUFDdEIsT0FBTyxJQUFJLENBQUMsV0FBVyxDQUFDLGlCQUFpQixFQUFFLENBQUM7SUFDOUMsQ0FBQztJQUVEOztPQUVHO0lBQ0ksYUFBYTtRQUNsQixNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNsRSxNQUFNLGdCQUFnQixHQUFHLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBRXRFLElBQUksY0FBYyxHQUFHLENBQUMsQ0FBQztRQUN2QixJQUFJLGlCQUFpQixHQUFHLENBQUMsQ0FBQztRQUMxQixJQUFJLG9CQUFvQixHQUFHLENBQUMsQ0FBQztRQUM3QixJQUFJLHVCQUF1QixHQUFHLENBQUMsQ0FBQztRQUVoQyw2QkFBNkI7UUFDN0IsS0FBSyxNQUFNLE1BQU0sSUFBSSxpQkFBaUIsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQ2hELElBQUksTUFBTSxDQUFDLEtBQUs7Z0JBQUUsY0FBYyxFQUFFLENBQUM7O2dCQUM5QixpQkFBaUIsRUFBRSxDQUFDO1lBQ3pCLElBQUksTUFBTSxDQUFDLFlBQVk7Z0JBQUUsb0JBQW9CLEVBQUUsQ0FBQztZQUNoRCxJQUFJLE1BQU0sQ0FBQyxpQkFBaUI7Z0JBQUUsdUJBQXVCLEVBQUUsQ0FBQztRQUMxRCxDQUFDO1FBRUQsT0FBTztZQUNMLGlCQUFpQixFQUFFLGlCQUFpQixDQUFDLElBQUk7WUFDekMsY0FBYztZQUNkLGlCQUFpQjtZQUNqQixvQkFBb0I7WUFDcEIsdUJBQXVCO1lBQ3ZCLGdCQUFnQjtZQUNoQixXQUFXLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxhQUFhO1lBQ2pDLGlCQUFpQixFQUFFLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUN2RSxNQUFNLEVBQUUsSUFBSSxDQUFDLFlBQVksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDLE1BQU07WUFDcEQsY0FBYyxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEVBQUU7WUFDcEQsV0FBVyxFQUFFLElBQUksQ0FBQyxXQUFXLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxNQUFNO1NBQ3pELENBQUM7SUFDSixDQUFDO0lBRUQ7O09BRUc7SUFDSSxpQ0FBaUM7UUFDdEMsTUFBTSxPQUFPLEdBQWEsRUFBRSxDQUFDO1FBRTdCLDBCQUEwQjtRQUMxQixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sSUFBSSxFQUFFLENBQUM7UUFFMUMsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUMzQixJQUFJLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxPQUFPO2dCQUFFLFNBQVM7WUFFbkMsMkRBQTJEO1lBQzNELElBQUksS0FBSyxDQUFDLE1BQU0sQ0FBQyxJQUFJLEtBQUssU0FBUztnQkFDL0IsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUc7Z0JBQ2pCLEtBQUssQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksS0FBSyxhQUFhO2dCQUN2QyxLQUFLLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEtBQUssTUFBTTtnQkFBRSxTQUFTO1lBRXRELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUM7Z0JBQ3JELENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE9BQU87Z0JBQ3JCLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLENBQUM7WUFFMUIsNENBQTRDO1lBQzVDLE1BQU0sZUFBZSxHQUFHLFlBQVksQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FDbkQsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxDQUFDLENBQ3BELENBQUM7WUFFRixPQUFPLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSxDQUFDLENBQUM7UUFDbkMsQ0FBQztRQUVELHFDQUFxQztRQUVyQyxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQ7O09BRUc7SUFDSSxLQUFLLENBQUMsaUJBQWlCO1FBQzVCLE9BQU8sSUFBSSxDQUFDLGVBQWUsQ0FBQyxTQUFTLEVBQUUsQ0FBQztJQUMxQyxDQUFDO0lBRUQ7O09BRUc7SUFDSSxvQkFBb0I7UUFDekIsSUFBSSxDQUFDLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN4QixPQUFPO2dCQUNMLE9BQU8sRUFBRSxLQUFLO2dCQUNkLE9BQU8sRUFBRSw4QkFBOEI7YUFDeEMsQ0FBQztRQUNKLENBQUM7UUFFRCx1QkFBdUI7UUFDdkIsTUFBTSxlQUFlLEdBQUcsSUFBSSxDQUFDLGlDQUFpQyxFQUFFLENBQUM7UUFDakUsTUFBTSxpQkFBaUIsR0FBd0IsRUFBRSxDQUFDO1FBRWxELG9CQUFvQjtRQUNwQixLQUFLLE1BQU0sTUFBTSxJQUFJLGVBQWUsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBRXZELElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ1QsTUFBTSxHQUFHLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztnQkFDdkIsTUFBTSxVQUFVLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQztnQkFDbkMsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsR0FBRyxHQUFHLENBQUMsT0FBTyxFQUFFLENBQUMsR0FBRyxDQUFDLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUksQ0FBQyxDQUFDLENBQUM7Z0JBRWpHLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxHQUFHO29CQUMxQixNQUFNLEVBQUUsT0FBTztvQkFDZixVQUFVLEVBQUUsVUFBVSxDQUFDLFdBQVcsRUFBRTtvQkFDcEMsYUFBYTtvQkFDYixhQUFhLEVBQUUsYUFBYSxJQUFJLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLEVBQUUsa0JBQWtCLElBQUksQ0FBQyxDQUFDO2lCQUM5RSxDQUFDO1lBQ0osQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxHQUFHO29CQUMxQixNQUFNLEVBQUUsU0FBUztvQkFDakIsT0FBTyxFQUFFLHNCQUFzQjtpQkFDaEMsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFLLENBQUM7UUFDakMsT0FBTztZQUNMLE9BQU8sRUFBRSxJQUFJO1lBQ2IsSUFBSSxFQUFFLElBQUksQ0FBQyxJQUFLO1lBQ2hCLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYztZQUNsQyxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVU7WUFDMUIsWUFBWSxFQUFFLGlCQUFpQjtTQUNoQyxDQUFDO0lBQ0osQ0FBQztDQUNGIn0=