@push.rocks/smartsecret 1.0.2 → 1.2.0

package/dist_ts/smartsecret.keyring.js

@@ -0,0 +1,758 @@
+import * as plugins from './smartsecret.plugins.js';
+import { SmartSecretKeyringError, createSmartSecretKeyringError, } from './smartsecret.keyring.error.js';
+import { SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES, SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES, SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES, SMARTSECRET_KEYRING_PROFILE, SMARTSECRET_KEYRING_SCHEMA_VERSION, createSmartSecretPayloadDigest, createSmartSecretWrapAad, encodeCanonicalBase64Url, fingerprintToBytes, parseSmartSecretEnvelope, requireEpochMilliseconds, requireFingerprint, requireKekVersion, requireSmartSecretIdentifier, sha256Bytes, timingSafeEqual, wipeCiphertext, } from './smartsecret.keyring.protocol.js';
+const descriptorKeys = [
+    'version',
+    'status',
+    'credentialPath',
+    'expectedFingerprint',
+    'createdAt',
+    'activatedAt',
+    'retiredAt',
+    'revokedAt',
+    'escrowReference',
+    'escrowedAt',
+    'recoveryTestedAt',
+];
+const requireConfigObject = (valueArg, allowedKeysArg, requiredKeysArg, errorCodeArg = 'CONFIG_INVALID') => {
+    try {
+        if (valueArg === null || typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+            throw createSmartSecretKeyringError(errorCodeArg);
+        }
+        const prototype = Object.getPrototypeOf(valueArg);
+        if (prototype !== Object.prototype && prototype !== null) {
+            throw createSmartSecretKeyringError(errorCodeArg);
+        }
+        const ownKeys = Reflect.ownKeys(valueArg);
+        if (ownKeys.length < requiredKeysArg.length
+            || ownKeys.length > allowedKeysArg.length
+            || ownKeys.some((keyArg) => typeof keyArg !== 'string')) {
+            throw createSmartSecretKeyringError(errorCodeArg);
+        }
+        const keys = ownKeys;
+        if (keys.some((keyArg) => !allowedKeysArg.includes(keyArg))
+            || requiredKeysArg.some((keyArg) => !keys.includes(keyArg))) {
+            throw createSmartSecretKeyringError(errorCodeArg);
+        }
+        const result = Object.create(null);
+        for (const key of keys) {
+            const descriptor = Object.getOwnPropertyDescriptor(valueArg, key);
+            if (!descriptor?.enumerable || !('value' in descriptor)) {
+                throw createSmartSecretKeyringError(errorCodeArg);
+            }
+            result[key] = descriptor.value;
+        }
+        return result;
+    }
+    catch (error) {
+        if (error instanceof SmartSecretKeyringError) {
+            throw error;
+        }
+        throw createSmartSecretKeyringError(errorCodeArg);
+    }
+};
+const requireDescriptorArray = (valueArg) => {
+    try {
+        if (!Array.isArray(valueArg) || Object.getPrototypeOf(valueArg) !== Array.prototype) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+        const ownKeys = Reflect.ownKeys(valueArg);
+        const lengthDescriptor = Object.getOwnPropertyDescriptor(valueArg, 'length');
+        if (!lengthDescriptor
+            || !('value' in lengthDescriptor)
+            || !Number.isSafeInteger(lengthDescriptor.value)
+            || lengthDescriptor.value < 0
+            || ownKeys.length !== lengthDescriptor.value + 1) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+        if (ownKeys.some((keyArg) => typeof keyArg === 'symbol')) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+        const result = new Array(lengthDescriptor.value);
+        for (let index = 0; index < lengthDescriptor.value; index++) {
+            const descriptor = Object.getOwnPropertyDescriptor(valueArg, String(index));
+            if (!descriptor?.enumerable || !('value' in descriptor)) {
+                throw createSmartSecretKeyringError('CONFIG_INVALID');
+            }
+            result[index] = descriptor.value;
+        }
+        return result;
+    }
+    catch (error) {
+        if (error instanceof SmartSecretKeyringError) {
+            throw error;
+        }
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+};
+const requireOptionalTimestamp = (valueArg, keyArg) => {
+    if (!Object.hasOwn(valueArg, keyArg)) {
+        return undefined;
+    }
+    return requireEpochMilliseconds(valueArg[keyArg]);
+};
+const normalizeDescriptor = (valueArg) => {
+    const value = requireConfigObject(valueArg, descriptorKeys, [
+        'version',
+        'status',
+        'createdAt',
+        'activatedAt',
+    ]);
+    const version = requireKekVersion(value.version);
+    if (value.status !== 'active' && value.status !== 'retired' && value.status !== 'revoked') {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    const status = value.status;
+    const createdAt = requireEpochMilliseconds(value.createdAt);
+    const activatedAt = requireEpochMilliseconds(value.activatedAt);
+    const retiredAt = requireOptionalTimestamp(value, 'retiredAt');
+    const revokedAt = requireOptionalTimestamp(value, 'revokedAt');
+    const escrowedAt = requireOptionalTimestamp(value, 'escrowedAt');
+    const recoveryTestedAt = requireOptionalTimestamp(value, 'recoveryTestedAt');
+    if (createdAt > activatedAt) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    if (status === 'active' && (retiredAt !== undefined || revokedAt !== undefined)) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    if (status === 'retired' && (retiredAt === undefined || revokedAt !== undefined)) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    if (status === 'revoked' && revokedAt === undefined) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    if (retiredAt !== undefined && retiredAt < activatedAt) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    if (revokedAt !== undefined && revokedAt < (retiredAt ?? activatedAt)) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    const hasEscrowReference = Object.hasOwn(value, 'escrowReference');
+    const hasEscrowedAt = escrowedAt !== undefined;
+    if (hasEscrowReference !== hasEscrowedAt) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    let escrowReference;
+    if (hasEscrowReference) {
+        escrowReference = requireSmartSecretIdentifier(value.escrowReference);
+    }
+    if (escrowedAt !== undefined && escrowedAt < createdAt) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    if (recoveryTestedAt !== undefined) {
+        if (escrowedAt === undefined || recoveryTestedAt < escrowedAt) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+        if (revokedAt !== undefined && recoveryTestedAt > revokedAt) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+    }
+    let credentialPath;
+    let expectedFingerprint;
+    if (status === 'revoked') {
+        if (Object.hasOwn(value, 'credentialPath') || Object.hasOwn(value, 'expectedFingerprint')) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+    }
+    else {
+        if (typeof value.credentialPath !== 'string') {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+        credentialPath = value.credentialPath;
+        if (!plugins.path.isAbsolute(credentialPath)
+            || plugins.path.resolve(credentialPath) !== credentialPath) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+        expectedFingerprint = requireFingerprint(value.expectedFingerprint);
+    }
+    return Object.freeze({
+        version,
+        status,
+        ...(credentialPath === undefined ? {} : { credentialPath }),
+        ...(expectedFingerprint === undefined ? {} : { expectedFingerprint }),
+        createdAt,
+        activatedAt,
+        ...(retiredAt === undefined ? {} : { retiredAt }),
+        ...(revokedAt === undefined ? {} : { revokedAt }),
+        ...(escrowReference === undefined ? {} : { escrowReference }),
+        ...(escrowedAt === undefined ? {} : { escrowedAt }),
+        ...(recoveryTestedAt === undefined ? {} : { recoveryTestedAt }),
+    });
+};
+const normalizeConfig = (valueArg) => {
+    const value = requireConfigObject(valueArg, ['keyringId', 'keys'], ['keyringId', 'keys']);
+    const keyringId = requireSmartSecretIdentifier(value.keyringId);
+    const descriptorValues = requireDescriptorArray(value.keys);
+    const descriptors = descriptorValues.map((descriptorArg) => normalizeDescriptor(descriptorArg));
+    if (descriptors.length === 0) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    for (let index = 1; index < descriptors.length; index++) {
+        if (descriptors[index - 1].version >= descriptors[index].version) {
+            throw createSmartSecretKeyringError('CONFIG_INVALID');
+        }
+    }
+    const active = descriptors.filter((descriptorArg) => descriptorArg.status === 'active');
+    if (active.length !== 1) {
+        throw createSmartSecretKeyringError('CONFIG_INVALID');
+    }
+    return {
+        keyringId,
+        descriptors: Object.freeze(descriptors),
+        activeVersion: active[0].version,
+    };
+};
+const statsMatch = (leftArg, rightArg) => leftArg.dev === rightArg.dev
+    && leftArg.ino === rightArg.ino
+    && leftArg.mode === rightArg.mode
+    && leftArg.nlink === rightArg.nlink
+    && leftArg.uid === rightArg.uid
+    && leftArg.gid === rightArg.gid
+    && leftArg.rdev === rightArg.rdev
+    && leftArg.size === rightArg.size
+    && leftArg.mtimeNs === rightArg.mtimeNs
+    && leftArg.ctimeNs === rightArg.ctimeNs;
+const statsIdentityMatches = (leftArg, rightArg) => leftArg.dev === rightArg.dev
+    && leftArg.ino === rightArg.ino
+    && leftArg.mode === rightArg.mode
+    && leftArg.uid === rightArg.uid
+    && leftArg.gid === rightArg.gid;
+const lstatPathComponents = async (credentialPathArg) => {
+    const root = plugins.path.parse(credentialPathArg).root;
+    const relative = plugins.path.relative(root, credentialPathArg);
+    const components = relative.split(plugins.path.sep).filter(Boolean);
+    const result = [];
+    let currentPath = root;
+    const rootStats = await plugins.fs.promises.lstat(root, { bigint: true });
+    if (rootStats.isSymbolicLink() || !rootStats.isDirectory()) {
+        throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+    }
+    result.push({ path: root, stats: rootStats });
+    for (let index = 0; index < components.length; index++) {
+        currentPath = plugins.path.join(currentPath, components[index]);
+        const stats = await plugins.fs.promises.lstat(currentPath, { bigint: true });
+        const isFinal = index === components.length - 1;
+        if (stats.isSymbolicLink()
+            || (isFinal ? !stats.isFile() : !stats.isDirectory())) {
+            throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+        }
+        result.push({ path: currentPath, stats });
+    }
+    return result;
+};
+const loadCredential = async (descriptorArg) => {
+    let handle;
+    let key;
+    let readBuffer;
+    let didFail = false;
+    try {
+        const credentialPath = descriptorArg.credentialPath;
+        const beforeComponents = await lstatPathComponents(credentialPath);
+        const beforeFinal = beforeComponents[beforeComponents.length - 1].stats;
+        if (typeof plugins.fs.constants.O_NOFOLLOW !== 'number') {
+            throw createSmartSecretKeyringError('PLATFORM_UNSUPPORTED');
+        }
+        handle = await plugins.fs.promises.open(credentialPath, plugins.fs.constants.O_RDONLY | plugins.fs.constants.O_NOFOLLOW);
+        const beforeFd = await handle.stat({ bigint: true });
+        if (!beforeFd.isFile()
+            || beforeFd.size !== 32n
+            || (beforeFd.mode & 18n) !== 0n
+            || !statsMatch(beforeFinal, beforeFd)) {
+            throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+        }
+        readBuffer = Buffer.alloc(33);
+        let totalBytesRead = 0;
+        while (totalBytesRead < readBuffer.byteLength) {
+            const { bytesRead } = await handle.read(readBuffer, totalBytesRead, readBuffer.byteLength - totalBytesRead, totalBytesRead);
+            if (bytesRead === 0) {
+                break;
+            }
+            totalBytesRead += bytesRead;
+        }
+        if (totalBytesRead !== 32) {
+            throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+        }
+        const afterFd = await handle.stat({ bigint: true });
+        const afterComponents = await lstatPathComponents(credentialPath);
+        if (beforeComponents.length !== afterComponents.length) {
+            throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+        }
+        for (let index = 0; index < beforeComponents.length - 1; index++) {
+            if (!statsIdentityMatches(beforeComponents[index].stats, afterComponents[index].stats)) {
+                throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+            }
+        }
+        const afterFinal = afterComponents[afterComponents.length - 1].stats;
+        if (!statsMatch(beforeFd, afterFd) || !statsMatch(afterFd, afterFinal)) {
+            throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+        }
+        key = new Uint8Array(readBuffer.subarray(0, 32));
+        const actualFingerprint = sha256Bytes(key);
+        const expectedFingerprint = fingerprintToBytes(descriptorArg.expectedFingerprint);
+        try {
+            if (!timingSafeEqual(actualFingerprint, expectedFingerprint)) {
+                throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+            }
+        }
+        finally {
+            actualFingerprint.fill(0);
+            expectedFingerprint.fill(0);
+        }
+    }
+    catch {
+        didFail = true;
+    }
+    finally {
+        readBuffer?.fill(0);
+        if (handle) {
+            try {
+                await handle.close();
+            }
+            catch {
+                didFail = true;
+            }
+        }
+    }
+    if (didFail || !key) {
+        key?.fill(0);
+        throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+    }
+    return key;
+};
+const copyBytes = (valueArg, minimumBytesArg, maximumBytesArg) => {
+    if (!(valueArg instanceof Uint8Array)) {
+        throw createSmartSecretKeyringError('INVALID_ARGUMENT');
+    }
+    if (valueArg.byteLength < minimumBytesArg || valueArg.byteLength > maximumBytesArg) {
+        throw createSmartSecretKeyringError('SIZE_LIMIT_EXCEEDED');
+    }
+    return new Uint8Array(valueArg);
+};
+const copyIdentifier = (valueArg) => {
+    try {
+        return requireSmartSecretIdentifier(valueArg);
+    }
+    catch {
+        throw createSmartSecretKeyringError('INVALID_ARGUMENT');
+    }
+};
+const encodeCiphertext = (valueArg) => ({
+    nonce: encodeCanonicalBase64Url(valueArg.nonce),
+    ciphertext: encodeCanonicalBase64Url(valueArg.ciphertext),
+    tag: encodeCanonicalBase64Url(valueArg.tag),
+});
+const wipeParsedEnvelope = (valueArg) => {
+    valueArg.contextDigest.fill(0);
+    valueArg.kekFingerprint.fill(0);
+    wipeCiphertext(valueArg.payload);
+    wipeCiphertext(valueArg.wrappedDek);
+};
+/**
+ * A Linux-only, immutable KEK snapshot for strict DEK/KEK envelopes.
+ * Envelope persistence and compare-and-swap coordination remain consumer responsibilities.
+ */
+export class SmartSecretKeyring {
+    constructor(keyringId, descriptors, activeVersion, loadedKeys) {
+        this.keyringId = keyringId;
+        this.descriptors = descriptors;
+        this.activeVersion = activeVersion;
+        this.loadedKeys = loadedKeys;
+        this.destroyed = false;
+    }
+    static async create(configArg) {
+        if (process.platform !== 'linux') {
+            throw createSmartSecretKeyringError('PLATFORM_UNSUPPORTED');
+        }
+        const config = normalizeConfig(configArg);
+        const loadedKeys = new Map();
+        try {
+            for (const descriptor of config.descriptors) {
+                if (descriptor.status === 'revoked') {
+                    continue;
+                }
+                let key;
+                try {
+                    key = await loadCredential(descriptor);
+                    loadedKeys.set(descriptor.version, { descriptor, key });
+                    key = undefined;
+                }
+                finally {
+                    key?.fill(0);
+                }
+            }
+            return new SmartSecretKeyring(config.keyringId, config.descriptors, config.activeVersion, loadedKeys);
+        }
+        catch (error) {
+            for (const loaded of loadedKeys.values()) {
+                loaded.key.fill(0);
+            }
+            if (error instanceof SmartSecretKeyringError) {
+                throw error;
+            }
+            throw createSmartSecretKeyringError('CREDENTIAL_FILE_INVALID');
+        }
+    }
+    requireAlive() {
+        if (this.destroyed) {
+            throw createSmartSecretKeyringError('DESTROYED');
+        }
+    }
+    requireEnvelopeKey(envelopeArg) {
+        if (envelopeArg.kek.keyringId !== this.keyringId) {
+            throw createSmartSecretKeyringError('KEK_UNAVAILABLE');
+        }
+        const loaded = this.loadedKeys.get(envelopeArg.kek.version);
+        if (!loaded || loaded.descriptor.status === 'revoked') {
+            throw createSmartSecretKeyringError('KEK_UNAVAILABLE');
+        }
+        if (envelopeArg.kek.fingerprint !== loaded.descriptor.expectedFingerprint) {
+            throw createSmartSecretKeyringError('KEK_FINGERPRINT_MISMATCH');
+        }
+        return new Uint8Array(loaded.key);
+    }
+    inspect() {
+        this.requireAlive();
+        return {
+            keyringId: this.keyringId,
+            activeVersion: this.activeVersion,
+            keys: this.descriptors.map((descriptorArg) => ({
+                version: descriptorArg.version,
+                status: descriptorArg.status,
+                ...(descriptorArg.expectedFingerprint === undefined
+                    ? {}
+                    : { expectedFingerprint: descriptorArg.expectedFingerprint }),
+                createdAt: descriptorArg.createdAt,
+                activatedAt: descriptorArg.activatedAt,
+                ...(descriptorArg.retiredAt === undefined ? {} : { retiredAt: descriptorArg.retiredAt }),
+                ...(descriptorArg.revokedAt === undefined ? {} : { revokedAt: descriptorArg.revokedAt }),
+                ...(descriptorArg.escrowReference === undefined
+                    ? {}
+                    : { escrowReference: descriptorArg.escrowReference }),
+                ...(descriptorArg.escrowedAt === undefined ? {} : { escrowedAt: descriptorArg.escrowedAt }),
+                ...(descriptorArg.recoveryTestedAt === undefined
+                    ? {}
+                    : { recoveryTestedAt: descriptorArg.recoveryTestedAt }),
+            })),
+        };
+    }
+    destroy() {
+        if (this.destroyed) {
+            return;
+        }
+        this.destroyed = true;
+        for (const loaded of this.loadedKeys.values()) {
+            loaded.key.fill(0);
+        }
+    }
+    async encryptEnvelope(optionsArg) {
+        this.requireAlive();
+        const options = requireConfigObject(optionsArg, ['envelopeId', 'plaintext', 'context', 'createdAt'], ['envelopeId', 'plaintext', 'context'], 'INVALID_ARGUMENT');
+        const envelopeId = copyIdentifier(options.envelopeId);
+        let createdAt;
+        try {
+            createdAt = options.createdAt === undefined
+                ? Date.now()
+                : requireEpochMilliseconds(options.createdAt);
+        }
+        catch {
+            throw createSmartSecretKeyringError('INVALID_ARGUMENT');
+        }
+        let plaintext;
+        let context;
+        let kek;
+        let kekFingerprint;
+        let contextDigest;
+        let dek;
+        let payload;
+        let wrappedDek;
+        let payloadDigest;
+        let wrapAad;
+        try {
+            plaintext = copyBytes(options.plaintext, 0, SMARTSECRET_KEYRING_MAX_PAYLOAD_BYTES);
+            context = copyBytes(options.context, SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES, SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES);
+            const active = this.loadedKeys.get(this.activeVersion);
+            kek = new Uint8Array(active.key);
+            kekFingerprint = fingerprintToBytes(active.descriptor.expectedFingerprint);
+            contextDigest = sha256Bytes(context);
+            dek = plugins.smartcrypto.generateDek();
+            try {
+                payload = await plugins.smartcrypto.aesGcmEncrypt({
+                    key: dek,
+                    plaintext,
+                    aad: context,
+                });
+                payloadDigest = createSmartSecretPayloadDigest(payload);
+                wrapAad = createSmartSecretWrapAad({
+                    envelopeId,
+                    createdAt,
+                    contextDigest,
+                    payloadDigest,
+                    keyringId: this.keyringId,
+                    kekVersion: active.descriptor.version,
+                    kekFingerprint,
+                });
+                wrappedDek = await plugins.smartcrypto.wrapDek({ dek, kek, wrapAad });
+            }
+            catch (error) {
+                if (error instanceof SmartSecretKeyringError) {
+                    throw error;
+                }
+                throw createSmartSecretKeyringError('CRYPTO_OPERATION_FAILED');
+            }
+            return {
+                schemaVersion: SMARTSECRET_KEYRING_SCHEMA_VERSION,
+                profile: SMARTSECRET_KEYRING_PROFILE,
+                envelopeId,
+                createdAt,
+                contextDigest: encodeCanonicalBase64Url(contextDigest),
+                kek: {
+                    keyringId: this.keyringId,
+                    version: active.descriptor.version,
+                    fingerprint: active.descriptor.expectedFingerprint,
+                },
+                payload: encodeCiphertext(payload),
+                wrappedDek: encodeCiphertext(wrappedDek),
+            };
+        }
+        finally {
+            plaintext?.fill(0);
+            context?.fill(0);
+            contextDigest?.fill(0);
+            dek?.fill(0);
+            kek?.fill(0);
+            kekFingerprint?.fill(0);
+            payloadDigest?.fill(0);
+            wrapAad?.fill(0);
+            wipeCiphertext(payload);
+            wipeCiphertext(wrappedDek);
+        }
+    }
+    async decryptEnvelope(optionsArg) {
+        this.requireAlive();
+        const options = requireConfigObject(optionsArg, ['envelope', 'expectedEnvelopeId', 'context'], ['envelope', 'expectedEnvelopeId', 'context'], 'INVALID_ARGUMENT');
+        const expectedEnvelopeId = copyIdentifier(options.expectedEnvelopeId);
+        const parsed = parseSmartSecretEnvelope(options.envelope);
+        let context;
+        let envelopeKey;
+        let contextDigest;
+        let payloadDigest;
+        let wrapAad;
+        let dek;
+        try {
+            context = copyBytes(options.context, SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES, SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES);
+            envelopeKey = this.requireEnvelopeKey(parsed.envelope);
+            contextDigest = sha256Bytes(context);
+            payloadDigest = createSmartSecretPayloadDigest(parsed.payload);
+            wrapAad = createSmartSecretWrapAad({
+                envelopeId: parsed.envelope.envelopeId,
+                createdAt: parsed.envelope.createdAt,
+                contextDigest: parsed.contextDigest,
+                payloadDigest,
+                keyringId: parsed.envelope.kek.keyringId,
+                kekVersion: parsed.envelope.kek.version,
+                kekFingerprint: parsed.kekFingerprint,
+            });
+            if (parsed.envelope.envelopeId !== expectedEnvelopeId) {
+                throw createSmartSecretKeyringError('ENVELOPE_ID_MISMATCH');
+            }
+            if (!timingSafeEqual(contextDigest, parsed.contextDigest)) {
+                throw createSmartSecretKeyringError('CONTEXT_MISMATCH');
+            }
+            try {
+                dek = await plugins.smartcrypto.unwrapDek({
+                    wrappedDek: parsed.wrappedDek,
+                    kek: envelopeKey,
+                    wrapAad,
+                });
+                return await plugins.smartcrypto.aesGcmDecrypt({
+                    key: dek,
+                    encryptedData: parsed.payload,
+                    aad: context,
+                });
+            }
+            catch {
+                throw createSmartSecretKeyringError('AUTHENTICATION_FAILED');
+            }
+        }
+        finally {
+            context?.fill(0);
+            contextDigest?.fill(0);
+            payloadDigest?.fill(0);
+            wrapAad?.fill(0);
+            envelopeKey?.fill(0);
+            dek?.fill(0);
+            wipeParsedEnvelope(parsed);
+        }
+    }
+    async rewrapEnvelope(optionsArg) {
+        this.requireAlive();
+        const options = requireConfigObject(optionsArg, ['envelope', 'expectedEnvelopeId', 'context', 'targetVersion'], ['envelope', 'expectedEnvelopeId', 'context'], 'INVALID_ARGUMENT');
+        const expectedEnvelopeId = copyIdentifier(options.expectedEnvelopeId);
+        const parsed = parseSmartSecretEnvelope(options.envelope);
+        let context;
+        let currentKey;
+        let targetKey;
+        let targetFingerprint;
+        let contextDigest;
+        let payloadDigest;
+        let currentWrapAad;
+        let newWrapAad;
+        let wrappedDek;
+        try {
+            context = copyBytes(options.context, SMARTSECRET_KEYRING_MIN_CONTEXT_BYTES, SMARTSECRET_KEYRING_MAX_CONTEXT_BYTES);
+            currentKey = this.requireEnvelopeKey(parsed.envelope);
+            if (options.targetVersion !== undefined) {
+                let targetVersion;
+                try {
+                    targetVersion = requireKekVersion(options.targetVersion);
+                }
+                catch {
+                    throw createSmartSecretKeyringError('TARGET_VERSION_MISMATCH');
+                }
+                if (targetVersion !== this.activeVersion) {
+                    throw createSmartSecretKeyringError('TARGET_VERSION_MISMATCH');
+                }
+            }
+            const active = this.loadedKeys.get(this.activeVersion);
+            targetKey = new Uint8Array(active.key);
+            targetFingerprint = fingerprintToBytes(active.descriptor.expectedFingerprint);
+            contextDigest = sha256Bytes(context);
+            payloadDigest = createSmartSecretPayloadDigest(parsed.payload);
+            currentWrapAad = createSmartSecretWrapAad({
+                envelopeId: parsed.envelope.envelopeId,
+                createdAt: parsed.envelope.createdAt,
+                contextDigest: parsed.contextDigest,
+                payloadDigest,
+                keyringId: parsed.envelope.kek.keyringId,
+                kekVersion: parsed.envelope.kek.version,
+                kekFingerprint: parsed.kekFingerprint,
+            });
+            newWrapAad = createSmartSecretWrapAad({
+                envelopeId: parsed.envelope.envelopeId,
+                createdAt: parsed.envelope.createdAt,
+                contextDigest: parsed.contextDigest,
+                payloadDigest,
+                keyringId: this.keyringId,
+                kekVersion: active.descriptor.version,
+                kekFingerprint: targetFingerprint,
+            });
+            if (parsed.envelope.envelopeId !== expectedEnvelopeId) {
+                throw createSmartSecretKeyringError('ENVELOPE_ID_MISMATCH');
+            }
+            if (!timingSafeEqual(contextDigest, parsed.contextDigest)) {
+                throw createSmartSecretKeyringError('CONTEXT_MISMATCH');
+            }
+            try {
+                wrappedDek = await plugins.smartcrypto.rewrapDek({
+                    wrappedDek: parsed.wrappedDek,
+                    currentKek: currentKey,
+                    currentWrapAad,
+                    newKek: targetKey,
+                    newWrapAad,
+                });
+            }
+            catch {
+                throw createSmartSecretKeyringError('AUTHENTICATION_FAILED');
+            }
+            return {
+                schemaVersion: parsed.envelope.schemaVersion,
+                profile: parsed.envelope.profile,
+                envelopeId: parsed.envelope.envelopeId,
+                createdAt: parsed.envelope.createdAt,
+                contextDigest: parsed.envelope.contextDigest,
+                kek: {
+                    keyringId: this.keyringId,
+                    version: active.descriptor.version,
+                    fingerprint: active.descriptor.expectedFingerprint,
+                },
+                payload: { ...parsed.envelope.payload },
+                wrappedDek: encodeCiphertext(wrappedDek),
+            };
+        }
+        finally {
+            context?.fill(0);
+            contextDigest?.fill(0);
+            payloadDigest?.fill(0);
+            currentWrapAad?.fill(0);
+            newWrapAad?.fill(0);
+            currentKey?.fill(0);
+            targetKey?.fill(0);
+            targetFingerprint?.fill(0);
+            wipeCiphertext(wrappedDek);
+            wipeParsedEnvelope(parsed);
+        }
+    }
+    async recoverySelfTest(versionArg) {
+        this.requireAlive();
+        let version;
+        try {
+            version = requireKekVersion(versionArg);
+        }
+        catch {
+            throw createSmartSecretKeyringError('INVALID_ARGUMENT');
+        }
+        const loaded = this.loadedKeys.get(version);
+        if (!loaded || loaded.descriptor.status === 'revoked') {
+            throw createSmartSecretKeyringError('KEK_UNAVAILABLE');
+        }
+        let key;
+        let fingerprint;
+        let dek;
+        let keyringId;
+        let length;
+        let versionBytes;
+        let aad;
+        let wrappedDek;
+        let unwrappedDek;
+        try {
+            key = new Uint8Array(loaded.key);
+            fingerprint = fingerprintToBytes(loaded.descriptor.expectedFingerprint);
+            dek = plugins.smartcrypto.generateDek();
+            keyringId = Buffer.from(this.keyringId, 'utf8');
+            length = Buffer.allocUnsafe(4);
+            length.writeUInt32BE(keyringId.byteLength, 0);
+            versionBytes = Buffer.allocUnsafe(8);
+            versionBytes.writeBigUInt64BE(BigInt(version), 0);
+            aad = Buffer.concat([
+                Buffer.from('smartsecret-keyring-recovery-aad-v1', 'ascii'),
+                length,
+                keyringId,
+                versionBytes,
+                fingerprint,
+            ]);
+            try {
+                wrappedDek = await plugins.smartcrypto.wrapDek({ dek, kek: key, wrapAad: aad });
+                unwrappedDek = await plugins.smartcrypto.unwrapDek({
+                    wrappedDek,
+                    kek: key,
+                    wrapAad: aad,
+                });
+            }
+            catch {
+                throw createSmartSecretKeyringError('CRYPTO_OPERATION_FAILED');
+            }
+            if (!timingSafeEqual(dek, unwrappedDek)) {
+                throw createSmartSecretKeyringError('CRYPTO_OPERATION_FAILED');
+            }
+            return {
+                keyringId: this.keyringId,
+                version,
+                status: loaded.descriptor.status,
+                fingerprint: loaded.descriptor.expectedFingerprint,
+                testedAt: Date.now(),
+            };
+        }
+        finally {
+            key?.fill(0);
+            fingerprint?.fill(0);
+            dek?.fill(0);
+            keyringId?.fill(0);
+            length?.fill(0);
+            versionBytes?.fill(0);
+            aad?.fill(0);
+            wipeCiphertext(wrappedDek);
+            unwrappedDek?.fill(0);
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoic21hcnRzZWNyZXQua2V5cmluZy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3NtYXJ0c2VjcmV0LmtleXJpbmcudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSwwQkFBMEIsQ0FBQztBQUNwRCxPQUFPLEVBQ0wsdUJBQXVCLEVBQ3ZCLDZCQUE2QixHQUM5QixNQUFNLGdDQUFnQyxDQUFDO0FBQ3hDLE9BQU8sRUFDTCxxQ0FBcUMsRUFDckMscUNBQXFDLEVBQ3JDLHFDQUFxQyxFQUNyQywyQkFBMkIsRUFDM0Isa0NBQWtDLEVBQ2xDLDhCQUE4QixFQUM5Qix3QkFBd0IsRUFDeEIsd0JBQXdCLEVBQ3hCLGtCQUFrQixFQUNsQix3QkFBd0IsRUFDeEIsd0JBQXdCLEVBQ3hCLGtCQUFrQixFQUNsQixpQkFBaUIsRUFDakIsNEJBQTRCLEVBQzVCLFdBQVcsRUFDWCxlQUFlLEVBQ2YsY0FBYyxHQUdmLE1BQU0sbUNBQW1DLENBQUM7QUFrRjNDLE1BQU0sY0FBYyxHQUFHO0lBQ3JCLFNBQVM7SUFDVCxRQUFRO0lBQ1IsZ0JBQWdCO0lBQ2hCLHFCQUFxQjtJQUNyQixXQUFXO0lBQ1gsYUFBYTtJQUNiLFdBQVc7SUFDWCxXQUFXO0lBQ1gsaUJBQWlCO0lBQ2pCLFlBQVk7SUFDWixrQkFBa0I7Q0FDVixDQUFDO0FBRVgsTUFBTSxtQkFBbUIsR0FBRyxDQUMxQixRQUFpQixFQUNqQixjQUFpQyxFQUNqQyxlQUFrQyxFQUNsQyxlQUFzRCxnQkFBZ0IsRUFDN0MsRUFBRTtJQUMzQixJQUFJLENBQUM7UUFDSCxJQUFJLFFBQVEsS0FBSyxJQUFJLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUNqRixNQUFNLDZCQUE2QixDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ2xELElBQUksU0FBUyxLQUFLLE1BQU0sQ0FBQyxTQUFTLElBQUksU0FBUyxLQUFLLElBQUksRUFBRSxDQUFDO1lBQ3pELE1BQU0sNkJBQTZCLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDcEQsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUMsSUFDRSxPQUFPLENBQUMsTUFBTSxHQUFHLGVBQWUsQ0FBQyxNQUFNO2VBQ3BDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsY0FBYyxDQUFDLE1BQU07ZUFDdEMsT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsT0FBTyxNQUFNLEtBQUssUUFBUSxDQUFDLEVBQ3ZELENBQUM7WUFDRCxNQUFNLDZCQUE2QixDQUFDLFlBQVksQ0FBQyxDQUFDO1FBQ3BELENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxPQUFtQixDQUFDO1FBQ2pDLElBQ0UsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDO2VBQ3BELGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxFQUMzRCxDQUFDO1lBQ0QsTUFBTSw2QkFBNkIsQ0FBQyxZQUFZLENBQUMsQ0FBQztRQUNwRCxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQTRCLE1BQU0sQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDNUQsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUN2QixNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBQ2xFLElBQUksQ0FBQyxVQUFVLEVBQUUsVUFBVSxJQUFJLENBQUMsQ0FBQyxPQUFPLElBQUksVUFBVSxDQUFDLEVBQUUsQ0FBQztnQkFDeEQsTUFBTSw2QkFBNkIsQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUNwRCxDQUFDO1lBQ0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7UUFDakMsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksdUJBQXVCLEVBQUUsQ0FBQztZQUM3QyxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLFlBQVksQ0FBQyxDQUFDO0lBQ3BELENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQUMsUUFBaUIsRUFBc0IsRUFBRTtJQUN2RSxJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLEtBQUssQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNwRixNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUNELE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDMUMsTUFBTSxnQkFBZ0IsR0FBRyxNQUFNLENBQUMsd0JBQXdCLENBQUMsUUFBUSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQzdFLElBQ0UsQ0FBQyxnQkFBZ0I7ZUFDZCxDQUFDLENBQUMsT0FBTyxJQUFJLGdCQUFnQixDQUFDO2VBQzlCLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUM7ZUFDN0MsZ0JBQWdCLENBQUMsS0FBSyxHQUFHLENBQUM7ZUFDMUIsT0FBTyxDQUFDLE1BQU0sS0FBSyxnQkFBZ0IsQ0FBQyxLQUFLLEdBQUcsQ0FBQyxFQUNoRCxDQUFDO1lBQ0QsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLE9BQU8sTUFBTSxLQUFLLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDekQsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLEtBQUssQ0FBVSxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMxRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsZ0JBQWdCLENBQUMsS0FBSyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDNUQsTUFBTSxVQUFVLEdBQUcsTUFBTSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztZQUM1RSxJQUFJLENBQUMsVUFBVSxFQUFFLFVBQVUsSUFBSSxDQUFDLENBQUMsT0FBTyxJQUFJLFVBQVUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hELE1BQU0sNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUN4RCxDQUFDO1lBQ0QsTUFBTSxDQUFDLEtBQUssQ0FBQyxHQUFHLFVBQVUsQ0FBQyxLQUFLLENBQUM7UUFDbkMsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxPQUFPLEtBQUssRUFBRSxDQUFDO1FBQ2YsSUFBSSxLQUFLLFlBQVksdUJBQXVCLEVBQUUsQ0FBQztZQUM3QyxNQUFNLEtBQUssQ0FBQztRQUNkLENBQUM7UUFDRCxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sd0JBQXdCLEdBQUcsQ0FDL0IsUUFBaUMsRUFDakMsTUFBYyxFQUNNLEVBQUU7SUFDdEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDckMsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUNELE9BQU8sd0JBQXdCLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFDcEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUU7SUFDckYsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLENBQUMsUUFBUSxFQUFFLGNBQWMsRUFBRTtRQUMxRCxTQUFTO1FBQ1QsUUFBUTtRQUNSLFdBQVc7UUFDWCxhQUFhO0tBQ2QsQ0FBQyxDQUFDO0lBQ0gsTUFBTSxPQUFPLEdBQUcsaUJBQWlCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO0lBQ2pELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUMxRixNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLEtBQUssQ0FBQyxNQUFNLENBQUM7SUFDNUIsTUFBTSxTQUFTLEdBQUcsd0JBQXdCLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQzVELE1BQU0sV0FBVyxHQUFHLHdCQUF3QixDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsQ0FBQztJQUNoRSxNQUFNLFNBQVMsR0FBRyx3QkFBd0IsQ0FBQyxLQUFLLEVBQUUsV0FBVyxDQUFDLENBQUM7SUFDL0QsTUFBTSxTQUFTLEdBQUcsd0JBQXdCLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDO0lBQy9ELE1BQU0sVUFBVSxHQUFHLHdCQUF3QixDQUFDLEtBQUssRUFBRSxZQUFZLENBQUMsQ0FBQztJQUNqRSxNQUFNLGdCQUFnQixHQUFHLHdCQUF3QixDQUFDLEtBQUssRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO0lBQzdFLElBQUksU0FBUyxHQUFHLFdBQVcsRUFBRSxDQUFDO1FBQzVCLE1BQU0sNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBRUQsSUFBSSxNQUFNLEtBQUssUUFBUSxJQUFJLENBQUMsU0FBUyxLQUFLLFNBQVMsSUFBSSxTQUFTLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUNoRixNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksTUFBTSxLQUFLLFNBQVMsSUFBSSxDQUFDLFNBQVMsS0FBSyxTQUFTLElBQUksU0FBUyxLQUFLLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDakYsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFDRCxJQUFJLE1BQU0sS0FBSyxTQUFTLElBQUksU0FBUyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ3BELE1BQU0sNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBQ0QsSUFBSSxTQUFTLEtBQUssU0FBUyxJQUFJLFNBQVMsR0FBRyxXQUFXLEVBQUUsQ0FBQztRQUN2RCxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUNELElBQUksU0FBUyxLQUFLLFNBQVMsSUFBSSxTQUFTLEdBQUcsQ0FBQyxTQUFTLElBQUksV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUN0RSxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7SUFDeEQsQ0FBQztJQUVELE1BQU0sa0JBQWtCLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsaUJBQWlCLENBQUMsQ0FBQztJQUNuRSxNQUFNLGFBQWEsR0FBRyxVQUFVLEtBQUssU0FBUyxDQUFDO0lBQy9DLElBQUksa0JBQWtCLEtBQUssYUFBYSxFQUFFLENBQUM7UUFDekMsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFDRCxJQUFJLGVBQW1DLENBQUM7SUFDeEMsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO1FBQ3ZCLGVBQWUsR0FBRyw0QkFBNEIsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUksVUFBVSxLQUFLLFNBQVMsSUFBSSxVQUFVLEdBQUcsU0FBUyxFQUFFLENBQUM7UUFDdkQsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFDRCxJQUFJLGdCQUFnQixLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ25DLElBQUksVUFBVSxLQUFLLFNBQVMsSUFBSSxnQkFBZ0IsR0FBRyxVQUFVLEVBQUUsQ0FBQztZQUM5RCxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUNELElBQUksU0FBUyxLQUFLLFNBQVMsSUFBSSxnQkFBZ0IsR0FBRyxTQUFTLEVBQUUsQ0FBQztZQUM1RCxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDeEQsQ0FBQztJQUNILENBQUM7SUFFRCxJQUFJLGNBQWtDLENBQUM7SUFDdkMsSUFBSSxtQkFBbUQsQ0FBQztJQUN4RCxJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUN6QixJQUFJLE1BQU0sQ0FBQyxNQUFNLENBQUMsS0FBSyxFQUFFLGdCQUFnQixDQUFDLElBQUksTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUscUJBQXFCLENBQUMsRUFBRSxDQUFDO1lBQzFGLE1BQU0sNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUN4RCxDQUFDO0lBQ0gsQ0FBQztTQUFNLENBQUM7UUFDTixJQUFJLE9BQU8sS0FBSyxDQUFDLGNBQWMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUM3QyxNQUFNLDZCQUE2QixDQUFDLGdCQUFnQixDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUNELGNBQWMsR0FBRyxLQUFLLENBQUMsY0FBYyxDQUFDO1FBQ3RDLElBQ0UsQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUM7ZUFDckMsT0FBTyxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEtBQUssY0FBYyxFQUMxRCxDQUFDO1lBQ0QsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3hELENBQUM7UUFDRCxtQkFBbUIsR0FBRyxrQkFBa0IsQ0FBQyxLQUFLLENBQUMsbUJBQW1CLENBQUMsQ0FBQztJQUN0RSxDQUFDO0lBRUQsT0FBTyxNQUFNLENBQUMsTUFBTSxDQUFDO1FBQ25CLE9BQU87UUFDUCxNQUFNO1FBQ04sR0FBRyxDQUFDLGNBQWMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxjQUFjLEVBQUUsQ0FBQztRQUMzRCxHQUFHLENBQUMsbUJBQW1CLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsbUJBQW1CLEVBQUUsQ0FBQztRQUNyRSxTQUFTO1FBQ1QsV0FBVztRQUNYLEdBQUcsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLENBQUM7UUFDakQsR0FBRyxDQUFDLFNBQVMsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxTQUFTLEVBQUUsQ0FBQztRQUNqRCxHQUFHLENBQUMsZUFBZSxLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLGVBQWUsRUFBRSxDQUFDO1FBQzdELEdBQUcsQ0FBQyxVQUFVLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLENBQUM7UUFDbkQsR0FBRyxDQUFDLGdCQUFnQixLQUFLLFNBQVMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLGdCQUFnQixFQUFFLENBQUM7S0FDaEUsQ0FBQyxDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxRQUFpQixFQUl4QyxFQUFFO0lBQ0YsTUFBTSxLQUFLLEdBQUcsbUJBQW1CLENBQUMsUUFBUSxFQUFFLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxFQUFFLENBQUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUM7SUFDMUYsTUFBTSxTQUFTLEdBQUcsNEJBQTRCLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sZ0JBQWdCLEdBQUcsc0JBQXNCLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO0lBQzVELE1BQU0sV0FBVyxHQUFHLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsbUJBQW1CLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQztJQUNoRyxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDN0IsTUFBTSw2QkFBNkIsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO0lBQ3hELENBQUM7SUFDRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsV0FBVyxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1FBQ3hELElBQUksV0FBVyxDQUFDLEtBQUssR0FBRyxDQUFDLENBQUMsQ0FBQyxPQUFPLElBQUksV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ2pFLE1BQU0sNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztRQUN4RCxDQUFDO0lBQ0gsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFdBQVcsQ0FBQyxNQUFNLENBQUMsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDLGFBQWEsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLENBQUM7SUFDeEYsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ3hCLE1BQU0sNkJBQTZCLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztJQUN4RCxDQUFDO0lBQ0QsT0FBTztRQUNMLFNBQVM7UUFDVCxXQUFXLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDdkMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxDQUFDLENBQUMsQ0FBQyxPQUFPO0tBQ2pDLENBQUM7QUFDSixDQUFDLENBQUM7QUFFRixNQUFNLFVBQVUsR0FBRyxDQUFDLE9BQXFCLEVBQUUsUUFBc0IsRUFBVyxFQUFFLENBQzVFLE9BQU8sQ0FBQyxHQUFHLEtBQUssUUFBUSxDQUFDLEdBQUc7T0FDekIsT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztPQUM1QixPQUFPLENBQUMsSUFBSSxLQUFLLFFBQVEsQ0FBQyxJQUFJO09BQzlCLE9BQU8sQ0FBQyxLQUFLLEtBQUssUUFBUSxDQUFDLEtBQUs7T0FDaEMsT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztPQUM1QixPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVEsQ0FBQyxHQUFHO09BQzVCLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLElBQUk7T0FDOUIsT0FBTyxDQUFDLElBQUksS0FBSyxRQUFRLENBQUMsSUFBSTtPQUM5QixPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVEsQ0FBQyxPQUFPO09BQ3BDLE9BQU8sQ0FBQyxPQUFPLEtBQUssUUFBUSxDQUFDLE9BQU8sQ0FBQztBQUUxQyxNQUFNLG9CQUFvQixHQUFHLENBQUMsT0FBcUIsRUFBRSxRQUFzQixFQUFXLEVBQUUsQ0FDdEYsT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztPQUN6QixPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVEsQ0FBQyxHQUFHO09BQzVCLE9BQU8sQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLElBQUk7T0FDOUIsT0FBTyxDQUFDLEdBQUcsS0FBSyxRQUFRLENBQUMsR0FBRztPQUM1QixPQUFPLENBQUMsR0FBRyxLQUFLLFFBQVEsQ0FBQyxHQUFHLENBQUM7QUFFbEMsTUFBTSxtQkFBbUIsR0FBRyxLQUFLLEVBQy9CLGlCQUF5QixFQUM4QixFQUFFO0lBQ3pELE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLGlCQUFpQixDQUFDLENBQUMsSUFBSSxDQUFDO0lBQ3hELE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO0lBQ2hFLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDcEUsTUFBTSxNQUFNLEdBQWlELEVBQUUsQ0FBQztJQUNoRSxJQUFJLFdBQVcsR0FBRyxJQUFJLENBQUM7SUFDdkIsTUFBTSxTQUFTLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7SUFDMUUsSUFBSSxTQUFTLENBQUMsY0FBYyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsV0FBVyxFQUFFLEVBQUUsQ0FBQztRQUMzRCxNQUFNLDZCQUE2QixDQUFDLHlCQUF5QixDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO0lBQzlDLEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxVQUFVLENBQUMsTUFBTSxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7UUFDdkQsV0FBVyxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztRQUNoRSxNQUFNLEtBQUssR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQyxXQUFXLEVBQUUsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUM3RSxNQUFNLE9BQU8sR0FBRyxLQUFLLEtBQUssVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7UUFDaEQsSUFDRSxLQUFLLENBQUMsY0FBYyxFQUFFO2VBQ25CLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsV0FBVyxFQUFFLENBQUMsRUFDckQsQ0FBQztZQUNELE1BQU0sNkJBQTZCLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxFQUFFLElBQUksRUFBRSxXQUFXLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsS0FBSyxFQUMxQixhQUFrRCxFQUM3QixFQUFFO0lBQ3ZCLElBQUksTUFBa0QsQ0FBQztJQUN2RCxJQUFJLEdBQTJCLENBQUM7SUFDaEMsSUFBSSxVQUE4QixDQUFDO0lBQ25DLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztJQUNwQixJQUFJLENBQUM7UUFDSCxNQUFNLGNBQWMsR0FBRyxhQUFhLENBQUMsY0FBZSxDQUFDO1FBQ3JELE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxtQkFBbUIsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUNuRSxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQyxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBQ3hFLElBQUksT0FBTyxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxVQUFVLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDeEQsTUFBTSw2QkFBNkIsQ0FBQyxzQkFBc0IsQ0FBQyxDQUFDO1FBQzlELENBQUM7UUFDRCxNQUFNLEdBQUcsTUFBTSxPQUFPLENBQUMsRUFBRSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQ3JDLGNBQWMsRUFDZCxPQUFPLENBQUMsRUFBRSxDQUFDLFNBQVMsQ0FBQyxRQUFRLEdBQUcsT0FBTyxDQUFDLEVBQUUsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUNoRSxDQUFDO1FBQ0YsTUFBTSxRQUFRLEdBQUcsTUFBTSxNQUFNLENBQUMsSUFBSSxDQUFDLEVBQUUsTUFBTSxFQUFFLElBQUksRUFBRSxDQUFDLENBQUM7UUFDckQsSUFDRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUU7ZUFDZixRQUFRLENBQUMsSUFBSSxLQUFLLEdBQUc7ZUFDckIsQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLEdBQU0sQ0FBQyxLQUFLLEVBQUU7ZUFDL0IsQ0FBQyxVQUFVLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxFQUNyQyxDQUFDO1lBQ0QsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFFRCxVQUFVLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUM5QixJQUFJLGNBQWMsR0FBRyxDQUFDLENBQUM7UUFDdkIsT0FBTyxjQUFjLEdBQUcsVUFBVSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQzlDLE1BQU0sRUFBRSxTQUFTLEVBQUUsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQ3JDLFVBQVUsRUFDVixjQUFjLEVBQ2QsVUFBVSxDQUFDLFVBQVUsR0FBRyxjQUFjLEVBQ3RDLGNBQWMsQ0FDZixDQUFDO1lBQ0YsSUFBSSxTQUFTLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ3BCLE1BQU07WUFDUixDQUFDO1lBQ0QsY0FBYyxJQUFJLFNBQVMsQ0FBQztRQUM5QixDQUFDO1FBQ0QsSUFBSSxjQUFjLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDMUIsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUNwRCxNQUFNLGVBQWUsR0FBRyxNQUFNLG1CQUFtQixDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2xFLElBQUksZ0JBQWdCLENBQUMsTUFBTSxLQUFLLGVBQWUsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUN2RCxNQUFNLDZCQUE2QixDQUFDLHlCQUF5QixDQUFDLENBQUM7UUFDakUsQ0FBQztRQUNELEtBQUssSUFBSSxLQUFLLEdBQUcsQ0FBQyxFQUFFLEtBQUssR0FBRyxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDakUsSUFBSSxDQUFDLG9CQUFvQixDQUFDLGdCQUFnQixDQUFDLEtBQUssQ0FBQyxDQUFDLEtBQUssRUFBRSxlQUFlLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDdkYsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQ2pFLENBQUM7UUFDSCxDQUFDO1FBQ0QsTUFBTSxVQUFVLEdBQUcsZUFBZSxDQUFDLGVBQWUsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBQ3JFLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ3ZFLE1BQU0sNkJBQTZCLENBQUMseUJBQXlCLENBQUMsQ0FBQztRQUNqRSxDQUFDO1FBRUQsR0FBRyxHQUFHLElBQUksVUFBVSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDakQsTUFBTSxpQkFBaUIsR0FBRyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDM0MsTUFBTSxtQkFBbUIsR0FBRyxrQkFBa0IsQ0FBQyxhQUFhLENBQUMsbUJBQW9CLENBQUMsQ0FBQztRQUNuRixJQUFJLENBQUM7WUFDSCxJQUFJLENBQUMsZUFBZSxDQUFDLGlCQUFpQixFQUFFLG1CQUFtQixDQUFDLEVBQUUsQ0FBQztnQkFDN0QsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQ2pFLENBQUM7UUFDSCxDQUFDO2dCQUFTLENBQUM7WUFDVCxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDMUIsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzlCLENBQUM7SUFDSCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxHQUFHLElBQUksQ0FBQztJQUNqQixDQUFDO1lBQVMsQ0FBQztRQUNULFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDcEIsSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUNYLElBQUksQ0FBQztnQkFDSCxNQUFNLE1BQU0sQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUN2QixDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLE9BQU8sR0FBRyxJQUFJLENBQUM7WUFDakIsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxPQUFPLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUNwQixHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ2IsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxPQUFPLEdBQUcsQ0FBQztBQUNiLENBQUMsQ0FBQztBQUVGLE1BQU0sU0FBUyxHQUFHLENBQ2hCLFFBQWlCLEVBQ2pCLGVBQXVCLEVBQ3ZCLGVBQXVCLEVBQ1gsRUFBRTtJQUNkLElBQUksQ0FBQyxDQUFDLFFBQVEsWUFBWSxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQ3RDLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsVUFBVSxHQUFHLGVBQWUsSUFBSSxRQUFRLENBQUMsVUFBVSxHQUFHLGVBQWUsRUFBRSxDQUFDO1FBQ25GLE1BQU0sNkJBQTZCLENBQUMscUJBQXFCLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsT0FBTyxJQUFJLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUNsQyxDQUFDLENBQUM7QUFFRixNQUFNLGNBQWMsR0FBRyxDQUFDLFFBQWlCLEVBQVUsRUFBRTtJQUNuRCxJQUFJLENBQUM7UUFDSCxPQUFPLDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ2hELENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLDZCQUE2QixDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDMUQsQ0FBQztBQUNILENBQUMsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsQ0FDdkIsUUFBK0MsRUFDSyxFQUFFLENBQUMsQ0FBQztJQUN4RCxLQUFLLEVBQUUsd0JBQXdCLENBQUMsUUFBUSxDQUFDLEtBQUssQ0FBQztJQUMvQyxVQUFVLEVBQUUsd0JBQXdCLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztJQUN6RCxHQUFHLEVBQUUsd0JBQXdCLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztDQUM1QyxDQUFDLENBQUM7QUFFSCxNQUFNLGtCQUFrQixHQUFHLENBQUMsUUFBc0MsRUFBUSxFQUFFO0lBQzFFLFFBQVEsQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQy9CLFFBQVEsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hDLGNBQWMsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUM7SUFDakMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztBQUN0QyxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLE9BQU8sa0JBQWtCO0lBRzdCLFlBQ21CLFNBQWlCLEVBQ2pCLFdBQTJELEVBQzNELGFBQXFCLEVBQ3JCLFVBQXNEO1FBSHRELGNBQVMsR0FBVCxTQUFTLENBQVE7UUFDakIsZ0JBQVcsR0FBWCxXQUFXLENBQWdEO1FBQzNELGtCQUFhLEdBQWIsYUFBYSxDQUFRO1FBQ3JCLGVBQVUsR0FBVixVQUFVLENBQTRDO1FBTmpFLGNBQVMsR0FBRyxLQUFLLENBQUM7SUFPdkIsQ0FBQztJQUVHLE1BQU0sQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLFNBQW9DO1FBQzdELElBQUksT0FBTyxDQUFDLFFBQVEsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUNqQyxNQUFNLDZCQUE2QixDQUFDLHNCQUFzQixDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLGVBQWUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUMxQyxNQUFNLFVBQVUsR0FBRyxJQUFJLEdBQUcsRUFBaUMsQ0FBQztRQUM1RCxJQUFJLENBQUM7WUFDSCxLQUFLLE1BQU0sVUFBVSxJQUFJLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDNUMsSUFBSSxVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO29CQUNwQyxTQUFTO2dCQUNYLENBQUM7Z0JBQ0QsSUFBSSxHQUEyQixDQUFDO2dCQUNoQyxJQUFJLENBQUM7b0JBQ0gsR0FBRyxHQUFHLE1BQU0sY0FBYyxDQUFDLFVBQVUsQ0FBQyxDQUFDO29CQUN2QyxVQUFVLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxVQUFVLEVBQUUsR0FBRyxFQUFFLENBQUMsQ0FBQztvQkFDeEQsR0FBRyxHQUFHLFNBQVMsQ0FBQztnQkFDbEIsQ0FBQzt3QkFBUyxDQUFDO29CQUNULEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ2YsQ0FBQztZQUNILENBQUM7WUFDRCxPQUFPLElBQUksa0JBQWtCLENBQzNCLE1BQU0sQ0FBQyxTQUFTLEVBQ2hCLE1BQU0sQ0FBQyxXQUFXLEVBQ2xCLE1BQU0sQ0FBQyxhQUFhLEVBQ3BCLFVBQVUsQ0FDWCxDQUFDO1FBQ0osQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixLQUFLLE1BQU0sTUFBTSxJQUFJLFVBQVUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO2dCQUN6QyxNQUFNLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyQixDQUFDO1lBQ0QsSUFBSSxLQUFLLFlBQVksdUJBQXVCLEVBQUUsQ0FBQztnQkFDN0MsTUFBTSxLQUFLLENBQUM7WUFDZCxDQUFDO1lBQ0QsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7SUFDSCxDQUFDO0lBRU8sWUFBWTtRQUNsQixJQUFJLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNuQixNQUFNLDZCQUE2QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQ25ELENBQUM7SUFDSCxDQUFDO0lBRU8sa0JBQWtCLENBQ3hCLFdBQW1DO1FBRW5DLElBQUksV0FBVyxDQUFDLEdBQUcsQ0FBQyxTQUFTLEtBQUssSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2pELE1BQU0sNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUM1RCxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RELE1BQU0sNkJBQTZCLENBQUMsaUJBQWlCLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBQ0QsSUFBSSxXQUFXLENBQUMsR0FBRyxDQUFDLFdBQVcsS0FBSyxNQUFNLENBQUMsVUFBVSxDQUFDLG1CQUFtQixFQUFFLENBQUM7WUFDMUUsTUFBTSw2QkFBNkIsQ0FBQywwQkFBMEIsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxPQUFPLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztJQUNwQyxDQUFDO0lBRU0sT0FBTztRQUNaLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNwQixPQUFPO1lBQ0wsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO1lBQ3pCLGFBQWEsRUFBRSxJQUFJLENBQUMsYUFBYTtZQUNqQyxJQUFJLEVBQUUsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxhQUFhLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQzdDLE9BQU8sRUFBRSxhQUFhLENBQUMsT0FBTztnQkFDOUIsTUFBTSxFQUFFLGFBQWEsQ0FBQyxNQUFNO2dCQUM1QixHQUFHLENBQUMsYUFBYSxDQUFDLG1CQUFtQixLQUFLLFNBQVM7b0JBQ2pELENBQUMsQ0FBQyxFQUFFO29CQUNKLENBQUMsQ0FBQyxFQUFFLG1CQUFtQixFQUFFLGFBQWEsQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO2dCQUMvRCxTQUFTLEVBQUUsYUFBYSxDQUFDLFNBQVM7Z0JBQ2xDLFdBQVcsRUFBRSxhQUFhLENBQUMsV0FBVztnQkFDdEMsR0FBRyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLGFBQWEsQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDeEYsR0FBRyxDQUFDLGFBQWEsQ0FBQyxTQUFTLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsU0FBUyxFQUFFLGFBQWEsQ0FBQyxTQUFTLEVBQUUsQ0FBQztnQkFDeEYsR0FBRyxDQUFDLGFBQWEsQ0FBQyxlQUFlLEtBQUssU0FBUztvQkFDN0MsQ0FBQyxDQUFDLEVBQUU7b0JBQ0osQ0FBQyxDQUFDLEVBQUUsZUFBZSxFQUFFLGFBQWEsQ0FBQyxlQUFlLEVBQUUsQ0FBQztnQkFDdkQsR0FBRyxDQUFDLGFBQWEsQ0FBQyxVQUFVLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLGFBQWEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztnQkFDM0YsR0FBRyxDQUFDLGFBQWEsQ0FBQyxnQkFBZ0IsS0FBSyxTQUFTO29CQUM5QyxDQUFDLENBQUMsRUFBRTtvQkFDSixDQUFDLENBQUMsRUFBRSxnQkFBZ0IsRUFBRSxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQzthQUMxRCxDQUFDLENBQUM7U0FDSixDQUFDO0lBQ0osQ0FBQztJQUVNLE9BQU87UUFDWixJQUFJLElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNuQixPQUFPO1FBQ1QsQ0FBQztRQUNELElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDO1FBQ3RCLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzlDLE1BQU0sQ0FBQyxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3JCLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLGVBQWUsQ0FDMUIsVUFBOEM7UUFFOUMsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3BCLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUNqQyxVQUFVLEVBQ1YsQ0FBQyxZQUFZLEVBQUUsV0FBVyxFQUFFLFNBQVMsRUFBRSxXQUFXLENBQUMsRUFDbkQsQ0FBQyxZQUFZLEVBQUUsV0FBVyxFQUFFLFNBQVMsQ0FBQyxFQUN0QyxrQkFBa0IsQ0FDbkIsQ0FBQztRQUNGLE1BQU0sVUFBVSxHQUFHLGNBQWMsQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDdEQsSUFBSSxTQUFpQixDQUFDO1FBQ3RCLElBQUksQ0FBQztZQUNILFNBQVMsR0FBRyxPQUFPLENBQUMsU0FBUyxLQUFLLFNBQVM7Z0JBQ3pDLENBQUMsQ0FBQyxJQUFJLENBQUMsR0FBRyxFQUFFO2dCQUNaLENBQUMsQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDbEQsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsSUFBSSxTQUFpQyxDQUFDO1FBQ3RDLElBQUksT0FBK0IsQ0FBQztRQUNwQyxJQUFJLEdBQTJCLENBQUM7UUFDaEMsSUFBSSxjQUFzQyxDQUFDO1FBQzNDLElBQUksYUFBcUMsQ0FBQztRQUMxQyxJQUFJLEdBQTJCLENBQUM7UUFDaEMsSUFBSSxPQUEwRCxDQUFDO1FBQy9ELElBQUksVUFBNkQsQ0FBQztRQUNsRSxJQUFJLGFBQXFDLENBQUM7UUFDMUMsSUFBSSxPQUErQixDQUFDO1FBQ3BDLElBQUksQ0FBQztZQUNILFNBQVMsR0FBRyxTQUFTLENBQUMsT0FBTyxDQUFDLFNBQVMsRUFBRSxDQUFDLEVBQUUscUNBQXFDLENBQUMsQ0FBQztZQUNuRixPQUFPLEdBQUcsU0FBUyxDQUNqQixPQUFPLENBQUMsT0FBTyxFQUNmLHFDQUFxQyxFQUNyQyxxQ0FBcUMsQ0FDdEMsQ0FBQztZQUNGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxhQUFhLENBQUUsQ0FBQztZQUN4RCxHQUFHLEdBQUcsSUFBSSxVQUFVLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1lBQ2pDLGNBQWMsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLG1CQUFvQixDQUFDLENBQUM7WUFDNUUsYUFBYSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUNyQyxHQUFHLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN4QyxJQUFJLENBQUM7Z0JBQ0gsT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUM7b0JBQ2hELEdBQUcsRUFBRSxHQUFHO29CQUNSLFNBQVM7b0JBQ1QsR0FBRyxFQUFFLE9BQU87aUJBQ2IsQ0FBQyxDQUFDO2dCQUNILGFBQWEsR0FBRyw4QkFBOEIsQ0FBQyxPQUFPLENBQUMsQ0FBQztnQkFDeEQsT0FBTyxHQUFHLHdCQUF3QixDQUFDO29CQUNqQyxVQUFVO29CQUNWLFNBQVM7b0JBQ1QsYUFBYTtvQkFDYixhQUFhO29CQUNiLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztvQkFDekIsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTztvQkFDckMsY0FBYztpQkFDZixDQUFDLENBQUM7Z0JBQ0gsVUFBVSxHQUFHLE1BQU0sT0FBTyxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxDQUFDLENBQUM7WUFDeEUsQ0FBQztZQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7Z0JBQ2YsSUFBSSxLQUFLLFlBQVksdUJBQXVCLEVBQUUsQ0FBQztvQkFDN0MsTUFBTSxLQUFLLENBQUM7Z0JBQ2QsQ0FBQztnQkFDRCxNQUFNLDZCQUE2QixDQUFDLHlCQUF5QixDQUFDLENBQUM7WUFDakUsQ0FBQztZQUNELE9BQU87Z0JBQ0wsYUFBYSxFQUFFLGtDQUFrQztnQkFDakQsT0FBTyxFQUFFLDJCQUEyQjtnQkFDcEMsVUFBVTtnQkFDVixTQUFTO2dCQUNULGFBQWEsRUFBRSx3QkFBd0IsQ0FBQyxhQUFhLENBQUM7Z0JBQ3RELEdBQUcsRUFBRTtvQkFDSCxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7b0JBQ3pCLE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU87b0JBQ2xDLFdBQVcsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLG1CQUFvQjtpQkFDcEQ7Z0JBQ0QsT0FBTyxFQUFFLGdCQUFnQixDQUFDLE9BQU8sQ0FBQztnQkFDbEMsVUFBVSxFQUFFLGdCQUFnQixDQUFDLFVBQVUsQ0FBQzthQUN6QyxDQUFDO1FBQ0osQ0FBQztnQkFBUyxDQUFDO1lBQ1QsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNuQixPQUFPLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2pCLGFBQWEsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdkIsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNiLEdBQUcsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDYixjQUFjLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3hCLGFBQWEsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdkIsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNqQixjQUFjLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDeEIsY0FBYyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQzdCLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLGVBQWUsQ0FDMUIsVUFBOEM7UUFFOUMsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3BCLE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUNqQyxVQUFVLEVBQ1YsQ0FBQyxVQUFVLEVBQUUsb0JBQW9CLEVBQUUsU0FBUyxDQUFDLEVBQzdDLENBQUMsVUFBVSxFQUFFLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxFQUM3QyxrQkFBa0IsQ0FDbkIsQ0FBQztRQUNGLE1BQU0sa0JBQWtCLEdBQUcsY0FBYyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sTUFBTSxHQUFHLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxRCxJQUFJLE9BQStCLENBQUM7UUFDcEMsSUFBSSxXQUFtQyxDQUFDO1FBQ3hDLElBQUksYUFBcUMsQ0FBQztRQUMxQyxJQUFJLGFBQXFDLENBQUM7UUFDMUMsSUFBSSxPQUErQixDQUFDO1FBQ3BDLElBQUksR0FBMkIsQ0FBQztRQUNoQyxJQUFJLENBQUM7WUFDSCxPQUFPLEdBQUcsU0FBUyxDQUNqQixPQUFPLENBQUMsT0FBTyxFQUNmLHFDQUFxQyxFQUNyQyxxQ0FBcUMsQ0FDdEMsQ0FBQztZQUNGLFdBQVcsR0FBRyxJQUFJLENBQUMsa0JBQWtCLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQ3ZELGFBQWEsR0FBRyxXQUFXLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDckMsYUFBYSxHQUFHLDhCQUE4QixDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUMvRCxPQUFPLEdBQUcsd0JBQXdCLENBQUM7Z0JBQ2pDLFVBQVUsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVU7Z0JBQ3RDLFNBQVMsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVM7Z0JBQ3BDLGFBQWEsRUFBRSxNQUFNLENBQUMsYUFBYTtnQkFDbkMsYUFBYTtnQkFDYixTQUFTLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsU0FBUztnQkFDeEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE9BQU87Z0JBQ3ZDLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYzthQUN0QyxDQUFDLENBQUM7WUFDSCxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLGtCQUFrQixFQUFFLENBQUM7Z0JBQ3RELE1BQU0sNkJBQTZCLENBQUMsc0JBQXNCLENBQUMsQ0FBQztZQUM5RCxDQUFDO1lBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7Z0JBQzFELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILEdBQUcsR0FBRyxNQUFNLE9BQU8sQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDO29CQUN4QyxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7b0JBQzdCLEdBQUcsRUFBRSxXQUFXO29CQUNoQixPQUFPO2lCQUNSLENBQUMsQ0FBQztnQkFDSCxPQUFPLE1BQU0sT0FBTyxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUM7b0JBQzdDLEdBQUcsRUFBRSxHQUFHO29CQUNSLGFBQWEsRUFBRSxNQUFNLENBQUMsT0FBTztvQkFDN0IsR0FBRyxFQUFFLE9BQU87aUJBQ2IsQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCxNQUFNLDZCQUE2QixDQUFDLHVCQUF1QixDQUFDLENBQUM7WUFDL0QsQ0FBQztRQUNILENBQUM7Z0JBQVMsQ0FBQztZQUNULE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDakIsYUFBYSxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN2QixhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3ZCLE9BQU8sRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDakIsV0FBVyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyQixHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2Isa0JBQWtCLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDN0IsQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsY0FBYyxDQUN6QixVQUE2QztRQUU3QyxJQUFJLENBQUMsWUFBWSxFQUFFLENBQUM7UUFDcEIsTUFBTSxPQUFPLEdBQUcsbUJBQW1CLENBQ2pDLFVBQVUsRUFDVixDQUFDLFVBQVUsRUFBRSxvQkFBb0IsRUFBRSxTQUFTLEVBQUUsZUFBZSxDQUFDLEVBQzlELENBQUMsVUFBVSxFQUFFLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxFQUM3QyxrQkFBa0IsQ0FDbkIsQ0FBQztRQUNGLE1BQU0sa0JBQWtCLEdBQUcsY0FBYyxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3RFLE1BQU0sTUFBTSxHQUFHLHdCQUF3QixDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUMxRCxJQUFJLE9BQStCLENBQUM7UUFDcEMsSUFBSSxVQUFrQyxDQUFDO1FBQ3ZDLElBQUksU0FBaUMsQ0FBQztRQUN0QyxJQUFJLGlCQUF5QyxDQUFDO1FBQzlDLElBQUksYUFBcUMsQ0FBQztRQUMxQyxJQUFJLGFBQXFDLENBQUM7UUFDMUMsSUFBSSxjQUFzQyxDQUFDO1FBQzNDLElBQUksVUFBa0MsQ0FBQztRQUN2QyxJQUFJLFVBQTZELENBQUM7UUFDbEUsSUFBSSxDQUFDO1lBQ0gsT0FBTyxHQUFHLFNBQVMsQ0FDakIsT0FBTyxDQUFDLE9BQU8sRUFDZixxQ0FBcUMsRUFDckMscUNBQXFDLENBQ3RDLENBQUM7WUFDRixVQUFVLEdBQUcsSUFBSSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUN0RCxJQUFJLE9BQU8sQ0FBQyxhQUFhLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3hDLElBQUksYUFBcUIsQ0FBQztnQkFDMUIsSUFBSSxDQUFDO29CQUNILGFBQWEsR0FBRyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLENBQUM7Z0JBQzNELENBQUM7Z0JBQUMsTUFBTSxDQUFDO29CQUNQLE1BQU0sNkJBQTZCLENBQUMseUJBQXlCLENBQUMsQ0FBQztnQkFDakUsQ0FBQztnQkFDRCxJQUFJLGFBQWEsS0FBSyxJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7b0JBQ3pDLE1BQU0sNkJBQTZCLENBQUMseUJBQXlCLENBQUMsQ0FBQztnQkFDakUsQ0FBQztZQUNILENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFFLENBQUM7WUFDeEQsU0FBUyxHQUFHLElBQUksVUFBVSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUN2QyxpQkFBaUIsR0FBRyxrQkFBa0IsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLG1CQUFvQixDQUFDLENBQUM7WUFDL0UsYUFBYSxHQUFHLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUNyQyxhQUFhLEdBQUcsOEJBQThCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQy9ELGNBQWMsR0FBRyx3QkFBd0IsQ0FBQztnQkFDeEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVTtnQkFDdEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUztnQkFDcEMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhO2dCQUNuQyxhQUFhO2dCQUNiLFNBQVMsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxTQUFTO2dCQUN4QyxVQUFVLEVBQUUsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsT0FBTztnQkFDdkMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxjQUFjO2FBQ3RDLENBQUMsQ0FBQztZQUNILFVBQVUsR0FBRyx3QkFBd0IsQ0FBQztnQkFDcEMsVUFBVSxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVTtnQkFDdEMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUztnQkFDcEMsYUFBYSxFQUFFLE1BQU0sQ0FBQyxhQUFhO2dCQUNuQyxhQUFhO2dCQUNiLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztnQkFDekIsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTztnQkFDckMsY0FBYyxFQUFFLGlCQUFpQjthQUNsQyxDQUFDLENBQUM7WUFDSCxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxLQUFLLGtCQUFrQixFQUFFLENBQUM7Z0JBQ3RELE1BQU0sNkJBQTZCLENBQUMsc0JBQXNCLENBQUMsQ0FBQztZQUM5RCxDQUFDO1lBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7Z0JBQzFELE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILFVBQVUsR0FBRyxNQUFNLE9BQU8sQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDO29CQUMvQyxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7b0JBQzdCLFVBQVUsRUFBRSxVQUFVO29CQUN0QixjQUFjO29CQUNkLE1BQU0sRUFBRSxTQUFTO29CQUNqQixVQUFVO2lCQUNYLENBQUMsQ0FBQztZQUNMLENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsTUFBTSw2QkFBNkIsQ0FBQyx1QkFBdUIsQ0FBQyxDQUFDO1lBQy9ELENBQUM7WUFDRCxPQUFPO2dCQUNMLGFBQWEsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLGFBQWE7Z0JBQzVDLE9BQU8sRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU87Z0JBQ2hDLFVBQVUsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFVBQVU7Z0JBQ3RDLFNBQVMsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVM7Z0JBQ3BDLGFBQWEsRUFBRSxNQUFNLENBQUMsUUFBUSxDQUFDLGFBQWE7Z0JBQzVDLEdBQUcsRUFBRTtvQkFDSCxTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7b0JBQ3pCLE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU87b0JBQ2xDLFdBQVcsRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLG1CQUFvQjtpQkFDcEQ7Z0JBQ0QsT0FBTyxFQUFFLEVBQUUsR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDLE9BQU8sRUFBRTtnQkFDdkMsVUFBVSxFQUFFLGdCQUFnQixDQUFDLFVBQVUsQ0FBQzthQUN6QyxDQUFDO1FBQ0osQ0FBQztnQkFBUyxDQUFDO1lBQ1QsT0FBTyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNqQixhQUFhLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3ZCLGFBQWEsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdkIsY0FBYyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUN4QixVQUFVLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ3BCLFVBQVUsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDcEIsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNuQixpQkFBaUIsRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDM0IsY0FBYyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQzNCLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzdCLENBQUM7SUFDSCxDQUFDO0lBRU0sS0FBSyxDQUFDLGdCQUFnQixDQUFDLFVBQWtCO1FBQzlDLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNwQixJQUFJLE9BQWUsQ0FBQztRQUNwQixJQUFJLENBQUM7WUFDSCxPQUFPLEdBQUcsaUJBQWlCLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDMUMsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLE1BQU0sNkJBQTZCLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUMxRCxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDNUMsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN0RCxNQUFNLDZCQUE2QixDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDekQsQ0FBQztRQUNELElBQUksR0FBMkIsQ0FBQztRQUNoQyxJQUFJLFdBQW1DLENBQUM7UUFDeEMsSUFBSSxHQUEyQixDQUFDO1FBQ2hDLElBQUksU0FBNkIsQ0FBQztRQUNsQyxJQUFJLE1BQTBCLENBQUM7UUFDL0IsSUFBSSxZQUFnQyxDQUFDO1FBQ3JDLElBQUksR0FBdUIsQ0FBQztRQUM1QixJQUFJLFVBQTZELENBQUM7UUFDbEUsSUFBSSxZQUFvQyxDQUFDO1FBQ3pDLElBQUksQ0FBQztZQUNILEdBQUcsR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDakMsV0FBVyxHQUFHLGtCQUFrQixDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsbUJBQW9CLENBQUMsQ0FBQztZQUN6RSxHQUFHLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUN4QyxTQUFTLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ2hELE1BQU0sR0FBRyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQy9CLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFVBQVUsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUM5QyxZQUFZLEdBQUcsTUFBTSxDQUFDLFdBQVcsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyQyxZQUFZLENBQUMsZ0JBQWdCLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDO1lBQ2xELEdBQUcsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO2dCQUNsQixNQUFNLENBQUMsSUFBSSxDQUFDLHFDQUFxQyxFQUFFLE9BQU8sQ0FBQztnQkFDM0QsTUFBTTtnQkFDTixTQUFTO2dCQUNULFlBQVk7Z0JBQ1osV0FBVzthQUNaLENBQUMsQ0FBQztZQUNILElBQUksQ0FBQztnQkFDSCxVQUFVLEdBQUcsTUFBTSxPQUFPLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxFQUFFLE9BQU8sRUFBRSxHQUFHLEVBQUUsQ0FBQyxDQUFDO2dCQUNoRixZQUFZLEdBQUcsTUFBTSxPQUFPLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQztvQkFDakQsVUFBVTtvQkFDVixHQUFHLEVBQUUsR0FBRztvQkFDUixPQUFPLEVBQUUsR0FBRztpQkFDYixDQUFDLENBQUM7WUFDTCxDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLE1BQU0sNkJBQTZCLENBQUMseUJBQXlCLENBQUMsQ0FBQztZQUNqRSxDQUFDO1lBQ0QsSUFBSSxDQUFDLGVBQWUsQ0FBQyxHQUFHLEVBQUUsWUFBWSxDQUFDLEVBQUUsQ0FBQztnQkFDeEMsTUFBTSw2QkFBNkIsQ0FBQyx5QkFBeUIsQ0FBQyxDQUFDO1lBQ2pFLENBQUM7WUFDRCxPQUFPO2dCQUNMLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztnQkFDekIsT0FBTztnQkFDUCxNQUFNLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxNQUFNO2dCQUNoQyxXQUFXLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxtQkFBb0I7Z0JBQ25ELFFBQVEsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFO2FBQ3JCLENBQUM7UUFDSixDQUFDO2dCQUFTLENBQUM7WUFDVCxHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2IsV0FBVyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNyQixHQUFHLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2IsU0FBUyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNuQixNQUFNLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1lBQ2hCLFlBQVksRUFBRSxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDdEIsR0FBRyxFQUFFLElBQUksQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNiLGNBQWMsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUMzQixZQUFZLEVBQUUsSUFBSSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hCLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==