@serve.zone/dcrouter 17.2.4 → 17.3.0

package/dist_ts/config/classes.api-token-manager.js

@@ -4,8 +4,10 @@ import { ApiTokenDoc } from '../db/index.js';
 const TOKEN_PREFIX_STR = 'dcr_';
 const ENV_ADMIN_TOKEN_ID = 'env-admin-token';
 const ENV_ADMIN_TOKEN_CREATED_BY = 'dcrouter-env';
+const LAST_USED_PERSIST_INTERVAL_MS = 60_000;
 export class ApiTokenManager {
     tokens = new Map();
+    lastUsedPersistedAt = new Map();
     constructor() { }
     async initialize() {
         await this.loadTokens();
@@ -20,7 +22,7 @@ export class ApiTokenManager {
     /**
      * Create a new API token. Returns the raw token value (shown once).
      */
-    async createToken(name, scopes, expiresInDays, createdBy, policy) {
+    async createToken(name, scopes, expiresInDays, createdBy, policy, gatewayCredentialLifecycle = null) {
         const id = plugins.uuid.v4();
         const randomBytes = plugins.crypto.randomBytes(32);
         const rawPayload = `${id}:${randomBytes.toString('base64url')}`;
@@ -33,6 +35,7 @@ export class ApiTokenManager {
             tokenHash,
             scopes,
             policy,
+            gatewayCredentialLifecycle: this.normalizeGatewayCredentialLifecycle(gatewayCredentialLifecycle, id),
             createdAt: now,
             expiresAt: expiresInDays != null ? now + expiresInDays * 86400000 : null,
             lastUsedAt: null,
@@ -44,6 +47,24 @@ export class ApiTokenManager {
         logger.log('info', `API token '${name}' created (id: ${id})`);
         return { id, rawToken };
     }
+    async createProvisionedGatewayCredentialCandidate(name, scopes, expiresInDays, createdBy, policy, credentialSequence, policyDigest) {
+        if (policy.role !== 'gatewayClient' || !policy.gatewayClient?.id
+            || !Number.isSafeInteger(policy.gatewayClient.policyGeneration)
+            || !Number.isSafeInteger(credentialSequence) || credentialSequence < 1
+            || !/^[a-f0-9]{64}$/.test(policyDigest)) {
+            throw new Error('Provisioned gateway credentials require a bound gateway-client policy');
+        }
+        return await this.createToken(name, scopes, expiresInDays, createdBy, policy, {
+            source: 'provisioned',
+            state: 'candidate',
+            sequence: credentialSequence,
+            policyGeneration: policy.gatewayClient.policyGeneration,
+            policyDigest,
+            finalizedAt: null,
+            cleanupCompletedAt: null,
+            revokedCredentialCount: null,
+        });
+    }
     /**
      * Validate a raw token string. Returns the stored token if valid, null otherwise.
      * Also updates lastUsedAt.
@@ -58,9 +79,19 @@ export class ApiTokenManager {
                     return null;
                 if (stored.expiresAt !== null && stored.expiresAt < Date.now())
                     return null;
-                // Update lastUsedAt (fire and forget)
-                stored.lastUsedAt = Date.now();
-                this.persistToken(stored).catch(() => { });
+                const now = Date.now();
+                stored.lastUsedAt = now;
+                const persistedAt = this.lastUsedPersistedAt.get(stored.id) || 0;
+                if (now - persistedAt >= LAST_USED_PERSIST_INTERVAL_MS) {
+                    this.lastUsedPersistedAt.set(stored.id, now);
+                    try {
+                        await this.persistToken(stored);
+                    }
+                    catch (error) {
+                        this.lastUsedPersistedAt.set(stored.id, persistedAt);
+                        throw error;
+                    }
+                }
                 return stored;
             }
         }
@@ -121,13 +152,123 @@ export class ApiTokenManager {
         if (!this.tokens.has(id))
             return false;
         const token = this.tokens.get(id);
-        this.tokens.delete(id);
+        // Disable durably before deletion so a failed delete cannot resurrect the
+        // credential after a restart.
+        token.enabled = false;
+        await this.persistToken(token);
         const doc = await ApiTokenDoc.findById(id);
         if (doc)
             await doc.delete();
+        this.tokens.delete(id);
+        this.lastUsedPersistedAt.delete(id);
         logger.log('info', `API token '${token.name}' revoked (id: ${id})`);
         return true;
     }
+    /** Revoke only ordinary gateway-client credentials bound to one live client. */
+    async revokeGatewayClientCredentials(gatewayClientId, excludingTokenId) {
+        const ids = Array.from(this.tokens.values())
+            .filter((token) => token.id !== excludingTokenId)
+            .filter((token) => token.id !== ENV_ADMIN_TOKEN_ID)
+            .filter((token) => token.policy?.role === 'gatewayClient')
+            .filter((token) => token.policy?.gatewayClient?.id === gatewayClientId)
+            .map((token) => token.id);
+        let revoked = 0;
+        for (const id of ids) {
+            if (await this.revokeToken(id))
+                revoked++;
+        }
+        return revoked;
+    }
+    /** Revoke only older provisioned credentials during a finalized handover. */
+    async revokeOlderProvisionedGatewayCredentials(gatewayClientId, finalizedSequence, excludingTokenId) {
+        if (!Number.isSafeInteger(finalizedSequence) || finalizedSequence < 1) {
+            throw new Error('Gateway credential finalization sequence is invalid');
+        }
+        const ids = Array.from(this.tokens.values())
+            .filter((token) => token.id !== excludingTokenId)
+            .filter((token) => token.policy?.role === 'gatewayClient')
+            .filter((token) => token.policy?.gatewayClient?.id === gatewayClientId)
+            .filter((token) => token.gatewayCredentialLifecycle?.source === 'provisioned')
+            .filter((token) => Number(token.gatewayCredentialLifecycle?.sequence) < finalizedSequence)
+            .map((token) => token.id);
+        let revoked = 0;
+        for (const id of ids) {
+            if (await this.revokeToken(id))
+                revoked++;
+        }
+        return revoked;
+    }
+    /** Durably activate a provisioned candidate while preserving retry identity. */
+    async activateProvisionedGatewayCredential(tokenId, gatewayClientId) {
+        const token = this.tokens.get(tokenId);
+        if (!token || token.policy?.role !== 'gatewayClient'
+            || token.policy.gatewayClient?.id !== gatewayClientId) {
+            throw new Error('Provisioned gateway credential is missing or has the wrong owner');
+        }
+        const lifecycle = this.normalizeGatewayCredentialLifecycle(token.gatewayCredentialLifecycle, token.id);
+        if (!lifecycle) {
+            throw new Error('Manual gateway credentials cannot be finalized');
+        }
+        if (lifecycle.state === 'active') {
+            return {
+                finalizedAt: lifecycle.finalizedAt,
+                wasAlreadyActive: true,
+                lifecycle,
+            };
+        }
+        const previousLifecycle = lifecycle;
+        const finalizedAt = Date.now();
+        token.gatewayCredentialLifecycle = {
+            ...lifecycle,
+            state: 'active',
+            finalizedAt,
+            cleanupCompletedAt: null,
+            revokedCredentialCount: null,
+        };
+        try {
+            await this.persistToken(token);
+        }
+        catch (error) {
+            token.gatewayCredentialLifecycle = previousLifecycle;
+            throw error;
+        }
+        return {
+            finalizedAt,
+            wasAlreadyActive: false,
+            lifecycle: token.gatewayCredentialLifecycle,
+        };
+    }
+    /** Mark sibling cleanup complete so later retries never touch newer tokens. */
+    async completeProvisionedGatewayCredentialHandover(tokenId, gatewayClientId, revokedCredentialCount) {
+        const token = this.tokens.get(tokenId);
+        if (!token || token.policy?.role !== 'gatewayClient'
+            || token.policy.gatewayClient?.id !== gatewayClientId) {
+            throw new Error('Provisioned gateway credential is missing or has the wrong owner');
+        }
+        const lifecycle = this.normalizeGatewayCredentialLifecycle(token.gatewayCredentialLifecycle, token.id);
+        if (!lifecycle || lifecycle.state !== 'active') {
+            throw new Error('Provisioned gateway credential is not active');
+        }
+        if (lifecycle.cleanupCompletedAt !== null)
+            return lifecycle;
+        if (!Number.isSafeInteger(revokedCredentialCount) || revokedCredentialCount < 0) {
+            throw new Error('Revoked credential count is invalid');
+        }
+        const previousLifecycle = lifecycle;
+        token.gatewayCredentialLifecycle = {
+            ...lifecycle,
+            cleanupCompletedAt: Date.now(),
+            revokedCredentialCount,
+        };
+        try {
+            await this.persistToken(token);
+        }
+        catch (error) {
+            token.gatewayCredentialLifecycle = previousLifecycle;
+            throw error;
+        }
+        return token.gatewayCredentialLifecycle;
+    }
     /**
      * Roll (regenerate) a token's secret while keeping its identity.
      * Returns the new raw token value (shown once).
@@ -169,12 +310,14 @@ export class ApiTokenManager {
                     tokenHash: doc.tokenHash,
                     scopes: doc.scopes,
                     policy: doc.policy,
+                    gatewayCredentialLifecycle: this.normalizeGatewayCredentialLifecycle(doc.gatewayCredentialLifecycle, doc.id),
                     createdAt: doc.createdAt,
                     expiresAt: doc.expiresAt,
                     lastUsedAt: doc.lastUsedAt,
                     createdBy: doc.createdBy,
                     enabled: doc.enabled,
                 });
+                this.lastUsedPersistedAt.set(doc.id, doc.lastUsedAt || 0);
             }
         }
     }
@@ -196,6 +339,7 @@ export class ApiTokenManager {
             tokenHash: this.hashToken(rawToken),
             scopes: ['*'],
             policy: { role: 'admin' },
+            gatewayCredentialLifecycle: null,
             createdAt: existing?.createdAt || now,
             expiresAt: null,
             lastUsedAt: existing?.lastUsedAt || null,
@@ -206,6 +350,55 @@ export class ApiTokenManager {
         await this.persistToken(stored);
         logger.log('info', `Environment admin API token ensured (id: ${stored.id})`);
     }
+    normalizeGatewayCredentialLifecycle(valueArg, tokenIdArg) {
+        if (valueArg == null)
+            return null;
+        if (typeof valueArg !== 'object' || Array.isArray(valueArg)) {
+            throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+        }
+        const value = valueArg;
+        if (value.source !== 'provisioned') {
+            throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+        }
+        if (!Number.isSafeInteger(value.sequence) || Number(value.sequence) < 1
+            || !Number.isSafeInteger(value.policyGeneration) || Number(value.policyGeneration) < 1
+            || typeof value.policyDigest !== 'string' || !/^[a-f0-9]{64}$/.test(value.policyDigest)) {
+            throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+        }
+        const base = {
+            source: 'provisioned',
+            sequence: Number(value.sequence),
+            policyGeneration: Number(value.policyGeneration),
+            policyDigest: value.policyDigest,
+        };
+        if (value.state === 'candidate' && value.finalizedAt === null
+            && value.cleanupCompletedAt === null && value.revokedCredentialCount === null) {
+            return {
+                ...base,
+                state: 'candidate',
+                finalizedAt: null,
+                cleanupCompletedAt: null,
+                revokedCredentialCount: null,
+            };
+        }
+        if (value.state === 'active' && Number.isSafeInteger(value.finalizedAt) && Number(value.finalizedAt) > 0) {
+            const cleanupPending = value.cleanupCompletedAt === null && value.revokedCredentialCount === null;
+            const cleanupComplete = Number.isSafeInteger(value.cleanupCompletedAt)
+                && Number(value.cleanupCompletedAt) > 0
+                && Number.isSafeInteger(value.revokedCredentialCount)
+                && Number(value.revokedCredentialCount) >= 0;
+            if (cleanupPending || cleanupComplete) {
+                return {
+                    ...base,
+                    state: 'active',
+                    finalizedAt: Number(value.finalizedAt),
+                    cleanupCompletedAt: cleanupComplete ? Number(value.cleanupCompletedAt) : null,
+                    revokedCredentialCount: cleanupComplete ? Number(value.revokedCredentialCount) : null,
+                };
+            }
+        }
+        throw new Error(`API token '${tokenIdArg}' has malformed gateway credential lifecycle`);
+    }
     hashToken(rawToken) {
         return plugins.crypto.createHash('sha256').update(rawToken).digest('hex');
     }
@@ -216,6 +409,7 @@ export class ApiTokenManager {
             existing.tokenHash = stored.tokenHash;
             existing.scopes = stored.scopes;
             existing.policy = stored.policy;
+            existing.gatewayCredentialLifecycle = stored.gatewayCredentialLifecycle ?? null;
             existing.createdAt = stored.createdAt;
             existing.expiresAt = stored.expiresAt;
             existing.lastUsedAt = stored.lastUsedAt;
@@ -230,6 +424,7 @@ export class ApiTokenManager {
             doc.tokenHash = stored.tokenHash;
             doc.scopes = stored.scopes;
             doc.policy = stored.policy;
+            doc.gatewayCredentialLifecycle = stored.gatewayCredentialLifecycle ?? null;
             doc.createdAt = stored.createdAt;
             doc.expiresAt = stored.expiresAt;
             doc.lastUsedAt = stored.lastUsedAt;
@@ -239,4 +434,4 @@ export class ApiTokenManager {
         }
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hcGktdG9rZW4tbWFuYWdlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL2NvbmZpZy9jbGFzc2VzLmFwaS10b2tlbi1tYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBQ3pDLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDdEMsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBUTdDLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDO0FBQ2hDLE1BQU0sa0JBQWtCLEdBQUcsaUJBQWlCLENBQUM7QUFDN0MsTUFBTSwwQkFBMEIsR0FBRyxjQUFjLENBQUM7QUFFbEQsTUFBTSxPQUFPLGVBQWU7SUFDbEIsTUFBTSxHQUFHLElBQUksR0FBRyxFQUEyQixDQUFDO0lBRXBELGdCQUFlLENBQUM7SUFFVCxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUN4QixNQUFNLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQ2pDLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDekIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsVUFBVSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksNEJBQTRCLENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUVELDRFQUE0RTtJQUM1RSxrQkFBa0I7SUFDbEIsNEVBQTRFO0lBRTVFOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FDdEIsSUFBWSxFQUNaLE1BQXdCLEVBQ3hCLGFBQTRCLEVBQzVCLFNBQWlCLEVBQ2pCLE1BQXdCO1FBRXhCLE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDN0IsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkQsTUFBTSxVQUFVLEdBQUcsR0FBRyxFQUFFLElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sUUFBUSxHQUFHLEdBQUcsZ0JBQWdCLEdBQUcsVUFBVSxFQUFFLENBQUM7UUFFcEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUUzQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdkIsTUFBTSxNQUFNLEdBQW9CO1lBQzlCLEVBQUU7WUFDRixJQUFJO1lBQ0osU0FBUztZQUNULE1BQU07WUFDTixNQUFNO1lBQ04sU0FBUyxFQUFFLEdBQUc7WUFDZCxTQUFTLEVBQUUsYUFBYSxJQUFJLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxHQUFHLGFBQWEsR0FBRyxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDeEUsVUFBVSxFQUFFLElBQUk7WUFDaEIsU0FBUztZQUNULE9BQU8sRUFBRSxJQUFJO1NBQ2QsQ0FBQztRQUVGLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUM1QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsY0FBYyxJQUFJLGtCQUFrQixFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQzlELE9BQU8sRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQUMsUUFBZ0I7UUFDekMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUV4RCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXRDLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzFDLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDOUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO29CQUFFLE9BQU8sSUFBSSxDQUFDO2dCQUNqQyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRTtvQkFBRSxPQUFPLElBQUksQ0FBQztnQkFFNUUsc0NBQXNDO2dCQUN0QyxNQUFNLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDL0IsSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUUsQ0FBQyxDQUFDLENBQUM7Z0JBQzFDLE9BQU8sTUFBTSxDQUFDO1lBQ2hCLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7O09BRUc7SUFDSSxRQUFRLENBQUMsS0FBc0IsRUFBRSxLQUFxQjtRQUMzRCxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLE9BQU87WUFBRSxPQUFPLElBQUksQ0FBQztRQUVoRCxNQUFNLG9CQUFvQixHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLGVBQWUsQ0FBQztRQUNwRSxNQUFNLDBCQUEwQixHQUFHLElBQUksR0FBRyxDQUFpQjtZQUN6RCxzQkFBc0I7WUFDdEIsdUJBQXVCO1lBQ3ZCLGtCQUFrQjtZQUNsQixtQkFBbUI7U0FDcEIsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxvQkFBb0IsSUFBSSxDQUFDLDBCQUEwQixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ25FLE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUVELElBQUksQ0FBQyxvQkFBb0IsSUFBSSxLQUFLLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUVyRSxNQUFNLE1BQU0sR0FBRyxJQUFJLEdBQUcsQ0FBaUIsQ0FBQyxHQUFHLEtBQUssQ0FBQyxNQUFNLEVBQUUsR0FBRyxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsTUFBTSxJQUFJLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUMzRixJQUFJLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFFbkMsTUFBTSxnQkFBZ0IsR0FBc0Q7WUFDMUUsc0JBQXNCLEVBQUUsQ0FBQyxrQkFBa0IsQ0FBQztZQUM1Qyx1QkFBdUIsRUFBRSxDQUFDLG1CQUFtQixDQUFDO1lBQzlDLGtCQUFrQixFQUFFLENBQUMsc0JBQXNCLENBQUM7WUFDNUMsbUJBQW1CLEVBQUUsQ0FBQyx1QkFBdUIsQ0FBQztTQUMvQyxDQUFDO1FBQ0YsT0FBTyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxDQUFDLEVBQUUsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBRUQ7O09BRUc7SUFDSSxVQUFVO1FBQ2YsTUFBTSxNQUFNLEdBQW9CLEVBQUUsQ0FBQztRQUNuQyxLQUFLLE1BQU0sTUFBTSxJQUFJLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUMxQyxNQUFNLENBQUMsSUFBSSxDQUFDO2dCQUNWLEVBQUUsRUFBRSxNQUFNLENBQUMsRUFBRTtnQkFDYixJQUFJLEVBQUUsTUFBTSxDQUFDLElBQUk7Z0JBQ2pCLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTTtnQkFDckIsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNO2dCQUNyQixTQUFTLEVBQUUsTUFBTSxDQUFDLFNBQVM7Z0JBQzNCLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUztnQkFDM0IsVUFBVSxFQUFFLE1BQU0sQ0FBQyxVQUFVO2dCQUM3QixPQUFPLEVBQUUsTUFBTSxDQUFDLE9BQU87YUFDeEIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBVTtRQUNqQyxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDdkMsTUFBTSxLQUFLLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFFLENBQUM7UUFDbkMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdkIsTUFBTSxHQUFHLEdBQUcsTUFBTSxXQUFXLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQzNDLElBQUksR0FBRztZQUFFLE1BQU0sR0FBRyxDQUFDLE1BQU0sRUFBRSxDQUFDO1FBQzVCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLGNBQWMsS0FBSyxDQUFDLElBQUksa0JBQWtCLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDcEUsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLFNBQVMsQ0FBQyxFQUFVO1FBQy9CLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25DLElBQUksQ0FBQyxNQUFNO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFFekIsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkQsTUFBTSxVQUFVLEdBQUcsR0FBRyxFQUFFLElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sUUFBUSxHQUFHLEdBQUcsZ0JBQWdCLEdBQUcsVUFBVSxFQUFFLENBQUM7UUFFcEQsTUFBTSxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQzVDLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxjQUFjLE1BQU0sQ0FBQyxJQUFJLGlCQUFpQixFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3BFLE9BQU8sRUFBRSxFQUFFLEVBQUUsUUFBUSxFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFVLEVBQUUsT0FBZ0I7UUFDbkQsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkMsSUFBSSxDQUFDLE1BQU07WUFBRSxPQUFPLEtBQUssQ0FBQztRQUMxQixNQUFNLENBQUMsT0FBTyxHQUFHLE9BQU8sQ0FBQztRQUN6QixNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsY0FBYyxNQUFNLENBQUMsSUFBSSxLQUFLLE9BQU8sQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxVQUFVLFNBQVMsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNqRyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCw0RUFBNEU7SUFDNUUsVUFBVTtJQUNWLDRFQUE0RTtJQUVwRSxLQUFLLENBQUMsVUFBVTtRQUN0QixNQUFNLElBQUksR0FBRyxNQUFNLFdBQVcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUN6QyxLQUFLLE1BQU0sR0FBRyxJQUFJLElBQUksRUFBRSxDQUFDO1lBQ3ZCLElBQUksR0FBRyxDQUFDLEVBQUUsRUFBRSxDQUFDO2dCQUNYLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUU7b0JBQ3RCLEVBQUUsRUFBRSxHQUFHLENBQUMsRUFBRTtvQkFDVixJQUFJLEVBQUUsR0FBRyxDQUFDLElBQUk7b0JBQ2QsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTO29CQUN4QixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU07b0JBQ2xCLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtvQkFDbEIsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTO29CQUN4QixTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVM7b0JBQ3hCLFVBQVUsRUFBRSxHQUFHLENBQUMsVUFBVTtvQkFDMUIsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTO29CQUN4QixPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU87aUJBQ3JCLENBQUMsQ0FBQztZQUNMLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxtQkFBbUI7UUFDL0IsTUFBTSxRQUFRLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQyx3QkFBd0IsRUFBRSxJQUFJLEVBQUUsQ0FBQztRQUM5RCxJQUFJLENBQUMsUUFBUTtZQUFFLE9BQU87UUFFdEIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUMsRUFBRSxDQUFDO1lBQzNDLE1BQU0sSUFBSSxLQUFLLENBQUMsNENBQTRDLGdCQUFnQixFQUFFLENBQUMsQ0FBQztRQUNsRixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsTUFBTSxHQUFHLGdCQUFnQixDQUFDLE1BQU0sR0FBRyxFQUFFLEVBQUUsQ0FBQztZQUNuRCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUN2QixNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO1FBQ3JELE1BQU0sTUFBTSxHQUFvQjtZQUM5QixFQUFFLEVBQUUsa0JBQWtCO1lBQ3RCLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLDZCQUE2QixFQUFFLElBQUksRUFBRSxJQUFJLHlCQUF5QjtZQUNwRixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUM7WUFDbkMsTUFBTSxFQUFFLENBQUMsR0FBRyxDQUFDO1lBQ2IsTUFBTSxFQUFFLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRTtZQUN6QixTQUFTLEVBQUUsUUFBUSxFQUFFLFNBQVMsSUFBSSxHQUFHO1lBQ3JDLFNBQVMsRUFBRSxJQUFJO1lBQ2YsVUFBVSxFQUFFLFFBQVEsRUFBRSxVQUFVLElBQUksSUFBSTtZQUN4QyxTQUFTLEVBQUUsUUFBUSxFQUFFLFNBQVMsSUFBSSwwQkFBMEI7WUFDNUQsT0FBTyxFQUFFLElBQUk7U0FDZCxDQUFDO1FBRUYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNuQyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsNENBQTRDLE1BQU0sQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFTyxTQUFTLENBQUMsUUFBZ0I7UUFDaEMsT0FBTyxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDO0lBQzVFLENBQUM7SUFFTyxLQUFLLENBQUMsWUFBWSxDQUFDLE1BQXVCO1FBQ2hELE1BQU0sUUFBUSxHQUFHLE1BQU0sV0FBVyxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdkQsSUFBSSxRQUFRLEVBQUUsQ0FBQztZQUNiLFFBQVEsQ0FBQyxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztZQUM1QixRQUFRLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDdEMsUUFBUSxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQ2hDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNoQyxRQUFRLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDdEMsUUFBUSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQ3RDLFFBQVEsQ0FBQyxVQUFVLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQztZQUN4QyxRQUFRLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDdEMsUUFBUSxDQUFDLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1lBQ2xDLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3hCLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxHQUFHLEdBQUcsSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUM5QixHQUFHLENBQUMsRUFBRSxHQUFHLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDbkIsR0FBRyxDQUFDLElBQUksR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDO1lBQ3ZCLEdBQUcsQ0FBQyxTQUFTLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQztZQUNqQyxHQUFHLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDM0IsR0FBRyxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQzNCLEdBQUcsQ0FBQyxTQUFTLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQztZQUNqQyxHQUFHLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDakMsR0FBRyxDQUFDLFVBQVUsR0FBRyxNQUFNLENBQUMsVUFBVSxDQUFDO1lBQ25DLEdBQUcsQ0FBQyxTQUFTLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQztZQUNqQyxHQUFHLENBQUMsT0FBTyxHQUFHLE1BQU0sQ0FBQyxPQUFPLENBQUM7WUFDN0IsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDbkIsQ0FBQztJQUNILENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5hcGktdG9rZW4tbWFuYWdlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL2NvbmZpZy9jbGFzc2VzLmFwaS10b2tlbi1tYW5hZ2VyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sZUFBZSxDQUFDO0FBQ3pDLE9BQU8sRUFBRSxNQUFNLEVBQUUsTUFBTSxjQUFjLENBQUM7QUFDdEMsT0FBTyxFQUFFLFdBQVcsRUFBRSxNQUFNLGdCQUFnQixDQUFDO0FBUzdDLE1BQU0sZ0JBQWdCLEdBQUcsTUFBTSxDQUFDO0FBQ2hDLE1BQU0sa0JBQWtCLEdBQUcsaUJBQWlCLENBQUM7QUFDN0MsTUFBTSwwQkFBMEIsR0FBRyxjQUFjLENBQUM7QUFDbEQsTUFBTSw2QkFBNkIsR0FBRyxNQUFNLENBQUM7QUFFN0MsTUFBTSxPQUFPLGVBQWU7SUFDbEIsTUFBTSxHQUFHLElBQUksR0FBRyxFQUEyQixDQUFDO0lBQzVDLG1CQUFtQixHQUFHLElBQUksR0FBRyxFQUFrQixDQUFDO0lBRXhELGdCQUFlLENBQUM7SUFFVCxLQUFLLENBQUMsVUFBVTtRQUNyQixNQUFNLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUN4QixNQUFNLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1FBQ2pDLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDekIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsVUFBVSxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksNEJBQTRCLENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUVELDRFQUE0RTtJQUM1RSxrQkFBa0I7SUFDbEIsNEVBQTRFO0lBRTVFOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FDdEIsSUFBWSxFQUNaLE1BQXdCLEVBQ3hCLGFBQTRCLEVBQzVCLFNBQWlCLEVBQ2pCLE1BQXdCLEVBQ3hCLDZCQUFpRSxJQUFJO1FBRXJFLE1BQU0sRUFBRSxHQUFHLE9BQU8sQ0FBQyxJQUFJLENBQUMsRUFBRSxFQUFFLENBQUM7UUFDN0IsTUFBTSxXQUFXLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkQsTUFBTSxVQUFVLEdBQUcsR0FBRyxFQUFFLElBQUksV0FBVyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2hFLE1BQU0sUUFBUSxHQUFHLEdBQUcsZ0JBQWdCLEdBQUcsVUFBVSxFQUFFLENBQUM7UUFFcEQsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUUzQyxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdkIsTUFBTSxNQUFNLEdBQW9CO1lBQzlCLEVBQUU7WUFDRixJQUFJO1lBQ0osU0FBUztZQUNULE1BQU07WUFDTixNQUFNO1lBQ04sMEJBQTBCLEVBQUUsSUFBSSxDQUFDLG1DQUFtQyxDQUFDLDBCQUEwQixFQUFFLEVBQUUsQ0FBQztZQUNwRyxTQUFTLEVBQUUsR0FBRztZQUNkLFNBQVMsRUFBRSxhQUFhLElBQUksSUFBSSxDQUFDLENBQUMsQ0FBQyxHQUFHLEdBQUcsYUFBYSxHQUFHLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUN4RSxVQUFVLEVBQUUsSUFBSTtZQUNoQixTQUFTO1lBQ1QsT0FBTyxFQUFFLElBQUk7U0FDZCxDQUFDO1FBRUYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQzVCLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNoQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxjQUFjLElBQUksa0JBQWtCLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDOUQsT0FBTyxFQUFFLEVBQUUsRUFBRSxRQUFRLEVBQUUsQ0FBQztJQUMxQixDQUFDO0lBRU0sS0FBSyxDQUFDLDJDQUEyQyxDQUN0RCxJQUFZLEVBQ1osTUFBd0IsRUFDeEIsYUFBNEIsRUFDNUIsU0FBaUIsRUFDakIsTUFBdUIsRUFDdkIsa0JBQTBCLEVBQzFCLFlBQW9CO1FBRXBCLElBQUksTUFBTSxDQUFDLElBQUksS0FBSyxlQUFlLElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxFQUFFLEVBQUU7ZUFDM0QsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLENBQUM7ZUFDNUQsQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGtCQUFrQixDQUFDLElBQUksa0JBQWtCLEdBQUcsQ0FBQztlQUNuRSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQzFDLE1BQU0sSUFBSSxLQUFLLENBQUMsdUVBQXVFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsT0FBTyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsSUFBSSxFQUFFLE1BQU0sRUFBRSxhQUFhLEVBQUUsU0FBUyxFQUFFLE1BQU0sRUFBRTtZQUM1RSxNQUFNLEVBQUUsYUFBYTtZQUNyQixLQUFLLEVBQUUsV0FBVztZQUNsQixRQUFRLEVBQUUsa0JBQWtCO1lBQzVCLGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxhQUFhLENBQUMsZ0JBQWdCO1lBQ3ZELFlBQVk7WUFDWixXQUFXLEVBQUUsSUFBSTtZQUNqQixrQkFBa0IsRUFBRSxJQUFJO1lBQ3hCLHNCQUFzQixFQUFFLElBQUk7U0FDN0IsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQUMsUUFBZ0I7UUFDekMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsZ0JBQWdCLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUV4RCxNQUFNLElBQUksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBRXRDLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzFDLElBQUksTUFBTSxDQUFDLFNBQVMsS0FBSyxJQUFJLEVBQUUsQ0FBQztnQkFDOUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPO29CQUFFLE9BQU8sSUFBSSxDQUFDO2dCQUNqQyxJQUFJLE1BQU0sQ0FBQyxTQUFTLEtBQUssSUFBSSxJQUFJLE1BQU0sQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRTtvQkFBRSxPQUFPLElBQUksQ0FBQztnQkFFNUUsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO2dCQUN2QixNQUFNLENBQUMsVUFBVSxHQUFHLEdBQUcsQ0FBQztnQkFDeEIsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLElBQUksQ0FBQyxDQUFDO2dCQUNqRSxJQUFJLEdBQUcsR0FBRyxXQUFXLElBQUksNkJBQTZCLEVBQUUsQ0FBQztvQkFDdkQsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLEdBQUcsQ0FBQyxDQUFDO29CQUM3QyxJQUFJLENBQUM7d0JBQ0gsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO29CQUNsQyxDQUFDO29CQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7d0JBQ2YsSUFBSSxDQUFDLG1CQUFtQixDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLFdBQVcsQ0FBQyxDQUFDO3dCQUNyRCxNQUFNLEtBQUssQ0FBQztvQkFDZCxDQUFDO2dCQUNILENBQUM7Z0JBQ0QsT0FBTyxNQUFNLENBQUM7WUFDaEIsQ0FBQztRQUNILENBQUM7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRDs7T0FFRztJQUNJLFFBQVEsQ0FBQyxLQUFzQixFQUFFLEtBQXFCO1FBQzNELElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssT0FBTztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBRWhELE1BQU0sb0JBQW9CLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssZUFBZSxDQUFDO1FBQ3BFLE1BQU0sMEJBQTBCLEdBQUcsSUFBSSxHQUFHLENBQWlCO1lBQ3pELHNCQUFzQjtZQUN0Qix1QkFBdUI7WUFDdkIsa0JBQWtCO1lBQ2xCLG1CQUFtQjtTQUNwQixDQUFDLENBQUM7UUFDSCxJQUFJLG9CQUFvQixJQUFJLENBQUMsMEJBQTBCLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDbkUsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBRUQsSUFBSSxDQUFDLG9CQUFvQixJQUFJLEtBQUssQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQztZQUFFLE9BQU8sSUFBSSxDQUFDO1FBRXJFLE1BQU0sTUFBTSxHQUFHLElBQUksR0FBRyxDQUFpQixDQUFDLEdBQUcsS0FBSyxDQUFDLE1BQU0sRUFBRSxHQUFHLENBQUMsS0FBSyxDQUFDLE1BQU0sRUFBRSxNQUFNLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQzNGLElBQUksTUFBTSxDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUVuQyxNQUFNLGdCQUFnQixHQUFzRDtZQUMxRSxzQkFBc0IsRUFBRSxDQUFDLGtCQUFrQixDQUFDO1lBQzVDLHVCQUF1QixFQUFFLENBQUMsbUJBQW1CLENBQUM7WUFDOUMsa0JBQWtCLEVBQUUsQ0FBQyxzQkFBc0IsQ0FBQztZQUM1QyxtQkFBbUIsRUFBRSxDQUFDLHVCQUF1QixDQUFDO1NBQy9DLENBQUM7UUFDRixPQUFPLE9BQU8sQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFFRDs7T0FFRztJQUNJLFVBQVU7UUFDZixNQUFNLE1BQU0sR0FBb0IsRUFBRSxDQUFDO1FBQ25DLEtBQUssTUFBTSxNQUFNLElBQUksSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDO1lBQzFDLE1BQU0sQ0FBQyxJQUFJLENBQUM7Z0JBQ1YsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFO2dCQUNiLElBQUksRUFBRSxNQUFNLENBQUMsSUFBSTtnQkFDakIsTUFBTSxFQUFFLE1BQU0sQ0FBQyxNQUFNO2dCQUNyQixNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07Z0JBQ3JCLFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUztnQkFDM0IsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTO2dCQUMzQixVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVU7Z0JBQzdCLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTzthQUN4QixDQUFDLENBQUM7UUFDTCxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVEOztPQUVHO0lBQ0ksS0FBSyxDQUFDLFdBQVcsQ0FBQyxFQUFVO1FBQ2pDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUN2QyxNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUUsQ0FBQztRQUNuQywwRUFBMEU7UUFDMUUsOEJBQThCO1FBQzlCLEtBQUssQ0FBQyxPQUFPLEdBQUcsS0FBSyxDQUFDO1FBQ3RCLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUMvQixNQUFNLEdBQUcsR0FBRyxNQUFNLFdBQVcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDM0MsSUFBSSxHQUFHO1lBQUUsTUFBTSxHQUFHLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDNUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDdkIsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNwQyxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxjQUFjLEtBQUssQ0FBQyxJQUFJLGtCQUFrQixFQUFFLEdBQUcsQ0FBQyxDQUFDO1FBQ3BFLE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELGdGQUFnRjtJQUN6RSxLQUFLLENBQUMsOEJBQThCLENBQ3pDLGVBQXVCLEVBQ3ZCLGdCQUF5QjtRQUV6QixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsTUFBTSxFQUFFLENBQUM7YUFDekMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxLQUFLLGdCQUFnQixDQUFDO2FBQ2hELE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxrQkFBa0IsQ0FBQzthQUNsRCxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLGVBQWUsQ0FBQzthQUN6RCxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsYUFBYSxFQUFFLEVBQUUsS0FBSyxlQUFlLENBQUM7YUFDdEUsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDNUIsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDO1FBQ2hCLEtBQUssTUFBTSxFQUFFLElBQUksR0FBRyxFQUFFLENBQUM7WUFDckIsSUFBSSxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1FBQzVDLENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsNkVBQTZFO0lBQ3RFLEtBQUssQ0FBQyx3Q0FBd0MsQ0FDbkQsZUFBdUIsRUFDdkIsaUJBQXlCLEVBQ3pCLGdCQUF3QjtRQUV4QixJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLGlCQUFpQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3RFLE1BQU0sSUFBSSxLQUFLLENBQUMscURBQXFELENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQ0QsTUFBTSxHQUFHLEdBQUcsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO2FBQ3pDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEVBQUUsS0FBSyxnQkFBZ0IsQ0FBQzthQUNoRCxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLGVBQWUsQ0FBQzthQUN6RCxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxNQUFNLEVBQUUsYUFBYSxFQUFFLEVBQUUsS0FBSyxlQUFlLENBQUM7YUFDdEUsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsMEJBQTBCLEVBQUUsTUFBTSxLQUFLLGFBQWEsQ0FBQzthQUM3RSxNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsMEJBQTBCLEVBQUUsUUFBUSxDQUFDLEdBQUcsaUJBQWlCLENBQUM7YUFDekYsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDNUIsSUFBSSxPQUFPLEdBQUcsQ0FBQyxDQUFDO1FBQ2hCLEtBQUssTUFBTSxFQUFFLElBQUksR0FBRyxFQUFFLENBQUM7WUFDckIsSUFBSSxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2dCQUFFLE9BQU8sRUFBRSxDQUFDO1FBQzVDLENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRUQsZ0ZBQWdGO0lBQ3pFLEtBQUssQ0FBQyxvQ0FBb0MsQ0FDL0MsT0FBZSxFQUNmLGVBQXVCO1FBTXZCLE1BQU0sS0FBSyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxLQUFLLElBQUksS0FBSyxDQUFDLE1BQU0sRUFBRSxJQUFJLEtBQUssZUFBZTtlQUMvQyxLQUFLLENBQUMsTUFBTSxDQUFDLGFBQWEsRUFBRSxFQUFFLEtBQUssZUFBZSxFQUFFLENBQUM7WUFDeEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1FBQ3RGLENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxJQUFJLENBQUMsbUNBQW1DLENBQ3hELEtBQUssQ0FBQywwQkFBMEIsRUFDaEMsS0FBSyxDQUFDLEVBQUUsQ0FDVCxDQUFDO1FBQ0YsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxJQUFJLEtBQUssQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxJQUFJLFNBQVMsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDakMsT0FBTztnQkFDTCxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVk7Z0JBQ25DLGdCQUFnQixFQUFFLElBQUk7Z0JBQ3RCLFNBQVM7YUFDVixDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0saUJBQWlCLEdBQUcsU0FBUyxDQUFDO1FBQ3BDLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztRQUMvQixLQUFLLENBQUMsMEJBQTBCLEdBQUc7WUFDakMsR0FBRyxTQUFTO1lBQ1osS0FBSyxFQUFFLFFBQVE7WUFDZixXQUFXO1lBQ1gsa0JBQWtCLEVBQUUsSUFBSTtZQUN4QixzQkFBc0IsRUFBRSxJQUFJO1NBQzdCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixLQUFLLENBQUMsMEJBQTBCLEdBQUcsaUJBQWlCLENBQUM7WUFDckQsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTztZQUNMLFdBQVc7WUFDWCxnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLFNBQVMsRUFBRSxLQUFLLENBQUMsMEJBQTBCO1NBQzVDLENBQUM7SUFDSixDQUFDO0lBRUQsK0VBQStFO0lBQ3hFLEtBQUssQ0FBQyw0Q0FBNEMsQ0FDdkQsT0FBZSxFQUNmLGVBQXVCLEVBQ3ZCLHNCQUE4QjtRQUU5QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxNQUFNLEVBQUUsSUFBSSxLQUFLLGVBQWU7ZUFDL0MsS0FBSyxDQUFDLE1BQU0sQ0FBQyxhQUFhLEVBQUUsRUFBRSxLQUFLLGVBQWUsRUFBRSxDQUFDO1lBQ3hELE1BQU0sSUFBSSxLQUFLLENBQUMsa0VBQWtFLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQ0QsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLG1DQUFtQyxDQUN4RCxLQUFLLENBQUMsMEJBQTBCLEVBQ2hDLEtBQUssQ0FBQyxFQUFFLENBQ1QsQ0FBQztRQUNGLElBQUksQ0FBQyxTQUFTLElBQUksU0FBUyxDQUFDLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMvQyxNQUFNLElBQUksS0FBSyxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksU0FBUyxDQUFDLGtCQUFrQixLQUFLLElBQUk7WUFBRSxPQUFPLFNBQVMsQ0FBQztRQUM1RCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLHNCQUFzQixHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ2hGLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBQ0QsTUFBTSxpQkFBaUIsR0FBRyxTQUFTLENBQUM7UUFDcEMsS0FBSyxDQUFDLDBCQUEwQixHQUFHO1lBQ2pDLEdBQUcsU0FBUztZQUNaLGtCQUFrQixFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUU7WUFDOUIsc0JBQXNCO1NBQ3ZCLENBQUM7UUFDRixJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsS0FBSyxDQUFDLENBQUM7UUFDakMsQ0FBQztRQUFDLE9BQU8sS0FBSyxFQUFFLENBQUM7WUFDZixLQUFLLENBQUMsMEJBQTBCLEdBQUcsaUJBQWlCLENBQUM7WUFDckQsTUFBTSxLQUFLLENBQUM7UUFDZCxDQUFDO1FBQ0QsT0FBTyxLQUFLLENBQUMsMEJBQTBCLENBQUM7SUFDMUMsQ0FBQztJQUdEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxTQUFTLENBQUMsRUFBVTtRQUMvQixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNuQyxJQUFJLENBQUMsTUFBTTtZQUFFLE9BQU8sSUFBSSxDQUFDO1FBRXpCLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25ELE1BQU0sVUFBVSxHQUFHLEdBQUcsRUFBRSxJQUFJLFdBQVcsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLEVBQUUsQ0FBQztRQUNoRSxNQUFNLFFBQVEsR0FBRyxHQUFHLGdCQUFnQixHQUFHLFVBQVUsRUFBRSxDQUFDO1FBRXBELE1BQU0sQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUM1QyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsY0FBYyxNQUFNLENBQUMsSUFBSSxpQkFBaUIsRUFBRSxHQUFHLENBQUMsQ0FBQztRQUNwRSxPQUFPLEVBQUUsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFRDs7T0FFRztJQUNJLEtBQUssQ0FBQyxXQUFXLENBQUMsRUFBVSxFQUFFLE9BQWdCO1FBQ25ELE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ25DLElBQUksQ0FBQyxNQUFNO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDMUIsTUFBTSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDekIsTUFBTSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2hDLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLGNBQWMsTUFBTSxDQUFDLElBQUksS0FBSyxPQUFPLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsVUFBVSxTQUFTLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDakcsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsNEVBQTRFO0lBQzVFLFVBQVU7SUFDViw0RUFBNEU7SUFFcEUsS0FBSyxDQUFDLFVBQVU7UUFDdEIsTUFBTSxJQUFJLEdBQUcsTUFBTSxXQUFXLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDekMsS0FBSyxNQUFNLEdBQUcsSUFBSSxJQUFJLEVBQUUsQ0FBQztZQUN2QixJQUFJLEdBQUcsQ0FBQyxFQUFFLEVBQUUsQ0FBQztnQkFDWCxJQUFJLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFO29CQUN0QixFQUFFLEVBQUUsR0FBRyxDQUFDLEVBQUU7b0JBQ1YsSUFBSSxFQUFFLEdBQUcsQ0FBQyxJQUFJO29CQUNkLFNBQVMsRUFBRSxHQUFHLENBQUMsU0FBUztvQkFDeEIsTUFBTSxFQUFFLEdBQUcsQ0FBQyxNQUFNO29CQUNsQixNQUFNLEVBQUUsR0FBRyxDQUFDLE1BQU07b0JBQ2xCLDBCQUEwQixFQUFFLElBQUksQ0FBQyxtQ0FBbUMsQ0FBQyxHQUFHLENBQUMsMEJBQTBCLEVBQUUsR0FBRyxDQUFDLEVBQUUsQ0FBQztvQkFDNUcsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTO29CQUN4QixTQUFTLEVBQUUsR0FBRyxDQUFDLFNBQVM7b0JBQ3hCLFVBQVUsRUFBRSxHQUFHLENBQUMsVUFBVTtvQkFDMUIsU0FBUyxFQUFFLEdBQUcsQ0FBQyxTQUFTO29CQUN4QixPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU87aUJBQ3JCLENBQUMsQ0FBQztnQkFDSCxJQUFJLENBQUMsbUJBQW1CLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsR0FBRyxDQUFDLFVBQVUsSUFBSSxDQUFDLENBQUMsQ0FBQztZQUM1RCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFFTyxLQUFLLENBQUMsbUJBQW1CO1FBQy9CLE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsd0JBQXdCLEVBQUUsSUFBSSxFQUFFLENBQUM7UUFDOUQsSUFBSSxDQUFDLFFBQVE7WUFBRSxPQUFPO1FBRXRCLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLGdCQUFnQixDQUFDLEVBQUUsQ0FBQztZQUMzQyxNQUFNLElBQUksS0FBSyxDQUFDLDRDQUE0QyxnQkFBZ0IsRUFBRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLE1BQU0sR0FBRyxnQkFBZ0IsQ0FBQyxNQUFNLEdBQUcsRUFBRSxFQUFFLENBQUM7WUFDbkQsTUFBTSxJQUFJLEtBQUssQ0FBQyx1Q0FBdUMsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFFRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7UUFDdkIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsa0JBQWtCLENBQUMsQ0FBQztRQUNyRCxNQUFNLE1BQU0sR0FBb0I7WUFDOUIsRUFBRSxFQUFFLGtCQUFrQjtZQUN0QixJQUFJLEVBQUUsT0FBTyxDQUFDLEdBQUcsQ0FBQyw2QkFBNkIsRUFBRSxJQUFJLEVBQUUsSUFBSSx5QkFBeUI7WUFDcEYsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLENBQUMsUUFBUSxDQUFDO1lBQ25DLE1BQU0sRUFBRSxDQUFDLEdBQUcsQ0FBQztZQUNiLE1BQU0sRUFBRSxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUU7WUFDekIsMEJBQTBCLEVBQUUsSUFBSTtZQUNoQyxTQUFTLEVBQUUsUUFBUSxFQUFFLFNBQVMsSUFBSSxHQUFHO1lBQ3JDLFNBQVMsRUFBRSxJQUFJO1lBQ2YsVUFBVSxFQUFFLFFBQVEsRUFBRSxVQUFVLElBQUksSUFBSTtZQUN4QyxTQUFTLEVBQUUsUUFBUSxFQUFFLFNBQVMsSUFBSSwwQkFBMEI7WUFDNUQsT0FBTyxFQUFFLElBQUk7U0FDZCxDQUFDO1FBRUYsSUFBSSxDQUFDLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLEVBQUUsRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNuQyxNQUFNLElBQUksQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsNENBQTRDLE1BQU0sQ0FBQyxFQUFFLEdBQUcsQ0FBQyxDQUFDO0lBQy9FLENBQUM7SUFFTyxtQ0FBbUMsQ0FDekMsUUFBaUIsRUFDakIsVUFBa0I7UUFFbEIsSUFBSSxRQUFRLElBQUksSUFBSTtZQUFFLE9BQU8sSUFBSSxDQUFDO1FBQ2xDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztZQUM1RCxNQUFNLElBQUksS0FBSyxDQUFDLGNBQWMsVUFBVSw4Q0FBOEMsQ0FBQyxDQUFDO1FBQzFGLENBQUM7UUFDRCxNQUFNLEtBQUssR0FBRyxRQUFnRCxDQUFDO1FBQy9ELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxhQUFhLEVBQUUsQ0FBQztZQUNuQyxNQUFNLElBQUksS0FBSyxDQUFDLGNBQWMsVUFBVSw4Q0FBOEMsQ0FBQyxDQUFDO1FBQzFGLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsUUFBUSxDQUFDLElBQUksTUFBTSxDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDO2VBQ2xFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQztlQUNuRixPQUFPLEtBQUssQ0FBQyxZQUFZLEtBQUssUUFBUSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1lBQzFGLE1BQU0sSUFBSSxLQUFLLENBQUMsY0FBYyxVQUFVLDhDQUE4QyxDQUFDLENBQUM7UUFDMUYsQ0FBQztRQUNELE1BQU0sSUFBSSxHQUFHO1lBQ1gsTUFBTSxFQUFFLGFBQXNCO1lBQzlCLFFBQVEsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQztZQUNoQyxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLGdCQUFnQixDQUFDO1lBQ2hELFlBQVksRUFBRSxLQUFLLENBQUMsWUFBWTtTQUNqQyxDQUFDO1FBQ0YsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFdBQVcsSUFBSSxLQUFLLENBQUMsV0FBVyxLQUFLLElBQUk7ZUFDeEQsS0FBSyxDQUFDLGtCQUFrQixLQUFLLElBQUksSUFBSSxLQUFLLENBQUMsc0JBQXNCLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDaEYsT0FBTztnQkFDTCxHQUFHLElBQUk7Z0JBQ1AsS0FBSyxFQUFFLFdBQVc7Z0JBQ2xCLFdBQVcsRUFBRSxJQUFJO2dCQUNqQixrQkFBa0IsRUFBRSxJQUFJO2dCQUN4QixzQkFBc0IsRUFBRSxJQUFJO2FBQzdCLENBQUM7UUFDSixDQUFDO1FBQ0QsSUFBSSxLQUFLLENBQUMsS0FBSyxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQ3pHLE1BQU0sY0FBYyxHQUFHLEtBQUssQ0FBQyxrQkFBa0IsS0FBSyxJQUFJLElBQUksS0FBSyxDQUFDLHNCQUFzQixLQUFLLElBQUksQ0FBQztZQUNsRyxNQUFNLGVBQWUsR0FBRyxNQUFNLENBQUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQzttQkFDakUsTUFBTSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUM7bUJBQ3BDLE1BQU0sQ0FBQyxhQUFhLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDO21CQUNsRCxNQUFNLENBQUMsS0FBSyxDQUFDLHNCQUFzQixDQUFDLElBQUksQ0FBQyxDQUFDO1lBQy9DLElBQUksY0FBYyxJQUFJLGVBQWUsRUFBRSxDQUFDO2dCQUN0QyxPQUFPO29CQUNMLEdBQUcsSUFBSTtvQkFDUCxLQUFLLEVBQUUsUUFBUTtvQkFDZixXQUFXLEVBQUUsTUFBTSxDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUM7b0JBQ3RDLGtCQUFrQixFQUFFLGVBQWUsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLENBQUMsQ0FBQyxJQUFJO29CQUM3RSxzQkFBc0IsRUFBRSxlQUFlLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsc0JBQXNCLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSTtpQkFDdEYsQ0FBQztZQUNKLENBQUM7UUFDSCxDQUFDO1FBQ0QsTUFBTSxJQUFJLEtBQUssQ0FBQyxjQUFjLFVBQVUsOENBQThDLENBQUMsQ0FBQztJQUMxRixDQUFDO0lBRU8sU0FBUyxDQUFDLFFBQWdCO1FBQ2hDLE9BQU8sT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBRU8sS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUF1QjtRQUNoRCxNQUFNLFFBQVEsR0FBRyxNQUFNLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1FBQ3ZELElBQUksUUFBUSxFQUFFLENBQUM7WUFDYixRQUFRLENBQUMsSUFBSSxHQUFHLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFDNUIsUUFBUSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQ3RDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNoQyxRQUFRLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7WUFDaEMsUUFBUSxDQUFDLDBCQUEwQixHQUFHLE1BQU0sQ0FBQywwQkFBMEIsSUFBSSxJQUFJLENBQUM7WUFDaEYsUUFBUSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQ3RDLFFBQVEsQ0FBQyxTQUFTLEdBQUcsTUFBTSxDQUFDLFNBQVMsQ0FBQztZQUN0QyxRQUFRLENBQUMsVUFBVSxHQUFHLE1BQU0sQ0FBQyxVQUFVLENBQUM7WUFDeEMsUUFBUSxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQ3RDLFFBQVEsQ0FBQyxPQUFPLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQztZQUNsQyxNQUFNLFFBQVEsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN4QixDQUFDO2FBQU0sQ0FBQztZQUNOLE1BQU0sR0FBRyxHQUFHLElBQUksV0FBVyxFQUFFLENBQUM7WUFDOUIsR0FBRyxDQUFDLEVBQUUsR0FBRyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQ25CLEdBQUcsQ0FBQyxJQUFJLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQztZQUN2QixHQUFHLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDakMsR0FBRyxDQUFDLE1BQU0sR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO1lBQzNCLEdBQUcsQ0FBQyxNQUFNLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUMzQixHQUFHLENBQUMsMEJBQTBCLEdBQUcsTUFBTSxDQUFDLDBCQUEwQixJQUFJLElBQUksQ0FBQztZQUMzRSxHQUFHLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDakMsR0FBRyxDQUFDLFNBQVMsR0FBRyxNQUFNLENBQUMsU0FBUyxDQUFDO1lBQ2pDLEdBQUcsQ0FBQyxVQUFVLEdBQUcsTUFBTSxDQUFDLFVBQVUsQ0FBQztZQUNuQyxHQUFHLENBQUMsU0FBUyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUM7WUFDakMsR0FBRyxDQUFDLE9BQU8sR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDO1lBQzdCLE1BQU0sR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ25CLENBQUM7SUFDSCxDQUFDO0NBQ0YifQ==

package/dist_ts/config/classes.gateway-client-manager.d.ts

@@ -1,4 +1,12 @@
+import * as plugins from '../plugins.js';
 import type { IGatewayClient } from '../../dist_ts_interfaces/data/workhoster.js';
+import type { IGatewayCredentialLifecycle } from '../../dist_ts_interfaces/data/route-management.js';
+export interface IStagedGatewayClientProvisioning {
+    action: plugins.servezoneInterfaces.data.TGatewayClientProvisioningAction;
+    gatewayClient: IGatewayClient;
+    credentialSequence: number;
+    policyDigest: string;
+}
 export declare class GatewayClientManager {
     initialize(): Promise<void>;
     listClients(): Promise<IGatewayClient[]>;
@@ -12,11 +20,37 @@ export declare class GatewayClientManager {
         allowedRouteTargets?: IGatewayClient['allowedRouteTargets'];
         capabilities?: IGatewayClient['capabilities'];
         createdBy: string;
+        applyCapabilityDefaults?: boolean;
     }): Promise<IGatewayClient>;
-    updateClient(id: string, patch: Partial<Pick<IGatewayClient, 'name' | 'description' | 'hostnamePatterns' | 'allowedRouteTargets' | 'capabilities' | 'enabled'>>): Promise<IGatewayClient | null>;
+    updateClient(id: string, patch: Partial<Pick<IGatewayClient, 'name' | 'description' | 'hostnamePatterns' | 'allowedRouteTargets' | 'capabilities' | 'enabled'>>, options?: {
+        applyCapabilityDefaults?: boolean;
+    }): Promise<IGatewayClient | null>;
     deleteClient(id: string): Promise<boolean>;
+    upsertClient(spec: plugins.servezoneInterfaces.data.IGatewayClientProvisioningSpec, createdBy: string): Promise<{
+        action: plugins.servezoneInterfaces.data.TGatewayClientProvisioningAction;
+        gatewayClient: IGatewayClient;
+    }>;
+    /**
+     * Stage an idempotent provisioning policy without changing the live policy.
+     * Sequence gaps after a later credential write failure are intentional.
+     */
+    stageClientProvisioning(spec: plugins.servezoneInterfaces.data.IGatewayClientProvisioningSpec, stagedBy: string): Promise<IStagedGatewayClientProvisioning>;
+    /** Resolve the exact durable policy a provisioned credential was issued for. */
+    getClientForProvisionedCredential(idArg: string, typeArg: IGatewayClient['type'], lifecycleArg: IGatewayCredentialLifecycle): Promise<IGatewayClient | null>;
+    /** Promote only the pending policy owned by this exact credential sequence. */
+    promoteProvisionedPolicy(idArg: string, typeArg: IGatewayClient['type'], lifecycleArg: IGatewayCredentialLifecycle): Promise<IGatewayClient>;
+    digestPublicClientPolicy(clientArg: IGatewayClient): string;
     private normalizeId;
-    private normalizeStringList;
+    private normalizeHostnamePatterns;
+    private normalizeHostnamePattern;
     private normalizeAllowedRouteTargets;
+    private normalizeTargetHost;
+    private normalizeProvisioningSpec;
+    private activePolicyFromDoc;
+    private digestPolicy;
+    private normalizeCredentialSequence;
+    private normalizePolicyGeneration;
+    private normalizeMutationRevision;
+    private toPublicPendingClient;
     private toPublicClient;
 }