@serve.zone/dcrouter 13.41.2 → 13.42.1

package/dist_ts/config/classes.source-policy-compiler.js

@@ -0,0 +1,497 @@
+import * as plugins from '../plugins.js';
+import { giteaRoutePathClassLabels, giteaRoutePathClassPatterns, routePathClasses, } from '../../dist_ts_interfaces/data/route-management.js';
+const MIN_ROUTE_PRIORITY = 0;
+const MAX_ROUTE_PRIORITY = 10000;
+const SOURCE_PRIORITY_BAND = 0.0008;
+const PATH_PRIORITY_BAND = 0.0001;
+export const sourcePolicyLimits = {
+    maxBindings: 16,
+    maxPathPoliciesPerBinding: 12,
+    maxPathPatternsPerPolicy: 64,
+    maxPathPatternLength: 256,
+    maxPathPatternWildcards: 8,
+    maxSourceProfileRefLength: 256,
+    maxIdLength: 128,
+    maxExceededMessageLength: 512,
+    maxCompiledVariantsPerRoute: 512,
+};
+export class SourcePolicyCompiler {
+    static compileRoute(route, metadata, referenceResolver, routeId) {
+        const bindings = metadata?.sourcePolicy?.bindings || [];
+        if (bindings.length === 0) {
+            return [route];
+        }
+        if (this.validateSourcePolicyShape(metadata?.sourcePolicy, route)) {
+            return [];
+        }
+        if (!referenceResolver) {
+            return [];
+        }
+        if (this.validateResolvedSourcePolicy(metadata?.sourcePolicy, referenceResolver)) {
+            return [];
+        }
+        const compiledRoutes = [];
+        const basePriority = route.priority ?? 0;
+        bindings.forEach((binding, index) => {
+            const profile = referenceResolver.getProfile(binding.sourceProfileRef);
+            const profileSecurity = referenceResolver.resolveSourceProfileSecurity(binding.sourceProfileRef);
+            if (!profile || !profileSecurity) {
+                return;
+            }
+            const sourceMatches = this.getSourceMatchEntries(profileSecurity);
+            if (sourceMatches.length === 0) {
+                return;
+            }
+            const sourcePriority = this.calculateSourcePriority(basePriority, index, bindings.length);
+            const sourceMatch = this.matchesAllSources(sourceMatches)
+                ? { ...route.match }
+                : { ...route.match, clientIp: sourceMatches };
+            const pathPolicies = binding.pathPolicies || [];
+            if (pathPolicies.length === 0) {
+                compiledRoutes.push(this.buildCompiledRoute({
+                    route,
+                    sourceMatch,
+                    profileName: profile.name,
+                    profileSecurity,
+                    binding,
+                    sourcePriority,
+                    routeId,
+                    sourceIndex: index,
+                }));
+                return;
+            }
+            let hasSourceFallback = false;
+            pathPolicies.forEach((pathPolicy, pathIndex) => {
+                const pathPatterns = this.getPathPatterns(pathPolicy);
+                if (pathPatterns.length === 0) {
+                    hasSourceFallback = true;
+                    compiledRoutes.push(this.buildCompiledRoute({
+                        route,
+                        sourceMatch,
+                        profileName: profile.name,
+                        profileSecurity,
+                        binding,
+                        pathPolicy,
+                        sourcePriority,
+                        routeId,
+                        sourceIndex: index,
+                        pathIndex,
+                        pathPolicyCount: pathPolicies.length,
+                    }));
+                    return;
+                }
+                pathPatterns.forEach((pathPattern, pathPatternIndex) => {
+                    compiledRoutes.push(this.buildCompiledRoute({
+                        route,
+                        sourceMatch,
+                        profileName: profile.name,
+                        profileSecurity,
+                        binding,
+                        pathPolicy,
+                        pathPattern,
+                        sourcePriority,
+                        routeId,
+                        sourceIndex: index,
+                        pathIndex,
+                        pathPolicyCount: pathPolicies.length,
+                        pathPatternIndex,
+                        pathPatternCount: pathPatterns.length,
+                    }));
+                });
+            });
+            if (!hasSourceFallback) {
+                compiledRoutes.push(this.buildCompiledRoute({
+                    route,
+                    sourceMatch,
+                    profileName: profile.name,
+                    profileSecurity,
+                    binding,
+                    sourcePriority,
+                    routeId,
+                    sourceIndex: index,
+                }));
+            }
+        });
+        return compiledRoutes;
+    }
+    static validateSourcePolicyPayload(sourcePolicy) {
+        if (!sourcePolicy) {
+            return undefined;
+        }
+        if (!Array.isArray(sourcePolicy.bindings)) {
+            return 'Source policy bindings must be an array';
+        }
+        if (sourcePolicy.bindings.length === 0) {
+            return undefined;
+        }
+        if (sourcePolicy.bindings.length > sourcePolicyLimits.maxBindings) {
+            return `Source policy exceeds ${sourcePolicyLimits.maxBindings} bindings`;
+        }
+        const validClasses = new Set(routePathClasses);
+        for (const binding of sourcePolicy.bindings) {
+            if (!binding || typeof binding !== 'object') {
+                return 'Source policy binding must be an object';
+            }
+            if (typeof binding.sourceProfileRef !== 'string') {
+                return 'Source policy binding requires a source profile';
+            }
+            if (binding.sourceProfileRef.length > sourcePolicyLimits.maxSourceProfileRefLength) {
+                return `Source policy source profile ref exceeds ${sourcePolicyLimits.maxSourceProfileRefLength} characters`;
+            }
+            if (binding.sourceProfileRef.trim().length === 0) {
+                return 'Source policy binding requires a source profile';
+            }
+            if (typeof binding.id === 'string' && binding.id.length > sourcePolicyLimits.maxIdLength) {
+                return `Source policy binding id exceeds ${sourcePolicyLimits.maxIdLength} characters`;
+            }
+            if (typeof binding.maxConnections === 'number' && binding.maxConnections < 0) {
+                return 'Source policy maxConnections must be non-negative';
+            }
+            const bindingRateLimitError = this.validateRateLimitPayload(binding.rateLimit);
+            if (bindingRateLimitError) {
+                return bindingRateLimitError;
+            }
+            const bindingMessage = binding.onExceeded?.errorMessage;
+            if (typeof bindingMessage === 'string' && bindingMessage.length > sourcePolicyLimits.maxExceededMessageLength) {
+                return `Source policy exceeded message exceeds ${sourcePolicyLimits.maxExceededMessageLength} characters`;
+            }
+            const pathPolicies = binding.pathPolicies;
+            if (pathPolicies === undefined) {
+                continue;
+            }
+            if (!Array.isArray(pathPolicies)) {
+                return 'Source policy path policies must be an array';
+            }
+            if (pathPolicies.length > sourcePolicyLimits.maxPathPoliciesPerBinding) {
+                return `Source policy binding exceeds ${sourcePolicyLimits.maxPathPoliciesPerBinding} path policies`;
+            }
+            for (const pathPolicy of pathPolicies) {
+                if (!pathPolicy || typeof pathPolicy !== 'object') {
+                    return 'Source policy path policy must be an object';
+                }
+                if (!validClasses.has(pathPolicy.pathClass)) {
+                    return 'Source policy path policy uses an unsupported path class';
+                }
+                if (typeof pathPolicy.id === 'string' && pathPolicy.id.length > sourcePolicyLimits.maxIdLength) {
+                    return `Source policy path policy id exceeds ${sourcePolicyLimits.maxIdLength} characters`;
+                }
+                if (typeof pathPolicy.maxConnections === 'number' && pathPolicy.maxConnections < 0) {
+                    return 'Source policy path policy maxConnections must be non-negative';
+                }
+                const pathRateLimitError = this.validateRateLimitPayload(pathPolicy.rateLimit);
+                if (pathRateLimitError) {
+                    return pathRateLimitError;
+                }
+                const pathMessage = pathPolicy.onExceeded?.errorMessage;
+                if (typeof pathMessage === 'string' && pathMessage.length > sourcePolicyLimits.maxExceededMessageLength) {
+                    return `Source policy exceeded message exceeds ${sourcePolicyLimits.maxExceededMessageLength} characters`;
+                }
+                const pathPatterns = pathPolicy.pathPatterns;
+                if (pathPatterns === undefined) {
+                    continue;
+                }
+                if (!Array.isArray(pathPatterns)) {
+                    return 'Source policy path patterns must be an array';
+                }
+                if (pathPatterns.length > sourcePolicyLimits.maxPathPatternsPerPolicy) {
+                    return `Source policy path class exceeds ${sourcePolicyLimits.maxPathPatternsPerPolicy} path patterns`;
+                }
+                for (const pattern of pathPatterns) {
+                    if (typeof pattern !== 'string') {
+                        return 'Source policy path pattern must be a string';
+                    }
+                    if (pattern.length > sourcePolicyLimits.maxPathPatternLength) {
+                        return `Source policy path pattern exceeds ${sourcePolicyLimits.maxPathPatternLength} characters`;
+                    }
+                    const wildcardCount = pattern.split('*').length - 1;
+                    if (wildcardCount > sourcePolicyLimits.maxPathPatternWildcards) {
+                        return `Source policy path pattern exceeds ${sourcePolicyLimits.maxPathPatternWildcards} wildcards`;
+                    }
+                }
+            }
+        }
+        return undefined;
+    }
+    static validateRateLimitPayload(rateLimit) {
+        if (!rateLimit || typeof rateLimit !== 'object') {
+            return undefined;
+        }
+        const rawRateLimit = rateLimit;
+        for (const key of ['maxRequests', 'window']) {
+            const value = rawRateLimit[key];
+            if (typeof value === 'string' && value.length > 32) {
+                return `Source policy rate limit ${key} exceeds 32 characters`;
+            }
+        }
+        if (typeof rateLimit.errorMessage === 'string'
+            && rateLimit.errorMessage.length > sourcePolicyLimits.maxExceededMessageLength) {
+            return `Source policy rate limit error message exceeds ${sourcePolicyLimits.maxExceededMessageLength} characters`;
+        }
+        return undefined;
+    }
+    static validateSourcePolicyShape(sourcePolicy, route) {
+        const payloadError = this.validateSourcePolicyPayload(sourcePolicy);
+        if (payloadError) {
+            return payloadError;
+        }
+        const bindings = sourcePolicy?.bindings || [];
+        if (bindings.length === 0) {
+            return undefined;
+        }
+        let estimatedCompiledRoutes = 0;
+        for (const binding of bindings) {
+            const pathPolicies = binding.pathPolicies || [];
+            if (pathPolicies.length === 0) {
+                estimatedCompiledRoutes++;
+            }
+            else {
+                let hasSourceFallback = false;
+                for (const pathPolicy of pathPolicies) {
+                    const pathPatterns = this.getPathPatterns(pathPolicy);
+                    if (pathPatterns.length > sourcePolicyLimits.maxPathPatternsPerPolicy) {
+                        return `Source policy path class expands beyond ${sourcePolicyLimits.maxPathPatternsPerPolicy} path patterns`;
+                    }
+                    if (pathPatterns.length === 0) {
+                        hasSourceFallback = true;
+                        estimatedCompiledRoutes++;
+                    }
+                    else {
+                        estimatedCompiledRoutes += pathPatterns.length;
+                    }
+                }
+                if (!hasSourceFallback) {
+                    estimatedCompiledRoutes++;
+                }
+            }
+            if (estimatedCompiledRoutes > sourcePolicyLimits.maxCompiledVariantsPerRoute) {
+                return `Source policy exceeds ${sourcePolicyLimits.maxCompiledVariantsPerRoute} compiled route variants`;
+            }
+        }
+        const expandedPortCount = route ? this.getExpandedPortCount(route.match?.ports) : 1;
+        if (estimatedCompiledRoutes * expandedPortCount > sourcePolicyLimits.maxCompiledVariantsPerRoute) {
+            return `Source policy exceeds ${sourcePolicyLimits.maxCompiledVariantsPerRoute} compiled route-port variants`;
+        }
+        return undefined;
+    }
+    static validateResolvedSourcePolicy(sourcePolicy, referenceResolver) {
+        const bindings = sourcePolicy?.bindings || [];
+        if (bindings.length === 0) {
+            return undefined;
+        }
+        if (!referenceResolver) {
+            return 'Source policy requires source profile resolution';
+        }
+        for (let index = 0; index < bindings.length; index++) {
+            const binding = bindings[index];
+            const profile = referenceResolver.getProfile(binding.sourceProfileRef);
+            if (!profile) {
+                return `Source profile '${binding.sourceProfileRef}' not found`;
+            }
+            const profileSecurity = referenceResolver.resolveSourceProfileSecurity(binding.sourceProfileRef);
+            if (!profileSecurity) {
+                return `Source profile '${profile.name}' could not be resolved`;
+            }
+            const sourceMatches = this.getSourceMatchEntries(profileSecurity);
+            if (sourceMatches.length === 0) {
+                return `Source profile '${profile.name}' has no source matches`;
+            }
+            const matchesAllSources = this.matchesAllSources(sourceMatches);
+            if (matchesAllSources && index < bindings.length - 1) {
+                return 'Wildcard source profile bindings must be last in a source policy';
+            }
+            if (index === bindings.length - 1 && !matchesAllSources) {
+                return 'Source policy must end with an all-source fallback profile';
+            }
+        }
+        return undefined;
+    }
+    static buildCompiledRoute(options) {
+        const routeKey = options.route.id || options.routeId || options.route.name || 'route';
+        const bindingKey = options.binding.id || options.binding.sourceProfileRef || String(options.sourceIndex + 1);
+        const pathPolicyKey = options.pathPolicy
+            ? options.pathPolicy.id || options.pathPolicy.pathClass
+            : undefined;
+        const pathLabel = options.pathPolicy
+            ? giteaRoutePathClassLabels[options.pathPolicy.pathClass]
+            : undefined;
+        const pathPatternSuffix = options.pathPatternCount && options.pathPatternCount > 1
+            ? `:${(options.pathPatternIndex || 0) + 1}`
+            : '';
+        const pathPriority = options.pathPolicy
+            ? this.calculatePathPriorityOffset(options.pathPattern, options.pathIndex || 0, options.pathPolicyCount || 1, options.pathPatternIndex || 0, options.pathPatternCount || 1)
+            : 0;
+        return {
+            ...options.route,
+            id: pathPolicyKey
+                ? `${routeKey}:source:${bindingKey}:path:${pathPolicyKey}${pathPatternSuffix}`
+                : `${routeKey}:source:${bindingKey}`,
+            name: pathLabel
+                ? `${options.route.name || routeKey}:source:${options.profileName}:path:${pathLabel}${pathPatternSuffix}`
+                : `${options.route.name || routeKey}:source:${options.profileName}`,
+            match: options.pathPattern
+                ? { ...options.sourceMatch, path: options.pathPattern }
+                : { ...options.sourceMatch },
+            priority: this.clampPriority(options.sourcePriority + pathPriority),
+            security: this.buildBindingSecurity(options.route.security, options.profileSecurity, options.binding, options.pathPolicy),
+        };
+    }
+    static getPathPatterns(pathPolicy) {
+        const patterns = pathPolicy.pathPatterns?.length
+            ? pathPolicy.pathPatterns
+            : giteaRoutePathClassPatterns[pathPolicy.pathClass];
+        return [...new Set(patterns.map((pattern) => pattern.trim()).filter(Boolean))];
+    }
+    static calculatePathPriorityOffset(pathPattern, pathIndex, pathPolicyCount, pathPatternIndex, pathPatternCount) {
+        if (!pathPattern) {
+            return 0;
+        }
+        const pathPolicyOffset = ((pathPolicyCount - pathIndex) / (pathPolicyCount + 1))
+            * (PATH_PRIORITY_BAND * 0.9);
+        const pathPatternOffset = ((pathPatternCount - pathPatternIndex) / (pathPatternCount + 1))
+            * (PATH_PRIORITY_BAND * 0.1 / (pathPolicyCount + 1));
+        return pathPolicyOffset + pathPatternOffset;
+    }
+    static calculateSourcePriority(basePriority, sourceIndex, sourceCount) {
+        const safeBasePriority = this.clampPriority(basePriority, MIN_ROUTE_PRIORITY, MAX_ROUTE_PRIORITY - SOURCE_PRIORITY_BAND - PATH_PRIORITY_BAND);
+        const sourceStep = SOURCE_PRIORITY_BAND / (sourceCount + 1);
+        return safeBasePriority + ((sourceCount - sourceIndex) * sourceStep);
+    }
+    static clampPriority(priority, min = MIN_ROUTE_PRIORITY, max = MAX_ROUTE_PRIORITY) {
+        if (!Number.isFinite(priority)) {
+            return min;
+        }
+        return Math.min(max, Math.max(min, priority));
+    }
+    static getExpandedPortCount(portRange) {
+        if (portRange === undefined) {
+            return 1;
+        }
+        if (typeof portRange === 'number') {
+            return Number.isFinite(portRange) ? 1 : sourcePolicyLimits.maxCompiledVariantsPerRoute + 1;
+        }
+        if (!Array.isArray(portRange)) {
+            return sourcePolicyLimits.maxCompiledVariantsPerRoute + 1;
+        }
+        let count = 0;
+        for (const portEntry of portRange) {
+            if (typeof portEntry === 'number') {
+                if (!Number.isFinite(portEntry)) {
+                    return sourcePolicyLimits.maxCompiledVariantsPerRoute + 1;
+                }
+                count++;
+            }
+            else if (portEntry
+                && typeof portEntry === 'object'
+                && Number.isFinite(portEntry.from)
+                && Number.isFinite(portEntry.to)
+                && portEntry.from <= portEntry.to) {
+                count += Math.floor(portEntry.to) - Math.floor(portEntry.from) + 1;
+            }
+            else {
+                return sourcePolicyLimits.maxCompiledVariantsPerRoute + 1;
+            }
+            if (count > sourcePolicyLimits.maxCompiledVariantsPerRoute) {
+                return count;
+            }
+        }
+        return Math.max(1, count);
+    }
+    static normalizeMaxConnections(value) {
+        return typeof value === 'number' && Number.isFinite(value) && value >= 0 ? value : undefined;
+    }
+    static forceIpRateLimit(rateLimit) {
+        if (!rateLimit) {
+            return undefined;
+        }
+        const { headerName: _headerName, ...rest } = structuredClone(rateLimit);
+        return {
+            ...rest,
+            keyBy: 'ip',
+        };
+    }
+    static sanitizeSourcePolicySecurity(security) {
+        const sanitized = structuredClone(security);
+        const maxConnections = this.normalizeMaxConnections(sanitized.maxConnections);
+        if (maxConnections === undefined) {
+            delete sanitized.maxConnections;
+        }
+        else {
+            sanitized.maxConnections = maxConnections;
+        }
+        if (sanitized.rateLimit) {
+            sanitized.rateLimit = this.forceIpRateLimit(sanitized.rateLimit);
+        }
+        return sanitized;
+    }
+    static isEmptySecurity(security) {
+        return Object.keys(security).length === 0;
+    }
+    static getSourceMatchEntries(security) {
+        const entries = security.ipAllowList || [];
+        const normalizedEntries = [];
+        for (const entry of entries) {
+            const rawEntry = typeof entry === 'string' ? entry : entry.ip;
+            if (typeof rawEntry !== 'string')
+                continue;
+            const normalizedEntry = rawEntry.trim();
+            if (normalizedEntry) {
+                normalizedEntries.push(normalizedEntry);
+            }
+        }
+        return [...new Set(normalizedEntries)];
+    }
+    static matchesAllSources(sourceMatches) {
+        return sourceMatches.includes('*')
+            || (sourceMatches.includes('0.0.0.0/0') && sourceMatches.includes('::/0'));
+    }
+    static buildBindingSecurity(routeSecurity, profileSecurity, binding, pathPolicy) {
+        const baseSecurity = this.omitSourceMatchFields(routeSecurity || {});
+        const sourceSecurity = this.omitSourceMatchFields(profileSecurity);
+        if (binding.rateLimit !== undefined) {
+            sourceSecurity.rateLimit = this.forceIpRateLimit(binding.rateLimit);
+        }
+        if (binding.maxConnections !== undefined) {
+            const maxConnections = this.normalizeMaxConnections(binding.maxConnections);
+            if (maxConnections === undefined) {
+                delete sourceSecurity.maxConnections;
+            }
+            else {
+                sourceSecurity.maxConnections = maxConnections;
+            }
+        }
+        if (binding.onExceeded?.errorMessage && sourceSecurity.rateLimit) {
+            sourceSecurity.rateLimit = {
+                ...sourceSecurity.rateLimit,
+                errorMessage: binding.onExceeded.errorMessage,
+            };
+        }
+        if (pathPolicy?.rateLimit !== undefined) {
+            sourceSecurity.rateLimit = this.forceIpRateLimit(pathPolicy.rateLimit);
+        }
+        if (pathPolicy?.maxConnections !== undefined) {
+            const maxConnections = this.normalizeMaxConnections(pathPolicy.maxConnections);
+            if (maxConnections === undefined) {
+                delete sourceSecurity.maxConnections;
+            }
+            else {
+                sourceSecurity.maxConnections = maxConnections;
+            }
+        }
+        if (pathPolicy?.onExceeded?.errorMessage && sourceSecurity.rateLimit) {
+            sourceSecurity.rateLimit = {
+                ...sourceSecurity.rateLimit,
+                errorMessage: pathPolicy.onExceeded.errorMessage,
+            };
+        }
+        const mergedSecurity = this.sanitizeSourcePolicySecurity({
+            ...baseSecurity,
+            ...sourceSecurity,
+        });
+        return this.isEmptySecurity(mergedSecurity) ? undefined : mergedSecurity;
+    }
+    static omitSourceMatchFields(security) {
+        const { ipAllowList: _ipAllowList, ...controls } = security;
+        return this.sanitizeSourcePolicySecurity(controls);
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zb3VyY2UtcG9saWN5LWNvbXBpbGVyLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvY29uZmlnL2NsYXNzZXMuc291cmNlLXBvbGljeS1jb21waWxlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUN6QyxPQUFPLEVBQ0wseUJBQXlCLEVBQ3pCLDJCQUEyQixFQUMzQixnQkFBZ0IsR0FDakIsTUFBTSw4Q0FBOEMsQ0FBQztBQVV0RCxNQUFNLGtCQUFrQixHQUFHLENBQUMsQ0FBQztBQUM3QixNQUFNLGtCQUFrQixHQUFHLEtBQUssQ0FBQztBQUNqQyxNQUFNLG9CQUFvQixHQUFHLE1BQU0sQ0FBQztBQUNwQyxNQUFNLGtCQUFrQixHQUFHLE1BQU0sQ0FBQztBQUVsQyxNQUFNLENBQUMsTUFBTSxrQkFBa0IsR0FBRztJQUNoQyxXQUFXLEVBQUUsRUFBRTtJQUNmLHlCQUF5QixFQUFFLEVBQUU7SUFDN0Isd0JBQXdCLEVBQUUsRUFBRTtJQUM1QixvQkFBb0IsRUFBRSxHQUFHO0lBQ3pCLHVCQUF1QixFQUFFLENBQUM7SUFDMUIseUJBQXlCLEVBQUUsR0FBRztJQUM5QixXQUFXLEVBQUUsR0FBRztJQUNoQix3QkFBd0IsRUFBRSxHQUFHO0lBQzdCLDJCQUEyQixFQUFFLEdBQUc7Q0FDeEIsQ0FBQztBQUVYLE1BQU0sT0FBTyxvQkFBb0I7SUFDeEIsTUFBTSxDQUFDLFlBQVksQ0FDeEIsS0FBc0MsRUFDdEMsUUFBb0MsRUFDcEMsaUJBQWdELEVBQ2hELE9BQWdCO1FBRWhCLE1BQU0sUUFBUSxHQUFHLFFBQVEsRUFBRSxZQUFZLEVBQUUsUUFBUSxJQUFJLEVBQUUsQ0FBQztRQUN4RCxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDMUIsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDO1FBQ2pCLENBQUM7UUFDRCxJQUFJLElBQUksQ0FBQyx5QkFBeUIsQ0FBQyxRQUFRLEVBQUUsWUFBWSxFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbEUsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDO1FBQ0QsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDdkIsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDO1FBQ0QsSUFBSSxJQUFJLENBQUMsNEJBQTRCLENBQUMsUUFBUSxFQUFFLFlBQVksRUFBRSxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7WUFDakYsT0FBTyxFQUFFLENBQUM7UUFDWixDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQXNDLEVBQUUsQ0FBQztRQUM3RCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsUUFBUSxJQUFJLENBQUMsQ0FBQztRQUV6QyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLEtBQUssRUFBRSxFQUFFO1lBQ2xDLE1BQU0sT0FBTyxHQUFHLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUN2RSxNQUFNLGVBQWUsR0FBRyxpQkFBaUIsQ0FBQyw0QkFBNEIsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUNqRyxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7Z0JBQ2pDLE9BQU87WUFDVCxDQUFDO1lBRUQsTUFBTSxhQUFhLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQ2xFLElBQUksYUFBYSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDL0IsT0FBTztZQUNULENBQUM7WUFDRCxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsdUJBQXVCLENBQUMsWUFBWSxFQUFFLEtBQUssRUFBRSxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDMUYsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLGlCQUFpQixDQUFDLGFBQWEsQ0FBQztnQkFDdkQsQ0FBQyxDQUFDLEVBQUUsR0FBRyxLQUFLLENBQUMsS0FBSyxFQUFFO2dCQUNwQixDQUFDLENBQUMsRUFBRSxHQUFHLEtBQUssQ0FBQyxLQUFLLEVBQUUsUUFBUSxFQUFFLGFBQWEsRUFBRSxDQUFDO1lBQ2hELE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLElBQUksRUFBRSxDQUFDO1lBRWhELElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDOUIsY0FBYyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsa0JBQWtCLENBQUM7b0JBQzFDLEtBQUs7b0JBQ0wsV0FBVztvQkFDWCxXQUFXLEVBQUUsT0FBTyxDQUFDLElBQUk7b0JBQ3pCLGVBQWU7b0JBQ2YsT0FBTztvQkFDUCxjQUFjO29CQUNkLE9BQU87b0JBQ1AsV0FBVyxFQUFFLEtBQUs7aUJBQ25CLENBQUMsQ0FBQyxDQUFDO2dCQUNKLE9BQU87WUFDVCxDQUFDO1lBRUQsSUFBSSxpQkFBaUIsR0FBRyxLQUFLLENBQUM7WUFDOUIsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFVBQVUsRUFBRSxTQUFTLEVBQUUsRUFBRTtnQkFDN0MsTUFBTSxZQUFZLEdBQUcsSUFBSSxDQUFDLGVBQWUsQ0FBQyxVQUFVLENBQUMsQ0FBQztnQkFDdEQsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO29CQUM5QixpQkFBaUIsR0FBRyxJQUFJLENBQUM7b0JBQ3pCLGNBQWMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDO3dCQUMxQyxLQUFLO3dCQUNMLFdBQVc7d0JBQ1gsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJO3dCQUN6QixlQUFlO3dCQUNmLE9BQU87d0JBQ1AsVUFBVTt3QkFDVixjQUFjO3dCQUNkLE9BQU87d0JBQ1AsV0FBVyxFQUFFLEtBQUs7d0JBQ2xCLFNBQVM7d0JBQ1QsZUFBZSxFQUFFLFlBQVksQ0FBQyxNQUFNO3FCQUNyQyxDQUFDLENBQUMsQ0FBQztvQkFDSixPQUFPO2dCQUNULENBQUM7Z0JBRUQsWUFBWSxDQUFDLE9BQU8sQ0FBQyxDQUFDLFdBQVcsRUFBRSxnQkFBZ0IsRUFBRSxFQUFFO29CQUNyRCxjQUFjLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsQ0FBQzt3QkFDMUMsS0FBSzt3QkFDTCxXQUFXO3dCQUNYLFdBQVcsRUFBRSxPQUFPLENBQUMsSUFBSTt3QkFDekIsZUFBZTt3QkFDZixPQUFPO3dCQUNQLFVBQVU7d0JBQ1YsV0FBVzt3QkFDWCxjQUFjO3dCQUNkLE9BQU87d0JBQ1AsV0FBVyxFQUFFLEtBQUs7d0JBQ2xCLFNBQVM7d0JBQ1QsZUFBZSxFQUFFLFlBQVksQ0FBQyxNQUFNO3dCQUNwQyxnQkFBZ0I7d0JBQ2hCLGdCQUFnQixFQUFFLFlBQVksQ0FBQyxNQUFNO3FCQUN0QyxDQUFDLENBQUMsQ0FBQztnQkFDTixDQUFDLENBQUMsQ0FBQztZQUNMLENBQUMsQ0FBQyxDQUFDO1lBRUgsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7Z0JBQ3ZCLGNBQWMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGtCQUFrQixDQUFDO29CQUMxQyxLQUFLO29CQUNMLFdBQVc7b0JBQ1gsV0FBVyxFQUFFLE9BQU8sQ0FBQyxJQUFJO29CQUN6QixlQUFlO29CQUNmLE9BQU87b0JBQ1AsY0FBYztvQkFDZCxPQUFPO29CQUNQLFdBQVcsRUFBRSxLQUFLO2lCQUNuQixDQUFDLENBQUMsQ0FBQztZQUNOLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUVILE9BQU8sY0FBYyxDQUFDO0lBQ3hCLENBQUM7SUFFTSxNQUFNLENBQUMsMkJBQTJCLENBQUMsWUFBMEM7UUFDbEYsSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ2xCLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMxQyxPQUFPLHlDQUF5QyxDQUFDO1FBQ25ELENBQUM7UUFDRCxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3ZDLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxJQUFJLFlBQVksQ0FBQyxRQUFRLENBQUMsTUFBTSxHQUFHLGtCQUFrQixDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2xFLE9BQU8seUJBQXlCLGtCQUFrQixDQUFDLFdBQVcsV0FBVyxDQUFDO1FBQzVFLENBQUM7UUFFRCxNQUFNLFlBQVksR0FBRyxJQUFJLEdBQUcsQ0FBUyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQ3ZELEtBQUssTUFBTSxPQUFPLElBQUksWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQzVDLElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxPQUFPLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzVDLE9BQU8seUNBQXlDLENBQUM7WUFDbkQsQ0FBQztZQUNELElBQUksT0FBTyxPQUFPLENBQUMsZ0JBQWdCLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ2pELE9BQU8saURBQWlELENBQUM7WUFDM0QsQ0FBQztZQUNELElBQUksT0FBTyxDQUFDLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyx5QkFBeUIsRUFBRSxDQUFDO2dCQUNuRixPQUFPLDRDQUE0QyxrQkFBa0IsQ0FBQyx5QkFBeUIsYUFBYSxDQUFDO1lBQy9HLENBQUM7WUFDRCxJQUFJLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQ2pELE9BQU8saURBQWlELENBQUM7WUFDM0QsQ0FBQztZQUNELElBQUksT0FBTyxPQUFPLENBQUMsRUFBRSxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsRUFBRSxDQUFDLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyxXQUFXLEVBQUUsQ0FBQztnQkFDekYsT0FBTyxvQ0FBb0Msa0JBQWtCLENBQUMsV0FBVyxhQUFhLENBQUM7WUFDekYsQ0FBQztZQUNELElBQUksT0FBTyxPQUFPLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxPQUFPLENBQUMsY0FBYyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUM3RSxPQUFPLG1EQUFtRCxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLHFCQUFxQixHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDL0UsSUFBSSxxQkFBcUIsRUFBRSxDQUFDO2dCQUMxQixPQUFPLHFCQUFxQixDQUFDO1lBQy9CLENBQUM7WUFDRCxNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQztZQUN4RCxJQUFJLE9BQU8sY0FBYyxLQUFLLFFBQVEsSUFBSSxjQUFjLENBQUMsTUFBTSxHQUFHLGtCQUFrQixDQUFDLHdCQUF3QixFQUFFLENBQUM7Z0JBQzlHLE9BQU8sMENBQTBDLGtCQUFrQixDQUFDLHdCQUF3QixhQUFhLENBQUM7WUFDNUcsQ0FBQztZQUVELE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLENBQUM7WUFDMUMsSUFBSSxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQy9CLFNBQVM7WUFDWCxDQUFDO1lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztnQkFDakMsT0FBTyw4Q0FBOEMsQ0FBQztZQUN4RCxDQUFDO1lBQ0QsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLGtCQUFrQixDQUFDLHlCQUF5QixFQUFFLENBQUM7Z0JBQ3ZFLE9BQU8saUNBQWlDLGtCQUFrQixDQUFDLHlCQUF5QixnQkFBZ0IsQ0FBQztZQUN2RyxDQUFDO1lBRUQsS0FBSyxNQUFNLFVBQVUsSUFBSSxZQUFZLEVBQUUsQ0FBQztnQkFDdEMsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLEVBQUUsQ0FBQztvQkFDbEQsT0FBTyw2Q0FBNkMsQ0FBQztnQkFDdkQsQ0FBQztnQkFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztvQkFDNUMsT0FBTywwREFBMEQsQ0FBQztnQkFDcEUsQ0FBQztnQkFDRCxJQUFJLE9BQU8sVUFBVSxDQUFDLEVBQUUsS0FBSyxRQUFRLElBQUksVUFBVSxDQUFDLEVBQUUsQ0FBQyxNQUFNLEdBQUcsa0JBQWtCLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQy9GLE9BQU8sd0NBQXdDLGtCQUFrQixDQUFDLFdBQVcsYUFBYSxDQUFDO2dCQUM3RixDQUFDO2dCQUNELElBQUksT0FBTyxVQUFVLENBQUMsY0FBYyxLQUFLLFFBQVEsSUFBSSxVQUFVLENBQUMsY0FBYyxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUNuRixPQUFPLCtEQUErRCxDQUFDO2dCQUN6RSxDQUFDO2dCQUNELE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxDQUFDLHdCQUF3QixDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDL0UsSUFBSSxrQkFBa0IsRUFBRSxDQUFDO29CQUN2QixPQUFPLGtCQUFrQixDQUFDO2dCQUM1QixDQUFDO2dCQUNELE1BQU0sV0FBVyxHQUFHLFVBQVUsQ0FBQyxVQUFVLEVBQUUsWUFBWSxDQUFDO2dCQUN4RCxJQUFJLE9BQU8sV0FBVyxLQUFLLFFBQVEsSUFBSSxXQUFXLENBQUMsTUFBTSxHQUFHLGtCQUFrQixDQUFDLHdCQUF3QixFQUFFLENBQUM7b0JBQ3hHLE9BQU8sMENBQTBDLGtCQUFrQixDQUFDLHdCQUF3QixhQUFhLENBQUM7Z0JBQzVHLENBQUM7Z0JBRUQsTUFBTSxZQUFZLEdBQUcsVUFBVSxDQUFDLFlBQVksQ0FBQztnQkFDN0MsSUFBSSxZQUFZLEtBQUssU0FBUyxFQUFFLENBQUM7b0JBQy9CLFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO29CQUNqQyxPQUFPLDhDQUE4QyxDQUFDO2dCQUN4RCxDQUFDO2dCQUNELElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO29CQUN0RSxPQUFPLG9DQUFvQyxrQkFBa0IsQ0FBQyx3QkFBd0IsZ0JBQWdCLENBQUM7Z0JBQ3pHLENBQUM7Z0JBQ0QsS0FBSyxNQUFNLE9BQU8sSUFBSSxZQUFZLEVBQUUsQ0FBQztvQkFDbkMsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRLEVBQUUsQ0FBQzt3QkFDaEMsT0FBTyw2Q0FBNkMsQ0FBQztvQkFDdkQsQ0FBQztvQkFDRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEdBQUcsa0JBQWtCLENBQUMsb0JBQW9CLEVBQUUsQ0FBQzt3QkFDN0QsT0FBTyxzQ0FBc0Msa0JBQWtCLENBQUMsb0JBQW9CLGFBQWEsQ0FBQztvQkFDcEcsQ0FBQztvQkFDRCxNQUFNLGFBQWEsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7b0JBQ3BELElBQUksYUFBYSxHQUFHLGtCQUFrQixDQUFDLHVCQUF1QixFQUFFLENBQUM7d0JBQy9ELE9BQU8sc0NBQXNDLGtCQUFrQixDQUFDLHVCQUF1QixZQUFZLENBQUM7b0JBQ3RHLENBQUM7Z0JBQ0gsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVPLE1BQU0sQ0FBQyx3QkFBd0IsQ0FBQyxTQUFrRDtRQUN4RixJQUFJLENBQUMsU0FBUyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2hELE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxNQUFNLFlBQVksR0FBRyxTQUErQyxDQUFDO1FBQ3JFLEtBQUssTUFBTSxHQUFHLElBQUksQ0FBQyxhQUFhLEVBQUUsUUFBUSxDQUFVLEVBQUUsQ0FBQztZQUNyRCxNQUFNLEtBQUssR0FBRyxZQUFZLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDaEMsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztnQkFDbkQsT0FBTyw0QkFBNEIsR0FBRyx3QkFBd0IsQ0FBQztZQUNqRSxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQ0UsT0FBTyxTQUFTLENBQUMsWUFBWSxLQUFLLFFBQVE7ZUFDdkMsU0FBUyxDQUFDLFlBQVksQ0FBQyxNQUFNLEdBQUcsa0JBQWtCLENBQUMsd0JBQXdCLEVBQzlFLENBQUM7WUFDRCxPQUFPLGtEQUFrRCxrQkFBa0IsQ0FBQyx3QkFBd0IsYUFBYSxDQUFDO1FBQ3BILENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRU0sTUFBTSxDQUFDLHlCQUF5QixDQUNyQyxZQUFpQyxFQUNqQyxLQUF1QztRQUV2QyxNQUFNLFlBQVksR0FBRyxJQUFJLENBQUMsMkJBQTJCLENBQUMsWUFBWSxDQUFDLENBQUM7UUFDcEUsSUFBSSxZQUFZLEVBQUUsQ0FBQztZQUNqQixPQUFPLFlBQVksQ0FBQztRQUN0QixDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsWUFBWSxFQUFFLFFBQVEsSUFBSSxFQUFFLENBQUM7UUFDOUMsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFFRCxJQUFJLHVCQUF1QixHQUFHLENBQUMsQ0FBQztRQUNoQyxLQUFLLE1BQU0sT0FBTyxJQUFJLFFBQVEsRUFBRSxDQUFDO1lBQy9CLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxZQUFZLElBQUksRUFBRSxDQUFDO1lBRWhELElBQUksWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztnQkFDOUIsdUJBQXVCLEVBQUUsQ0FBQztZQUM1QixDQUFDO2lCQUFNLENBQUM7Z0JBQ04sSUFBSSxpQkFBaUIsR0FBRyxLQUFLLENBQUM7Z0JBQzlCLEtBQUssTUFBTSxVQUFVLElBQUksWUFBWSxFQUFFLENBQUM7b0JBQ3RDLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLENBQUM7b0JBQ3RELElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxrQkFBa0IsQ0FBQyx3QkFBd0IsRUFBRSxDQUFDO3dCQUN0RSxPQUFPLDJDQUEyQyxrQkFBa0IsQ0FBQyx3QkFBd0IsZ0JBQWdCLENBQUM7b0JBQ2hILENBQUM7b0JBQ0QsSUFBSSxZQUFZLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO3dCQUM5QixpQkFBaUIsR0FBRyxJQUFJLENBQUM7d0JBQ3pCLHVCQUF1QixFQUFFLENBQUM7b0JBQzVCLENBQUM7eUJBQU0sQ0FBQzt3QkFDTix1QkFBdUIsSUFBSSxZQUFZLENBQUMsTUFBTSxDQUFDO29CQUNqRCxDQUFDO2dCQUNILENBQUM7Z0JBQ0QsSUFBSSxDQUFDLGlCQUFpQixFQUFFLENBQUM7b0JBQ3ZCLHVCQUF1QixFQUFFLENBQUM7Z0JBQzVCLENBQUM7WUFDSCxDQUFDO1lBRUQsSUFBSSx1QkFBdUIsR0FBRyxrQkFBa0IsQ0FBQywyQkFBMkIsRUFBRSxDQUFDO2dCQUM3RSxPQUFPLHlCQUF5QixrQkFBa0IsQ0FBQywyQkFBMkIsMEJBQTBCLENBQUM7WUFDM0csQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLGlCQUFpQixHQUFHLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLG9CQUFvQixDQUFDLEtBQUssQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUNwRixJQUFJLHVCQUF1QixHQUFHLGlCQUFpQixHQUFHLGtCQUFrQixDQUFDLDJCQUEyQixFQUFFLENBQUM7WUFDakcsT0FBTyx5QkFBeUIsa0JBQWtCLENBQUMsMkJBQTJCLCtCQUErQixDQUFDO1FBQ2hILENBQUM7UUFFRCxPQUFPLFNBQVMsQ0FBQztJQUNuQixDQUFDO0lBRU0sTUFBTSxDQUFDLDRCQUE0QixDQUN4QyxZQUE0QyxFQUM1QyxpQkFBZ0Q7UUFFaEQsTUFBTSxRQUFRLEdBQUcsWUFBWSxFQUFFLFFBQVEsSUFBSSxFQUFFLENBQUM7UUFDOUMsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFCLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxJQUFJLENBQUMsaUJBQWlCLEVBQUUsQ0FBQztZQUN2QixPQUFPLGtEQUFrRCxDQUFDO1FBQzVELENBQUM7UUFFRCxLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO1lBQ3JELE1BQU0sT0FBTyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUNoQyxNQUFNLE9BQU8sR0FBRyxpQkFBaUIsQ0FBQyxVQUFVLENBQUMsT0FBTyxDQUFDLGdCQUFnQixDQUFDLENBQUM7WUFDdkUsSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNiLE9BQU8sbUJBQW1CLE9BQU8sQ0FBQyxnQkFBZ0IsYUFBYSxDQUFDO1lBQ2xFLENBQUM7WUFDRCxNQUFNLGVBQWUsR0FBRyxpQkFBaUIsQ0FBQyw0QkFBNEIsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsQ0FBQztZQUNqRyxJQUFJLENBQUMsZUFBZSxFQUFFLENBQUM7Z0JBQ3JCLE9BQU8sbUJBQW1CLE9BQU8sQ0FBQyxJQUFJLHlCQUF5QixDQUFDO1lBQ2xFLENBQUM7WUFDRCxNQUFNLGFBQWEsR0FBRyxJQUFJLENBQUMscUJBQXFCLENBQUMsZUFBZSxDQUFDLENBQUM7WUFDbEUsSUFBSSxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO2dCQUMvQixPQUFPLG1CQUFtQixPQUFPLENBQUMsSUFBSSx5QkFBeUIsQ0FBQztZQUNsRSxDQUFDO1lBQ0QsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsYUFBYSxDQUFDLENBQUM7WUFDaEUsSUFBSSxpQkFBaUIsSUFBSSxLQUFLLEdBQUcsUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDckQsT0FBTyxrRUFBa0UsQ0FBQztZQUM1RSxDQUFDO1lBQ0QsSUFBSSxLQUFLLEtBQUssUUFBUSxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksQ0FBQyxpQkFBaUIsRUFBRSxDQUFDO2dCQUN4RCxPQUFPLDREQUE0RCxDQUFDO1lBQ3RFLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztJQUVPLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxPQWVqQztRQUNDLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLE9BQU8sQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLElBQUksT0FBTyxDQUFDO1FBQ3RGLE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxPQUFPLENBQUMsRUFBRSxJQUFJLE9BQU8sQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLElBQUksTUFBTSxDQUFDLE9BQU8sQ0FBQyxXQUFXLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDN0csTUFBTSxhQUFhLEdBQUcsT0FBTyxDQUFDLFVBQVU7WUFDdEMsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxJQUFJLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUztZQUN2RCxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2QsTUFBTSxTQUFTLEdBQUcsT0FBTyxDQUFDLFVBQVU7WUFDbEMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDO1lBQ3pELENBQUMsQ0FBQyxTQUFTLENBQUM7UUFDZCxNQUFNLGlCQUFpQixHQUFHLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSxPQUFPLENBQUMsZ0JBQWdCLEdBQUcsQ0FBQztZQUNoRixDQUFDLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsSUFBSSxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUU7WUFDM0MsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNQLE1BQU0sWUFBWSxHQUFHLE9BQU8sQ0FBQyxVQUFVO1lBQ3JDLENBQUMsQ0FBQyxJQUFJLENBQUMsMkJBQTJCLENBQzlCLE9BQU8sQ0FBQyxXQUFXLEVBQ25CLE9BQU8sQ0FBQyxTQUFTLElBQUksQ0FBQyxFQUN0QixPQUFPLENBQUMsZUFBZSxJQUFJLENBQUMsRUFDNUIsT0FBTyxDQUFDLGdCQUFnQixJQUFJLENBQUMsRUFDN0IsT0FBTyxDQUFDLGdCQUFnQixJQUFJLENBQUMsQ0FDOUI7WUFDSCxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBRU4sT0FBTztZQUNMLEdBQUcsT0FBTyxDQUFDLEtBQUs7WUFDaEIsRUFBRSxFQUFFLGFBQWE7Z0JBQ2YsQ0FBQyxDQUFDLEdBQUcsUUFBUSxXQUFXLFVBQVUsU0FBUyxhQUFhLEdBQUcsaUJBQWlCLEVBQUU7Z0JBQzlFLENBQUMsQ0FBQyxHQUFHLFFBQVEsV0FBVyxVQUFVLEVBQUU7WUFDdEMsSUFBSSxFQUFFLFNBQVM7Z0JBQ2IsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLEtBQUssQ0FBQyxJQUFJLElBQUksUUFBUSxXQUFXLE9BQU8sQ0FBQyxXQUFXLFNBQVMsU0FBUyxHQUFHLGlCQUFpQixFQUFFO2dCQUN6RyxDQUFDLENBQUMsR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxRQUFRLFdBQVcsT0FBTyxDQUFDLFdBQVcsRUFBRTtZQUNyRSxLQUFLLEVBQUUsT0FBTyxDQUFDLFdBQVc7Z0JBQ3hCLENBQUMsQ0FBQyxFQUFFLEdBQUcsT0FBTyxDQUFDLFdBQVcsRUFBRSxJQUFJLEVBQUUsT0FBTyxDQUFDLFdBQVcsRUFBRTtnQkFDdkQsQ0FBQyxDQUFDLEVBQUUsR0FBRyxPQUFPLENBQUMsV0FBVyxFQUFFO1lBQzlCLFFBQVEsRUFBRSxJQUFJLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxjQUFjLEdBQUcsWUFBWSxDQUFDO1lBQ25FLFFBQVEsRUFBRSxJQUFJLENBQUMsb0JBQW9CLENBQ2pDLE9BQU8sQ0FBQyxLQUFLLENBQUMsUUFBUSxFQUN0QixPQUFPLENBQUMsZUFBZSxFQUN2QixPQUFPLENBQUMsT0FBTyxFQUNmLE9BQU8sQ0FBQyxVQUFVLENBQ25CO1NBQ0YsQ0FBQztJQUNKLENBQUM7SUFFTyxNQUFNLENBQUMsZUFBZSxDQUFDLFVBQW1DO1FBQ2hFLE1BQU0sUUFBUSxHQUFhLFVBQVUsQ0FBQyxZQUFZLEVBQUUsTUFBTTtZQUN4RCxDQUFDLENBQUMsVUFBVSxDQUFDLFlBQVk7WUFDekIsQ0FBQyxDQUFDLDJCQUEyQixDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUN0RCxPQUFPLENBQUMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2pGLENBQUM7SUFFTyxNQUFNLENBQUMsMkJBQTJCLENBQ3hDLFdBQStCLEVBQy9CLFNBQWlCLEVBQ2pCLGVBQXVCLEVBQ3ZCLGdCQUF3QixFQUN4QixnQkFBd0I7UUFFeEIsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2pCLE9BQU8sQ0FBQyxDQUFDO1FBQ1gsQ0FBQztRQUNELE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxDQUFDLGVBQWUsR0FBRyxTQUFTLENBQUMsR0FBRyxDQUFDLGVBQWUsR0FBRyxDQUFDLENBQUMsQ0FBQztjQUM1RSxDQUFDLGtCQUFrQixHQUFHLEdBQUcsQ0FBQyxDQUFDO1FBQy9CLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxDQUFDLGdCQUFnQixHQUFHLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxnQkFBZ0IsR0FBRyxDQUFDLENBQUMsQ0FBQztjQUN0RixDQUFDLGtCQUFrQixHQUFHLEdBQUcsR0FBRyxDQUFDLGVBQWUsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3ZELE9BQU8sZ0JBQWdCLEdBQUcsaUJBQWlCLENBQUM7SUFDOUMsQ0FBQztJQUVPLE1BQU0sQ0FBQyx1QkFBdUIsQ0FDcEMsWUFBb0IsRUFDcEIsV0FBbUIsRUFDbkIsV0FBbUI7UUFFbkIsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUN6QyxZQUFZLEVBQ1osa0JBQWtCLEVBQ2xCLGtCQUFrQixHQUFHLG9CQUFvQixHQUFHLGtCQUFrQixDQUMvRCxDQUFDO1FBQ0YsTUFBTSxVQUFVLEdBQUcsb0JBQW9CLEdBQUcsQ0FBQyxXQUFXLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDNUQsT0FBTyxnQkFBZ0IsR0FBRyxDQUFDLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQyxHQUFHLFVBQVUsQ0FBQyxDQUFDO0lBQ3ZFLENBQUM7SUFFTyxNQUFNLENBQUMsYUFBYSxDQUMxQixRQUFnQixFQUNoQixHQUFHLEdBQUcsa0JBQWtCLEVBQ3hCLEdBQUcsR0FBRyxrQkFBa0I7UUFFeEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUMvQixPQUFPLEdBQUcsQ0FBQztRQUNiLENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLElBQUksQ0FBQyxHQUFHLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUM7SUFDaEQsQ0FBQztJQUVPLE1BQU0sQ0FBQyxvQkFBb0IsQ0FBQyxTQUF3RTtRQUMxRyxJQUFJLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUM1QixPQUFPLENBQUMsQ0FBQztRQUNYLENBQUM7UUFDRCxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsRUFBRSxDQUFDO1lBQ2xDLE9BQU8sTUFBTSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxrQkFBa0IsQ0FBQywyQkFBMkIsR0FBRyxDQUFDLENBQUM7UUFDN0YsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDOUIsT0FBTyxrQkFBa0IsQ0FBQywyQkFBMkIsR0FBRyxDQUFDLENBQUM7UUFDNUQsQ0FBQztRQUVELElBQUksS0FBSyxHQUFHLENBQUMsQ0FBQztRQUNkLEtBQUssTUFBTSxTQUFTLElBQUksU0FBUyxFQUFFLENBQUM7WUFDbEMsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRLEVBQUUsQ0FBQztnQkFDbEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztvQkFDaEMsT0FBTyxrQkFBa0IsQ0FBQywyQkFBMkIsR0FBRyxDQUFDLENBQUM7Z0JBQzVELENBQUM7Z0JBQ0QsS0FBSyxFQUFFLENBQUM7WUFDVixDQUFDO2lCQUFNLElBQ0wsU0FBUzttQkFDTixPQUFPLFNBQVMsS0FBSyxRQUFRO21CQUM3QixNQUFNLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUM7bUJBQy9CLE1BQU0sQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQzttQkFDN0IsU0FBUyxDQUFDLElBQUksSUFBSSxTQUFTLENBQUMsRUFBRSxFQUNqQyxDQUFDO2dCQUNELEtBQUssSUFBSSxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUMsR0FBRyxJQUFJLENBQUMsS0FBSyxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUM7WUFDckUsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLE9BQU8sa0JBQWtCLENBQUMsMkJBQTJCLEdBQUcsQ0FBQyxDQUFDO1lBQzVELENBQUM7WUFDRCxJQUFJLEtBQUssR0FBRyxrQkFBa0IsQ0FBQywyQkFBMkIsRUFBRSxDQUFDO2dCQUMzRCxPQUFPLEtBQUssQ0FBQztZQUNmLENBQUM7UUFDSCxDQUFDO1FBRUQsT0FBTyxJQUFJLENBQUMsR0FBRyxDQUFDLENBQUMsRUFBRSxLQUFLLENBQUMsQ0FBQztJQUM1QixDQUFDO0lBRU8sTUFBTSxDQUFDLHVCQUF1QixDQUFDLEtBQXVDO1FBQzVFLE9BQU8sT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE1BQU0sQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7SUFDL0YsQ0FBQztJQUVPLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FDN0IsU0FBa0Q7UUFFbEQsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztRQUNELE1BQU0sRUFBRSxVQUFVLEVBQUUsV0FBVyxFQUFFLEdBQUcsSUFBSSxFQUFFLEdBQUcsZUFBZSxDQUFDLFNBQWdDLENBQUMsQ0FBQztRQUMvRixPQUFPO1lBQ0wsR0FBRyxJQUFJO1lBQ1AsS0FBSyxFQUFFLElBQUk7U0FDbUIsQ0FBQztJQUNuQyxDQUFDO0lBRU8sTUFBTSxDQUFDLDRCQUE0QixDQUFDLFFBQXdCO1FBQ2xFLE1BQU0sU0FBUyxHQUFHLGVBQWUsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM1QyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsdUJBQXVCLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQzlFLElBQUksY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ2pDLE9BQU8sU0FBUyxDQUFDLGNBQWMsQ0FBQztRQUNsQyxDQUFDO2FBQU0sQ0FBQztZQUNOLFNBQVMsQ0FBQyxjQUFjLEdBQUcsY0FBYyxDQUFDO1FBQzVDLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN4QixTQUFTLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDbkUsQ0FBQztRQUNELE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7SUFFTyxNQUFNLENBQUMsZUFBZSxDQUFDLFFBQXdCO1FBQ3JELE9BQU8sTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLEtBQUssQ0FBQyxDQUFDO0lBQzVDLENBQUM7SUFFTyxNQUFNLENBQUMscUJBQXFCLENBQUMsUUFBd0I7UUFDM0QsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLFdBQVcsSUFBSSxFQUFFLENBQUM7UUFDM0MsTUFBTSxpQkFBaUIsR0FBYSxFQUFFLENBQUM7UUFDdkMsS0FBSyxNQUFNLEtBQUssSUFBSSxPQUFPLEVBQUUsQ0FBQztZQUM1QixNQUFNLFFBQVEsR0FBRyxPQUFPLEtBQUssS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5RCxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVE7Z0JBQUUsU0FBUztZQUMzQyxNQUFNLGVBQWUsR0FBRyxRQUFRLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDeEMsSUFBSSxlQUFlLEVBQUUsQ0FBQztnQkFDcEIsaUJBQWlCLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1lBQzFDLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsaUJBQWlCLENBQUMsQ0FBQyxDQUFDO0lBQ3pDLENBQUM7SUFFTyxNQUFNLENBQUMsaUJBQWlCLENBQUMsYUFBdUI7UUFDdEQsT0FBTyxhQUFhLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztlQUM3QixDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksYUFBYSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFTyxNQUFNLENBQUMsb0JBQW9CLENBQ2pDLGFBQXlDLEVBQ3pDLGVBQStCLEVBQy9CLE9BQWtDLEVBQ2xDLFVBQW9DO1FBRXBDLE1BQU0sWUFBWSxHQUFHLElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxhQUFhLElBQUksRUFBRSxDQUFDLENBQUM7UUFDckUsTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBRW5FLElBQUksT0FBTyxDQUFDLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNwQyxjQUFjLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdEUsQ0FBQztRQUNELElBQUksT0FBTyxDQUFDLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN6QyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsdUJBQXVCLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzVFLElBQUksY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUNqQyxPQUFPLGNBQWMsQ0FBQyxjQUFjLENBQUM7WUFDdkMsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGNBQWMsQ0FBQyxjQUFjLEdBQUcsY0FBYyxDQUFDO1lBQ2pELENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsVUFBVSxFQUFFLFlBQVksSUFBSSxjQUFjLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDakUsY0FBYyxDQUFDLFNBQVMsR0FBRztnQkFDekIsR0FBRyxjQUFjLENBQUMsU0FBUztnQkFDM0IsWUFBWSxFQUFFLE9BQU8sQ0FBQyxVQUFVLENBQUMsWUFBWTthQUM5QyxDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksVUFBVSxFQUFFLFNBQVMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUN4QyxjQUFjLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDekUsQ0FBQztRQUNELElBQUksVUFBVSxFQUFFLGNBQWMsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUM3QyxNQUFNLGNBQWMsR0FBRyxJQUFJLENBQUMsdUJBQXVCLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQy9FLElBQUksY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO2dCQUNqQyxPQUFPLGNBQWMsQ0FBQyxjQUFjLENBQUM7WUFDdkMsQ0FBQztpQkFBTSxDQUFDO2dCQUNOLGNBQWMsQ0FBQyxjQUFjLEdBQUcsY0FBYyxDQUFDO1lBQ2pELENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxVQUFVLEVBQUUsVUFBVSxFQUFFLFlBQVksSUFBSSxjQUFjLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDckUsY0FBYyxDQUFDLFNBQVMsR0FBRztnQkFDekIsR0FBRyxjQUFjLENBQUMsU0FBUztnQkFDM0IsWUFBWSxFQUFFLFVBQVUsQ0FBQyxVQUFVLENBQUMsWUFBWTthQUNqRCxDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sY0FBYyxHQUFHLElBQUksQ0FBQyw0QkFBNEIsQ0FBQztZQUN2RCxHQUFHLFlBQVk7WUFDZixHQUFHLGNBQWM7U0FDbEIsQ0FBQyxDQUFDO1FBRUgsT0FBTyxJQUFJLENBQUMsZUFBZSxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLGNBQWMsQ0FBQztJQUMzRSxDQUFDO0lBRU8sTUFBTSxDQUFDLHFCQUFxQixDQUFDLFFBQXdCO1FBQzNELE1BQU0sRUFBRSxXQUFXLEVBQUUsWUFBWSxFQUFFLEdBQUcsUUFBUSxFQUFFLEdBQUcsUUFBUSxDQUFDO1FBQzVELE9BQU8sSUFBSSxDQUFDLDRCQUE0QixDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3JELENBQUM7Q0FDRiJ9

package/dist_ts/config/index.d.ts

@@ -3,5 +3,6 @@ export { RouteConfigManager } from './classes.route-config-manager.js';
 export { ApiTokenManager } from './classes.api-token-manager.js';
 export { GatewayClientManager } from './classes.gateway-client-manager.js';
 export { ReferenceResolver } from './classes.reference-resolver.js';
+export { SourcePolicyCompiler } from './classes.source-policy-compiler.js';
 export { DbSeeder } from './classes.db-seeder.js';
 export { TargetProfileManager } from './classes.target-profile-manager.js';

package/dist_ts/config/index.js

@@ -4,6 +4,7 @@ export { RouteConfigManager } from './classes.route-config-manager.js';
 export { ApiTokenManager } from './classes.api-token-manager.js';
 export { GatewayClientManager } from './classes.gateway-client-manager.js';
 export { ReferenceResolver } from './classes.reference-resolver.js';
+export { SourcePolicyCompiler } from './classes.source-policy-compiler.js';
 export { DbSeeder } from './classes.db-seeder.js';
 export { TargetProfileManager } from './classes.target-profile-manager.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9jb25maWcvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0JBQStCO0FBQy9CLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUNBQW1DLENBQUM7QUFDdkUsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQ2pFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHFDQUFxQyxDQUFDO0FBQzNFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3BFLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxxQ0FBcUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9jb25maWcvaW5kZXgudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsK0JBQStCO0FBQy9CLGNBQWMsZ0JBQWdCLENBQUM7QUFDL0IsT0FBTyxFQUFFLGtCQUFrQixFQUFFLE1BQU0sbUNBQW1DLENBQUM7QUFDdkUsT0FBTyxFQUFFLGVBQWUsRUFBRSxNQUFNLGdDQUFnQyxDQUFDO0FBQ2pFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHFDQUFxQyxDQUFDO0FBQzNFLE9BQU8sRUFBRSxpQkFBaUIsRUFBRSxNQUFNLGlDQUFpQyxDQUFDO0FBQ3BFLE9BQU8sRUFBRSxvQkFBb0IsRUFBRSxNQUFNLHFDQUFxQyxDQUFDO0FBQzNFLE9BQU8sRUFBRSxRQUFRLEVBQUUsTUFBTSx3QkFBd0IsQ0FBQztBQUNsRCxPQUFPLEVBQUUsb0JBQW9CLEVBQUUsTUFBTSxxQ0FBcUMsQ0FBQyJ9

package/dist_ts_interfaces/data/route-management.d.ts

@@ -45,6 +45,43 @@ export interface ISourceProfile {
     updatedAt: number;
     createdBy: string;
 }
+export interface IRouteSourcePolicyExceededAction {
+    type: '429';
+    errorMessage?: string;
+}
+export declare const routePathClasses: readonly ["git-smart-http", "static", "normal-html", "expensive-html", "raw", "archive"];
+export type TRoutePathClass = typeof routePathClasses[number];
+export declare const giteaRoutePathClassLabels: Record<TRoutePathClass, string>;
+export declare const giteaRoutePathClassPatterns: Record<TRoutePathClass, string[]>;
+export interface IRoutePathPolicyBinding {
+    id?: string;
+    pathClass: TRoutePathClass;
+    /** Optional custom patterns. When omitted, the Gitea defaults for the class are used. */
+    pathPatterns?: string[];
+    /** Optional path-class override for the source binding's rate limit. */
+    rateLimit?: IRouteSecurity['rateLimit'];
+    /** Optional path-class override for the source binding's connection limit. */
+    maxConnections?: IRouteSecurity['maxConnections'];
+    onExceeded?: IRouteSourcePolicyExceededAction;
+}
+export interface IRouteSourcePolicyBinding {
+    id?: string;
+    sourceProfileRef: string;
+    /** Snapshot of the profile name at resolution time, for display. */
+    sourceProfileName?: string;
+    /** Optional route-level override for the referenced profile's rate limit. */
+    rateLimit?: IRouteSecurity['rateLimit'];
+    /** Optional route-level override for the referenced profile's connection limit. */
+    maxConnections?: IRouteSecurity['maxConnections'];
+    /** Initial source-policy slice only supports explicit 429 behavior. */
+    onExceeded?: IRouteSourcePolicyExceededAction;
+    /** Optional path-class variants inside this source binding. Path-specific variants win over fallback variants. */
+    pathPolicies?: IRoutePathPolicyBinding[];
+}
+export interface IRouteSourcePolicy {
+    /** Ordered source profile bindings. The first matching binding wins. */
+    bindings: IRouteSourcePolicyBinding[];
+}
 /**
  * A reusable, named network target (host + port) that can be referenced by routes.
  */
@@ -64,6 +101,8 @@ export interface INetworkTarget {
 export interface IRouteMetadata {
     /** ID of the SourceProfileDoc used to resolve this route's security. */
     sourceProfileRef?: string;
+    /** Ordered source policy. When present, it supersedes sourceProfileRef. */
+    sourcePolicy?: IRouteSourcePolicy;
     /** ID of the NetworkTargetDoc used to resolve this route's targets. */
     networkTargetRef?: string;
     /** Snapshot of the profile name at resolution time, for display. */