@serve.zone/interfaces 23.0.4 → 23.2.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/changelog.md +17 -0
- package/dist_ts/00_commitinfo_data.js +1 -1
- package/dist_ts/data/immutableimage.d.ts +2 -0
- package/dist_ts/data/immutableimage.js +1 -1
- package/dist_ts/data/secret.d.ts +2 -0
- package/dist_ts/data/secret.js +18 -3
- package/dist_ts/runtime.d.ts +123 -1
- package/dist_ts/runtime.js +525 -2
- package/package.json +1 -1
- package/readme.md +47 -0
- package/ts/00_commitinfo_data.ts +1 -1
- package/ts/data/immutableimage.ts +2 -0
- package/ts/data/secret.ts +24 -2
- package/ts/runtime.ts +772 -0
package/dist_ts/runtime.js
CHANGED
|
@@ -1,5 +1,6 @@
|
|
|
1
1
|
import * as plugins from './plugins.js';
|
|
2
|
-
import { createResolvedSecretMaterialEnvelopeContext, createSecretRecipientEnrollmentChallengeContext, validateResolvedSecretManifest, validateSecretRecipientMetadata, verifySecretEnvelopeContext, verifyResolvedSecretManifestDigest, } from './data/secret.js';
|
|
2
|
+
import { createResolvedSecretMaterialEnvelopeContext, createSecretRecipientEnrollmentChallengeContext, resolvedSecretManifestReferencesEqual, validateResolvedSecretManifest, validateResolvedSecretManifestReference, validateSecretRecipientMetadata, validateSecretRecipientSet, verifySecretEnvelopeContext, verifyResolvedSecretManifestDigest, } from './data/secret.js';
|
|
3
|
+
import { isSha256Digest } from './data/immutableimage.js';
|
|
3
4
|
/**
|
|
4
5
|
* Parses every envelope with SmartCrypto, verifies its bound context digest,
|
|
5
6
|
* and checks sorted exact version coverage. It never receives a private key
|
|
@@ -230,4 +231,526 @@ export const validateCompleteSecretRecipientEnrollmentRequest = (requestArg) =>
|
|
|
230
231
|
return errors;
|
|
231
232
|
};
|
|
232
233
|
export { validateSecretRecipientMetadata };
|
|
233
|
-
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFPeEMsT0FBTyxFQUNMLDJDQUEyQyxFQUMzQywrQ0FBK0MsRUFDL0MsOEJBQThCLEVBQzlCLCtCQUErQixFQUMvQiwyQkFBMkIsRUFDM0Isa0NBQWtDLEdBQ25DLE1BQU0sa0JBQWtCLENBQUM7QUFtQzFCOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQ3JELFdBQW9CLEVBQ3BCLFdBQXVDLEVBQ3JCLEVBQUU7SUFDcEIsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUNoRyxNQUFNLFFBQVEsR0FBRyxXQUFxRCxDQUFDO0lBQ3ZFLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNsRSxTQUFTO1FBQ1QsVUFBVTtRQUNWLGVBQWU7S0FDaEIsQ0FBQyxFQUFFLENBQUM7UUFDSCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7UUFDM0YsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSw4QkFBOEIsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDM0QsQ0FBQyxNQUFNLGtDQUFrQyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2xFLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDOUQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDckQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTLEtBQUssV0FBVyxDQUFDLFNBQVM7V0FDckQsUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWM7V0FDL0QsUUFBUSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0IsS0FBSyxXQUFXLENBQUMsc0JBQXNCO1dBQy9FLFFBQVEsQ0FBQyxRQUFRLENBQUMsb0JBQW9CLEtBQUssV0FBVyxDQUFDLG9CQUFvQjtXQUMzRSxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWUsS0FBSyxXQUFXLENBQUMsZUFBZTtXQUNqRSxRQUFRLENBQUMsUUFBUSxDQUFDLHVCQUF1QixLQUFLLFdBQVcsQ0FBQyx1QkFBdUI7V0FDakYsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLEtBQUssV0FBVyxDQUFDLFVBQVU7V0FDL0MsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssV0FBVyxDQUFDLGNBQWMsRUFBRSxDQUFDO1FBQzdELE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEdBQUcsR0FBRztXQUM1QixRQUFRLENBQUMsT0FBTyxDQUFDLE1BQU0sS0FBSyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNsRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLGtCQUFrQixHQUFHLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTztTQUNqRCxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFFBQVEsQ0FBQyxlQUFlLENBQUM7U0FDM0MsSUFBSSxFQUFFLENBQUM7SUFDVixNQUFNLGdCQUFnQixHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDdEYsSUFBSSxJQUFJLEdBQUcsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLElBQUksS0FBSyxnQkFBZ0IsQ0FBQyxNQUFNO1dBQ3pELElBQUksQ0FBQyxTQUFTLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLGtCQUFrQixDQUFDLEVBQUUsQ0FBQztRQUM3RSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxNQUFNLHdCQUF3QixHQUFHLElBQUksR0FBRyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUM7UUFDbkYsUUFBUSxDQUFDLGVBQWU7UUFDeEIsUUFBUTtLQUNULENBQUMsQ0FBQyxDQUFDO0lBQ0osS0FBSyxNQUFNLEtBQUssSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDckMsSUFBSSxDQUFDLEtBQUssSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksT0FBTyxLQUFLLENBQUMsZUFBZSxLQUFLLFFBQVE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNuRyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDL0QsVUFBVTtZQUNWLGlCQUFpQjtTQUNsQixDQUFDLEVBQUUsQ0FBQztZQUNILE9BQU8sS0FBSyxDQUFDO1FBQ2YsQ0FBQztRQUNELE1BQU0sYUFBYSxHQUFHLHdCQUF3QixDQUFDLEdBQUcsQ0FBQyxLQUFLLENBQUMsZUFBZSxDQUFDLENBQUM7UUFDMUUsSUFBSSxDQUFDLGFBQWE7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNqQyxJQUFJLFFBQStDLENBQUM7UUFDcEQsSUFBSSxDQUFDO1lBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3JFLENBQUM7UUFBQyxNQUFNLENBQUM7WUFDUCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLHNCQUFzQjtZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ2pGLE1BQU0sT0FBTyxHQUFHLDJDQUEyQyxDQUFDO1lBQzFELGNBQWMsRUFBRSxXQUFXLENBQUMsc0JBQXNCO1lBQ2xELGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWM7WUFDaEQsU0FBUyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUztZQUN0QyxTQUFTLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxTQUFTO1lBQ3RDLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGNBQWM7WUFDaEQsc0JBQXNCLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxzQkFBc0I7WUFDaEUsb0JBQW9CLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0I7WUFDNUQsZUFBZSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsZUFBZTtZQUNsRCx1QkFBdUIsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLHVCQUF1QjtZQUNsRSxVQUFVLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFO1lBQ2hDLGNBQWMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU07WUFDeEMsUUFBUSxFQUFFLGFBQWEsQ0FBQyxRQUFRO1lBQ2hDLGVBQWUsRUFBRSxhQUFhLENBQUMsZUFBZTtTQUMvQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDO1lBQUUsT0FBTyxLQUFLLENBQUM7SUFDMUUsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDO0FBQ2QsQ0FBQyxDQUFDO0FBc0VGLE1BQU0sd0JBQXdCLEdBQUcscUNBQXFDLENBQUM7QUFDdkUsTUFBTSx1QkFBdUIsR0FBRyx1Q0FBdUMsQ0FBQztBQUV4RSxNQUFNLENBQUMsTUFBTSw2Q0FBNkMsR0FBRyxDQUMzRCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHNDQUFzQyxDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqRSxvQkFBb0I7UUFDcEIsVUFBVTtRQUNWLG1CQUFtQjtRQUNuQix3QkFBd0I7S0FDekIsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxzQkFBc0IsS0FBSyxRQUFRO1dBQ2pELENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO0lBQzdELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLGlCQUFpQixLQUFLLFFBQVE7V0FDNUMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztRQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztXQUMvQyxPQUFPLENBQUMsa0JBQTZCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxJQUFJLFdBQVcsSUFBSSxPQUFPLElBQUksZ0JBQWdCLElBQUksT0FBTyxFQUFFLENBQUM7UUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQ2xGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwwQ0FBMEMsR0FBRyxLQUFLLEVBQzdELFlBQXFCLEVBQ0YsRUFBRTtJQUNyQixJQUFJLENBQUMsWUFBWSxJQUFJLE9BQU8sWUFBWSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUM7UUFDckYsT0FBTyxDQUFDLHdDQUF3QyxDQUFDLENBQUM7SUFDcEQsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLFlBQXVDLENBQUM7SUFDMUQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNuRSxXQUFXO1FBQ1gsY0FBYztRQUNkLFVBQVU7UUFDVixXQUFXO1FBQ1gsWUFBWTtRQUNaLFdBQVc7UUFDWCxnQkFBZ0I7UUFDaEIsZUFBZTtLQUNoQixDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0RBQWdELENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsS0FBSyxNQUFNLEtBQUssSUFBSSxDQUFDLGNBQWMsRUFBRSxXQUFXLEVBQUUsZ0JBQWdCLENBQVUsRUFBRSxDQUFDO1FBQzdFLElBQUksT0FBTyxTQUFTLENBQUMsS0FBSyxDQUFDLEtBQUssUUFBUTtlQUNuQyxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxDQUFXLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEtBQUssb0JBQW9CLENBQUMsQ0FBQztRQUNqRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksU0FBUyxDQUFDLGFBQWEsS0FBSyxDQUFDO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQy9GLElBQUksT0FBTyxTQUFTLENBQUMsU0FBUyxLQUFLLFFBQVE7V0FDdEMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDeEQsTUFBTSxDQUFDLElBQUksQ0FBQyxtREFBbUQsQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLElBQUssU0FBUyxDQUFDLFVBQXFCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDeEYsTUFBTSxDQUFDLElBQUksQ0FBQyxrREFBa0QsQ0FBQyxDQUFDO0lBQ2xFLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUssU0FBUyxDQUFDLFNBQW9CLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDdEYsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLFFBQTJELENBQUM7SUFDaEUsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksUUFBUSxFQUFFLENBQUM7UUFDYixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssU0FBUyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3pELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztRQUMvRCxDQUFDO1FBQ0QsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUN2RCxNQUFNLENBQUMsSUFBSSxDQUFDLCtEQUErRCxDQUFDLENBQUM7UUFDL0UsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN4QixNQUFNLE9BQU8sR0FBRywrQ0FBK0MsQ0FBQztnQkFDOUQsWUFBWSxFQUFFLFNBQVMsQ0FBQyxZQUFzQjtnQkFDOUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjtnQkFDeEMsY0FBYyxFQUFFLFNBQVMsQ0FBQyxjQUF3QjtnQkFDbEQsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjtnQkFDeEMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFvQjtnQkFDMUMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFtQjthQUN6QyxDQUFDLENBQUM7WUFDSCxJQUFJLENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyw2Q0FBNkMsQ0FBQyxDQUFDO1lBQzdELENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLGdEQUFnRCxHQUFHLENBQzlELFVBQW1CLEVBQ1QsRUFBRTtJQUNaLElBQUksQ0FBQyxVQUFVLElBQUksT0FBTyxVQUFVLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMseUNBQXlDLENBQUMsQ0FBQztJQUNyRCxDQUFDO0lBQ0QsTUFBTSxPQUFPLEdBQUcsVUFBcUMsQ0FBQztJQUN0RCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQ2pFLGNBQWM7UUFDZCxvQkFBb0I7UUFDcEIsVUFBVTtRQUNWLFVBQVU7S0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNILE1BQU0sQ0FBQyxJQUFJLENBQUMsaURBQWlELENBQUMsQ0FBQztJQUNqRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVE7V0FDeEQsT0FBUSxPQUFPLENBQUMsUUFBb0MsQ0FBQyxHQUFHLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFlBQVksS0FBSyxRQUFRO1dBQ3ZDLENBQUMsd0JBQXdCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsaUNBQWlDLENBQUMsQ0FBQztJQUNqRCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsT0FBTyxDQUFDLGtCQUFrQixDQUFDO1dBQy9DLE9BQU8sQ0FBQyxrQkFBNkIsR0FBRyxDQUFDLEVBQUUsQ0FBQztRQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsUUFBUSxLQUFLLFFBQVEsSUFBSSxDQUFDLHVCQUF1QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLDZFQUE2RSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksV0FBVyxJQUFJLE9BQU8sSUFBSSxnQkFBZ0IsSUFBSSxPQUFPLEVBQUUsQ0FBQztRQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE9BQU8sRUFBRSwrQkFBK0IsRUFBRSxDQUFDIn0=
|
|
234
|
+
const runtimeIdentifierRegex = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
|
|
235
|
+
const runtimeFailureCodeRegex = /^[A-Z][A-Z0-9_]{0,127}$/;
|
|
236
|
+
const runtimePlatforms = new Set([
|
|
237
|
+
'linux/amd64',
|
|
238
|
+
'linux/arm64',
|
|
239
|
+
]);
|
|
240
|
+
const maximumRuntimeNodes = 1024;
|
|
241
|
+
const isRuntimeRecord = (valueArg) => (Boolean(valueArg) && typeof valueArg === 'object' && !Array.isArray(valueArg));
|
|
242
|
+
const hasExactRuntimeKeys = (valueArg, keysArg) => JSON.stringify(Object.keys(valueArg).sort()) === JSON.stringify([...keysArg].sort());
|
|
243
|
+
const hasOnlyRuntimeKeys = (valueArg, keysArg) => Object.keys(valueArg).every((keyArg) => keysArg.includes(keyArg));
|
|
244
|
+
const isRuntimeIdentifier = (valueArg) => (typeof valueArg === 'string' && runtimeIdentifierRegex.test(valueArg));
|
|
245
|
+
const isPositiveSafeInteger = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg > 0);
|
|
246
|
+
const computeRuntimeSha256 = async (inputArg) => {
|
|
247
|
+
const input = new TextEncoder().encode(inputArg);
|
|
248
|
+
const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', input.buffer));
|
|
249
|
+
return `sha256:${[...digest]
|
|
250
|
+
.map((byteArg) => byteArg.toString(16).padStart(2, '0'))
|
|
251
|
+
.join('')}`;
|
|
252
|
+
};
|
|
253
|
+
export const validateGetSecretRecipientEnrollmentStateRequest = (requestArg) => {
|
|
254
|
+
try {
|
|
255
|
+
if (!isRuntimeRecord(requestArg)
|
|
256
|
+
|| !hasExactRuntimeKeys(requestArg, ['identity'])
|
|
257
|
+
|| !isRuntimeRecord(requestArg.identity)
|
|
258
|
+
|| !hasExactRuntimeKeys(requestArg.identity, ['jwt'])
|
|
259
|
+
|| typeof requestArg.identity.jwt !== 'string'
|
|
260
|
+
|| requestArg.identity.jwt.length === 0) {
|
|
261
|
+
return ['secret recipient enrollment state request must contain only a JWT identity'];
|
|
262
|
+
}
|
|
263
|
+
return [];
|
|
264
|
+
}
|
|
265
|
+
catch {
|
|
266
|
+
return ['secret recipient enrollment state request must be safely inspectable'];
|
|
267
|
+
}
|
|
268
|
+
};
|
|
269
|
+
export const validateSecretRecipientEnrollmentState = (stateArg) => {
|
|
270
|
+
try {
|
|
271
|
+
if (!isRuntimeRecord(stateArg)
|
|
272
|
+
|| !hasExactRuntimeKeys(stateArg, ['schemaVersion', 'generation', 'recipients'])) {
|
|
273
|
+
return ['secret recipient enrollment state must use its exact schema'];
|
|
274
|
+
}
|
|
275
|
+
const errors = [];
|
|
276
|
+
if (stateArg.schemaVersion !== 1) {
|
|
277
|
+
errors.push('secret recipient enrollment state schemaVersion must be 1');
|
|
278
|
+
}
|
|
279
|
+
if (stateArg.generation === 0) {
|
|
280
|
+
if (!Array.isArray(stateArg.recipients) || stateArg.recipients.length !== 0) {
|
|
281
|
+
errors.push('generation-zero enrollment state must have no recipients');
|
|
282
|
+
}
|
|
283
|
+
return errors;
|
|
284
|
+
}
|
|
285
|
+
if (!isPositiveSafeInteger(stateArg.generation)) {
|
|
286
|
+
errors.push('secret recipient enrollment state generation must be zero or positive');
|
|
287
|
+
}
|
|
288
|
+
const recipientErrors = validateSecretRecipientSet(stateArg.recipients);
|
|
289
|
+
errors.push(...recipientErrors.map((errorArg) => `enrollment state ${errorArg}`));
|
|
290
|
+
if (recipientErrors.length === 0) {
|
|
291
|
+
const recipients = stateArg.recipients;
|
|
292
|
+
const greatestGeneration = Math.max(...recipients.map((recipientArg) => recipientArg.generation));
|
|
293
|
+
if (stateArg.generation !== greatestGeneration) {
|
|
294
|
+
errors.push('secret recipient enrollment state generation must match the active generation');
|
|
295
|
+
}
|
|
296
|
+
}
|
|
297
|
+
return errors;
|
|
298
|
+
}
|
|
299
|
+
catch {
|
|
300
|
+
return ['secret recipient enrollment state must be safely inspectable'];
|
|
301
|
+
}
|
|
302
|
+
};
|
|
303
|
+
/** Dedicated TypedSocket tag carrying ICoreflowSecretRuntimeRegistrationV1. */
|
|
304
|
+
export const coreflowSecretRuntimeRegistrationTagId = 'coreflowSecretRuntimeRegistration';
|
|
305
|
+
export const validateGetCoreflowSecretRuntimeRegistrationExpectationRequest = (requestArg) => {
|
|
306
|
+
try {
|
|
307
|
+
if (!isRuntimeRecord(requestArg)
|
|
308
|
+
|| !hasExactRuntimeKeys(requestArg, ['identity'])
|
|
309
|
+
|| !isRuntimeRecord(requestArg.identity)
|
|
310
|
+
|| !hasExactRuntimeKeys(requestArg.identity, ['jwt'])
|
|
311
|
+
|| typeof requestArg.identity.jwt !== 'string'
|
|
312
|
+
|| requestArg.identity.jwt.length === 0) {
|
|
313
|
+
return ['secret runtime registration expectation request must contain only a JWT identity'];
|
|
314
|
+
}
|
|
315
|
+
return [];
|
|
316
|
+
}
|
|
317
|
+
catch {
|
|
318
|
+
return ['secret runtime registration expectation request must be safely inspectable'];
|
|
319
|
+
}
|
|
320
|
+
};
|
|
321
|
+
const compareRuntimeTargets = (leftArg, rightArg) => {
|
|
322
|
+
for (const [left, right] of [
|
|
323
|
+
[leftArg.nodeId, rightArg.nodeId],
|
|
324
|
+
[leftArg.nodeName, rightArg.nodeName],
|
|
325
|
+
[leftArg.platform, rightArg.platform],
|
|
326
|
+
]) {
|
|
327
|
+
if (left < right)
|
|
328
|
+
return -1;
|
|
329
|
+
if (left > right)
|
|
330
|
+
return 1;
|
|
331
|
+
}
|
|
332
|
+
return 0;
|
|
333
|
+
};
|
|
334
|
+
const canonicalRuntimeTarget = (targetArg) => ({
|
|
335
|
+
nodeId: targetArg.nodeId,
|
|
336
|
+
nodeName: targetArg.nodeName,
|
|
337
|
+
platform: targetArg.platform,
|
|
338
|
+
});
|
|
339
|
+
export const createCoreflowSecretRuntimeNodeSetDigestInput = (targetsArg) => JSON.stringify({
|
|
340
|
+
schemaVersion: 1,
|
|
341
|
+
targets: targetsArg.map(canonicalRuntimeTarget),
|
|
342
|
+
});
|
|
343
|
+
export const computeCoreflowSecretRuntimeNodeSetDigest = async (targetsArg) => computeRuntimeSha256(createCoreflowSecretRuntimeNodeSetDigestInput(targetsArg));
|
|
344
|
+
const validateRuntimeTargets = (targetsArg, pathArg) => {
|
|
345
|
+
if (!Array.isArray(targetsArg)
|
|
346
|
+
|| targetsArg.length === 0
|
|
347
|
+
|| targetsArg.length > maximumRuntimeNodes) {
|
|
348
|
+
return [`${pathArg} must be a non-empty bounded array`];
|
|
349
|
+
}
|
|
350
|
+
const errors = [];
|
|
351
|
+
let previous;
|
|
352
|
+
const nodeIds = new Set();
|
|
353
|
+
const nodeNames = new Set();
|
|
354
|
+
for (const [index, targetArg] of targetsArg.entries()) {
|
|
355
|
+
if (!isRuntimeRecord(targetArg)
|
|
356
|
+
|| !hasExactRuntimeKeys(targetArg, ['nodeId', 'nodeName', 'platform'])) {
|
|
357
|
+
errors.push(`${pathArg}[${index}] must use its exact schema`);
|
|
358
|
+
continue;
|
|
359
|
+
}
|
|
360
|
+
if (!isRuntimeIdentifier(targetArg.nodeId) || !isRuntimeIdentifier(targetArg.nodeName)) {
|
|
361
|
+
errors.push(`${pathArg}[${index}] node identity must be canonical`);
|
|
362
|
+
}
|
|
363
|
+
if (!runtimePlatforms.has(targetArg.platform)) {
|
|
364
|
+
errors.push(`${pathArg}[${index}].platform must be supported`);
|
|
365
|
+
}
|
|
366
|
+
if (isRuntimeIdentifier(targetArg.nodeId)
|
|
367
|
+
&& isRuntimeIdentifier(targetArg.nodeName)
|
|
368
|
+
&& runtimePlatforms.has(targetArg.platform)) {
|
|
369
|
+
const target = targetArg;
|
|
370
|
+
if (previous && compareRuntimeTargets(previous, target) >= 0) {
|
|
371
|
+
errors.push(`${pathArg} must be uniquely sorted by nodeId, nodeName, and platform`);
|
|
372
|
+
}
|
|
373
|
+
previous = target;
|
|
374
|
+
if (nodeIds.has(target.nodeId))
|
|
375
|
+
errors.push(`${pathArg} nodeIds must be unique`);
|
|
376
|
+
if (nodeNames.has(target.nodeName))
|
|
377
|
+
errors.push(`${pathArg} nodeNames must be unique`);
|
|
378
|
+
nodeIds.add(target.nodeId);
|
|
379
|
+
nodeNames.add(target.nodeName);
|
|
380
|
+
}
|
|
381
|
+
}
|
|
382
|
+
return errors;
|
|
383
|
+
};
|
|
384
|
+
const validateRuntimeArtifacts = (artifactsArg, pathArg) => {
|
|
385
|
+
if (!Array.isArray(artifactsArg)
|
|
386
|
+
|| artifactsArg.length === 0
|
|
387
|
+
|| artifactsArg.length > runtimePlatforms.size) {
|
|
388
|
+
return [`${pathArg} must be a non-empty bounded array`];
|
|
389
|
+
}
|
|
390
|
+
const errors = [];
|
|
391
|
+
const platforms = [];
|
|
392
|
+
for (const [index, artifactArg] of artifactsArg.entries()) {
|
|
393
|
+
if (!isRuntimeRecord(artifactArg)
|
|
394
|
+
|| !hasExactRuntimeKeys(artifactArg, [
|
|
395
|
+
'platform',
|
|
396
|
+
'workloadInitPlatformManifestDigest',
|
|
397
|
+
'workloadInitExecutableDigest',
|
|
398
|
+
])) {
|
|
399
|
+
errors.push(`${pathArg}[${index}] must use its exact schema`);
|
|
400
|
+
continue;
|
|
401
|
+
}
|
|
402
|
+
platforms.push(artifactArg.platform);
|
|
403
|
+
if (!runtimePlatforms.has(artifactArg.platform)) {
|
|
404
|
+
errors.push(`${pathArg}[${index}].platform must be supported`);
|
|
405
|
+
}
|
|
406
|
+
if (typeof artifactArg.workloadInitPlatformManifestDigest !== 'string'
|
|
407
|
+
|| !isSha256Digest(artifactArg.workloadInitPlatformManifestDigest)
|
|
408
|
+
|| typeof artifactArg.workloadInitExecutableDigest !== 'string'
|
|
409
|
+
|| !isSha256Digest(artifactArg.workloadInitExecutableDigest)) {
|
|
410
|
+
errors.push(`${pathArg}[${index}] digests must be canonical`);
|
|
411
|
+
}
|
|
412
|
+
}
|
|
413
|
+
if (new Set(platforms).size !== platforms.length
|
|
414
|
+
|| JSON.stringify(platforms) !== JSON.stringify([...platforms].sort())) {
|
|
415
|
+
errors.push(`${pathArg} must be uniquely sorted by platform`);
|
|
416
|
+
}
|
|
417
|
+
return errors;
|
|
418
|
+
};
|
|
419
|
+
const activeRecipientFingerprint = (recipientArg) => (JSON.stringify({
|
|
420
|
+
schemaVersion: recipientArg.schemaVersion,
|
|
421
|
+
recipientKeyId: recipientArg.recipientKeyId,
|
|
422
|
+
publicKey: recipientArg.publicKey,
|
|
423
|
+
generation: recipientArg.generation,
|
|
424
|
+
activatedAt: recipientArg.activatedAt,
|
|
425
|
+
lifecycleState: recipientArg.lifecycleState,
|
|
426
|
+
}));
|
|
427
|
+
/**
|
|
428
|
+
* Consumers discard this registration on transport disconnect, tag
|
|
429
|
+
* removal/replacement, reporter-session change, or any expectation change.
|
|
430
|
+
*/
|
|
431
|
+
export const validateCoreflowSecretRuntimeRegistration = async (registrationArg, expectationArg) => {
|
|
432
|
+
try {
|
|
433
|
+
const errors = [];
|
|
434
|
+
if (!isRuntimeRecord(expectationArg)
|
|
435
|
+
|| !hasExactRuntimeKeys(expectationArg, [
|
|
436
|
+
'expectationVersion',
|
|
437
|
+
'reporterSessionId',
|
|
438
|
+
'targets',
|
|
439
|
+
'workloadInitImageIndexDigest',
|
|
440
|
+
'workloadInitArtifacts',
|
|
441
|
+
'activeRecipient',
|
|
442
|
+
])) {
|
|
443
|
+
return ['secret runtime registration expectation must use its exact schema'];
|
|
444
|
+
}
|
|
445
|
+
if (expectationArg.expectationVersion !== 1) {
|
|
446
|
+
errors.push('secret runtime registration expectationVersion must be 1');
|
|
447
|
+
}
|
|
448
|
+
if (!isRuntimeIdentifier(expectationArg.reporterSessionId)) {
|
|
449
|
+
errors.push('expected secret runtime reporterSessionId must be canonical');
|
|
450
|
+
}
|
|
451
|
+
const expectedTargetErrors = validateRuntimeTargets(expectationArg.targets, 'expected targets');
|
|
452
|
+
errors.push(...expectedTargetErrors);
|
|
453
|
+
errors.push(...validateRuntimeArtifacts(expectationArg.workloadInitArtifacts, 'expected WorkloadInit artifacts'));
|
|
454
|
+
if (typeof expectationArg.workloadInitImageIndexDigest !== 'string'
|
|
455
|
+
|| !isSha256Digest(expectationArg.workloadInitImageIndexDigest)) {
|
|
456
|
+
errors.push('expected WorkloadInit image index digest must be canonical');
|
|
457
|
+
}
|
|
458
|
+
const expectedRecipientErrors = validateSecretRecipientMetadata(expectationArg.activeRecipient);
|
|
459
|
+
if (expectedRecipientErrors.length > 0
|
|
460
|
+
|| !isRuntimeRecord(expectationArg.activeRecipient)
|
|
461
|
+
|| expectationArg.activeRecipient.lifecycleState !== 'active') {
|
|
462
|
+
errors.push('expected secret recipient must be canonical and active');
|
|
463
|
+
}
|
|
464
|
+
if (!isRuntimeRecord(registrationArg)
|
|
465
|
+
|| !hasExactRuntimeKeys(registrationArg, [
|
|
466
|
+
'registrationVersion',
|
|
467
|
+
'reporterSessionId',
|
|
468
|
+
'registeredAt',
|
|
469
|
+
'targets',
|
|
470
|
+
'nodeSetDigest',
|
|
471
|
+
'nodeEvidence',
|
|
472
|
+
'capabilities',
|
|
473
|
+
'activeRecipient',
|
|
474
|
+
'workloadInitImageIndexDigest',
|
|
475
|
+
'workloadInitApprovedAt',
|
|
476
|
+
])) {
|
|
477
|
+
errors.push('secret runtime registration must use its exact schema');
|
|
478
|
+
return errors;
|
|
479
|
+
}
|
|
480
|
+
if (registrationArg.registrationVersion !== 1) {
|
|
481
|
+
errors.push('secret runtime registrationVersion must be 1');
|
|
482
|
+
}
|
|
483
|
+
if (!isRuntimeIdentifier(registrationArg.reporterSessionId)) {
|
|
484
|
+
errors.push('secret runtime reporterSessionId must be canonical');
|
|
485
|
+
}
|
|
486
|
+
else if (registrationArg.reporterSessionId !== expectationArg.reporterSessionId) {
|
|
487
|
+
errors.push('secret runtime reporterSessionId does not match the live session');
|
|
488
|
+
}
|
|
489
|
+
if (!isPositiveSafeInteger(registrationArg.registeredAt)
|
|
490
|
+
|| !isPositiveSafeInteger(registrationArg.workloadInitApprovedAt)) {
|
|
491
|
+
errors.push('secret runtime registration timestamps must be positive integers');
|
|
492
|
+
}
|
|
493
|
+
const registrationTargetErrors = validateRuntimeTargets(registrationArg.targets, 'registration targets');
|
|
494
|
+
errors.push(...registrationTargetErrors);
|
|
495
|
+
if (typeof registrationArg.nodeSetDigest !== 'string'
|
|
496
|
+
|| !isSha256Digest(registrationArg.nodeSetDigest)) {
|
|
497
|
+
errors.push('secret runtime nodeSetDigest must be canonical');
|
|
498
|
+
}
|
|
499
|
+
if (typeof registrationArg.workloadInitImageIndexDigest !== 'string'
|
|
500
|
+
|| !isSha256Digest(registrationArg.workloadInitImageIndexDigest)) {
|
|
501
|
+
errors.push('secret runtime WorkloadInit image index digest must be canonical');
|
|
502
|
+
}
|
|
503
|
+
const registrationRecipientErrors = validateSecretRecipientMetadata(registrationArg.activeRecipient);
|
|
504
|
+
if (registrationRecipientErrors.length > 0
|
|
505
|
+
|| !isRuntimeRecord(registrationArg.activeRecipient)
|
|
506
|
+
|| registrationArg.activeRecipient.lifecycleState !== 'active') {
|
|
507
|
+
errors.push('secret runtime registration recipient must be canonical and active');
|
|
508
|
+
}
|
|
509
|
+
if (!isRuntimeRecord(registrationArg.capabilities)
|
|
510
|
+
|| !hasOnlyRuntimeKeys(registrationArg.capabilities, [
|
|
511
|
+
'immutableImageDeploymentVersion',
|
|
512
|
+
'corestoreInventoryVersion',
|
|
513
|
+
'secretManifestVersion',
|
|
514
|
+
'sealedSecretMaterialVersion',
|
|
515
|
+
'secretRecipientEnrollmentVersion',
|
|
516
|
+
'workloadInitEnvironmentVersion',
|
|
517
|
+
'secretDeploymentReportVersion',
|
|
518
|
+
])
|
|
519
|
+
|| registrationArg.capabilities.immutableImageDeploymentVersion !== 1
|
|
520
|
+
|| registrationArg.capabilities.secretManifestVersion !== 2
|
|
521
|
+
|| registrationArg.capabilities.sealedSecretMaterialVersion !== 1
|
|
522
|
+
|| registrationArg.capabilities.secretRecipientEnrollmentVersion !== 1
|
|
523
|
+
|| registrationArg.capabilities.workloadInitEnvironmentVersion !== 1
|
|
524
|
+
|| registrationArg.capabilities.secretDeploymentReportVersion !== 1
|
|
525
|
+
|| (registrationArg.capabilities.corestoreInventoryVersion !== undefined
|
|
526
|
+
&& registrationArg.capabilities.corestoreInventoryVersion !== 1)) {
|
|
527
|
+
errors.push('secret runtime registration capabilities are incomplete or unsupported');
|
|
528
|
+
}
|
|
529
|
+
if (!Array.isArray(registrationArg.nodeEvidence)
|
|
530
|
+
|| registrationArg.nodeEvidence.length === 0
|
|
531
|
+
|| registrationArg.nodeEvidence.length > maximumRuntimeNodes) {
|
|
532
|
+
errors.push('secret runtime node evidence must be a non-empty bounded array');
|
|
533
|
+
}
|
|
534
|
+
else {
|
|
535
|
+
const evidenceTargets = [];
|
|
536
|
+
const evidenceArtifacts = [];
|
|
537
|
+
for (const [index, evidenceArg] of registrationArg.nodeEvidence.entries()) {
|
|
538
|
+
if (!isRuntimeRecord(evidenceArg)
|
|
539
|
+
|| !hasExactRuntimeKeys(evidenceArg, [
|
|
540
|
+
'nodeId',
|
|
541
|
+
'nodeName',
|
|
542
|
+
'platform',
|
|
543
|
+
'workloadInitPlatformManifestDigest',
|
|
544
|
+
'workloadInitExecutableDigest',
|
|
545
|
+
])) {
|
|
546
|
+
errors.push(`secret runtime nodeEvidence[${index}] must use its exact schema`);
|
|
547
|
+
continue;
|
|
548
|
+
}
|
|
549
|
+
evidenceTargets.push({
|
|
550
|
+
nodeId: evidenceArg.nodeId,
|
|
551
|
+
nodeName: evidenceArg.nodeName,
|
|
552
|
+
platform: evidenceArg.platform,
|
|
553
|
+
});
|
|
554
|
+
evidenceArtifacts.push({
|
|
555
|
+
platform: evidenceArg.platform,
|
|
556
|
+
workloadInitPlatformManifestDigest: evidenceArg.workloadInitPlatformManifestDigest,
|
|
557
|
+
workloadInitExecutableDigest: evidenceArg.workloadInitExecutableDigest,
|
|
558
|
+
});
|
|
559
|
+
if (typeof evidenceArg.workloadInitPlatformManifestDigest !== 'string'
|
|
560
|
+
|| !isSha256Digest(evidenceArg.workloadInitPlatformManifestDigest)
|
|
561
|
+
|| typeof evidenceArg.workloadInitExecutableDigest !== 'string'
|
|
562
|
+
|| !isSha256Digest(evidenceArg.workloadInitExecutableDigest)) {
|
|
563
|
+
errors.push(`secret runtime nodeEvidence[${index}] digests must be canonical`);
|
|
564
|
+
}
|
|
565
|
+
}
|
|
566
|
+
errors.push(...validateRuntimeTargets(evidenceTargets, 'secret runtime evidence targets'));
|
|
567
|
+
if (JSON.stringify(evidenceTargets) !== JSON.stringify(registrationArg.targets)) {
|
|
568
|
+
errors.push('secret runtime node evidence must exactly cover registration targets in order');
|
|
569
|
+
}
|
|
570
|
+
const expectedArtifacts = new Map(expectationArg.workloadInitArtifacts
|
|
571
|
+
.map((artifactArg) => [artifactArg.platform, artifactArg]));
|
|
572
|
+
for (const [index, artifactArg] of evidenceArtifacts.entries()) {
|
|
573
|
+
const expectedArtifact = expectedArtifacts.get(artifactArg.platform);
|
|
574
|
+
if (!expectedArtifact
|
|
575
|
+
|| expectedArtifact.workloadInitPlatformManifestDigest
|
|
576
|
+
!== artifactArg.workloadInitPlatformManifestDigest
|
|
577
|
+
|| expectedArtifact.workloadInitExecutableDigest
|
|
578
|
+
!== artifactArg.workloadInitExecutableDigest) {
|
|
579
|
+
errors.push(`secret runtime nodeEvidence[${index}] does not match the approved artifact`);
|
|
580
|
+
}
|
|
581
|
+
}
|
|
582
|
+
}
|
|
583
|
+
if (JSON.stringify(registrationArg.targets) !== JSON.stringify(expectationArg.targets)) {
|
|
584
|
+
errors.push('secret runtime registration must exactly cover authoritative target nodes');
|
|
585
|
+
}
|
|
586
|
+
if (expectedTargetErrors.length === 0 && registrationTargetErrors.length === 0) {
|
|
587
|
+
const expectedNodeSetDigest = await computeCoreflowSecretRuntimeNodeSetDigest(expectationArg.targets);
|
|
588
|
+
if (registrationArg.nodeSetDigest !== expectedNodeSetDigest) {
|
|
589
|
+
errors.push('secret runtime nodeSetDigest does not match authoritative target nodes');
|
|
590
|
+
}
|
|
591
|
+
}
|
|
592
|
+
if (registrationArg.workloadInitImageIndexDigest
|
|
593
|
+
!== expectationArg.workloadInitImageIndexDigest) {
|
|
594
|
+
errors.push('secret runtime WorkloadInit image index is not approved');
|
|
595
|
+
}
|
|
596
|
+
if (registrationRecipientErrors.length === 0 && expectedRecipientErrors.length === 0
|
|
597
|
+
&& activeRecipientFingerprint(registrationArg.activeRecipient) !== activeRecipientFingerprint(expectationArg.activeRecipient)) {
|
|
598
|
+
errors.push('secret runtime registration recipient does not match the active recipient');
|
|
599
|
+
}
|
|
600
|
+
return errors;
|
|
601
|
+
}
|
|
602
|
+
catch {
|
|
603
|
+
return ['secret runtime registration and expectation must be safely inspectable'];
|
|
604
|
+
}
|
|
605
|
+
};
|
|
606
|
+
const canonicalManifestReference = (referenceArg) => ({
|
|
607
|
+
manifestId: referenceArg.manifestId,
|
|
608
|
+
manifestDigest: referenceArg.manifestDigest,
|
|
609
|
+
clusterId: referenceArg.clusterId,
|
|
610
|
+
imageRolloutId: referenceArg.imageRolloutId,
|
|
611
|
+
imageRolloutGeneration: referenceArg.imageRolloutGeneration,
|
|
612
|
+
requestedImageDigest: referenceArg.requestedImageDigest,
|
|
613
|
+
invocationDigest: referenceArg.invocationDigest,
|
|
614
|
+
secretRolloutId: referenceArg.secretRolloutId,
|
|
615
|
+
secretRolloutGeneration: referenceArg.secretRolloutGeneration,
|
|
616
|
+
});
|
|
617
|
+
export const createSecretDeploymentReportDigestInput = (reportArg) => {
|
|
618
|
+
const common = {
|
|
619
|
+
schemaVersion: reportArg.schemaVersion,
|
|
620
|
+
reporterSessionId: reportArg.reporterSessionId,
|
|
621
|
+
reportSequence: reportArg.reportSequence,
|
|
622
|
+
serviceId: reportArg.serviceId,
|
|
623
|
+
expectedPlanRevision: reportArg.expectedPlanRevision,
|
|
624
|
+
desiredManifest: canonicalManifestReference(reportArg.desiredManifest),
|
|
625
|
+
status: reportArg.status,
|
|
626
|
+
};
|
|
627
|
+
if (reportArg.status === 'applied') {
|
|
628
|
+
return JSON.stringify({
|
|
629
|
+
...common,
|
|
630
|
+
appliedManifest: canonicalManifestReference(reportArg.appliedManifest),
|
|
631
|
+
reportedAt: reportArg.reportedAt,
|
|
632
|
+
});
|
|
633
|
+
}
|
|
634
|
+
if (reportArg.status === 'drifted') {
|
|
635
|
+
return JSON.stringify({
|
|
636
|
+
...common,
|
|
637
|
+
...(reportArg.observedManifest
|
|
638
|
+
? { observedManifest: canonicalManifestReference(reportArg.observedManifest) }
|
|
639
|
+
: {}),
|
|
640
|
+
failureCode: reportArg.failureCode,
|
|
641
|
+
reportedAt: reportArg.reportedAt,
|
|
642
|
+
});
|
|
643
|
+
}
|
|
644
|
+
if (reportArg.status === 'failed') {
|
|
645
|
+
return JSON.stringify({
|
|
646
|
+
...common,
|
|
647
|
+
failureCode: reportArg.failureCode,
|
|
648
|
+
reportedAt: reportArg.reportedAt,
|
|
649
|
+
});
|
|
650
|
+
}
|
|
651
|
+
return JSON.stringify({ ...common, reportedAt: reportArg.reportedAt });
|
|
652
|
+
};
|
|
653
|
+
export const computeSecretDeploymentReportDigest = async (reportArg) => computeRuntimeSha256(createSecretDeploymentReportDigestInput(reportArg));
|
|
654
|
+
export const verifySecretDeploymentReportDigest = async (reportArg) => {
|
|
655
|
+
try {
|
|
656
|
+
if (!isRuntimeRecord(reportArg)
|
|
657
|
+
|| typeof reportArg.reportDigest !== 'string'
|
|
658
|
+
|| !isSha256Digest(reportArg.reportDigest)) {
|
|
659
|
+
return false;
|
|
660
|
+
}
|
|
661
|
+
return reportArg.reportDigest === await computeSecretDeploymentReportDigest(reportArg);
|
|
662
|
+
}
|
|
663
|
+
catch {
|
|
664
|
+
return false;
|
|
665
|
+
}
|
|
666
|
+
};
|
|
667
|
+
/**
|
|
668
|
+
* The expected cluster and reporter session come from the consumer's verified
|
|
669
|
+
* live connection authority and are deliberately not accepted from the wire.
|
|
670
|
+
*/
|
|
671
|
+
export const validateSecretDeploymentReportRequest = async (requestArg, expectedClusterIdArg, expectedReporterSessionIdArg) => {
|
|
672
|
+
try {
|
|
673
|
+
if (!isRuntimeIdentifier(expectedClusterIdArg)) {
|
|
674
|
+
return ['trusted expected cluster id must be canonical'];
|
|
675
|
+
}
|
|
676
|
+
if (!isRuntimeIdentifier(expectedReporterSessionIdArg)) {
|
|
677
|
+
return ['trusted expected reporter session id must be canonical'];
|
|
678
|
+
}
|
|
679
|
+
if (!isRuntimeRecord(requestArg)) {
|
|
680
|
+
return ['secret deployment report request must be an object'];
|
|
681
|
+
}
|
|
682
|
+
const status = requestArg.status;
|
|
683
|
+
const commonKeys = [
|
|
684
|
+
'identity',
|
|
685
|
+
'schemaVersion',
|
|
686
|
+
'reporterSessionId',
|
|
687
|
+
'reportSequence',
|
|
688
|
+
'serviceId',
|
|
689
|
+
'expectedPlanRevision',
|
|
690
|
+
'desiredManifest',
|
|
691
|
+
'status',
|
|
692
|
+
'reportedAt',
|
|
693
|
+
'reportDigest',
|
|
694
|
+
];
|
|
695
|
+
const expectedKeys = status === 'applied'
|
|
696
|
+
? [...commonKeys, 'appliedManifest']
|
|
697
|
+
: status === 'drifted'
|
|
698
|
+
? [...commonKeys, 'failureCode', ...(requestArg.observedManifest === undefined
|
|
699
|
+
? []
|
|
700
|
+
: ['observedManifest'])]
|
|
701
|
+
: status === 'failed'
|
|
702
|
+
? [...commonKeys, 'failureCode']
|
|
703
|
+
: commonKeys;
|
|
704
|
+
const errors = [];
|
|
705
|
+
if (!['applying', 'applied', 'drifted', 'failed'].includes(status)
|
|
706
|
+
|| !hasExactRuntimeKeys(requestArg, expectedKeys)) {
|
|
707
|
+
errors.push('secret deployment report must use its exact status schema');
|
|
708
|
+
}
|
|
709
|
+
if (!isRuntimeRecord(requestArg.identity)
|
|
710
|
+
|| !hasExactRuntimeKeys(requestArg.identity, ['jwt'])
|
|
711
|
+
|| typeof requestArg.identity.jwt !== 'string'
|
|
712
|
+
|| requestArg.identity.jwt.length === 0) {
|
|
713
|
+
errors.push('secret deployment report requires a JWT identity');
|
|
714
|
+
}
|
|
715
|
+
if (requestArg.schemaVersion !== 1) {
|
|
716
|
+
errors.push('secret deployment report schemaVersion must be 1');
|
|
717
|
+
}
|
|
718
|
+
if (!isRuntimeIdentifier(requestArg.reporterSessionId)
|
|
719
|
+
|| !isRuntimeIdentifier(requestArg.serviceId)) {
|
|
720
|
+
errors.push('secret deployment report identity fields must be canonical');
|
|
721
|
+
}
|
|
722
|
+
else if (requestArg.reporterSessionId !== expectedReporterSessionIdArg) {
|
|
723
|
+
errors.push('secret deployment report reporterSessionId does not match the live session');
|
|
724
|
+
}
|
|
725
|
+
if (!isPositiveSafeInteger(requestArg.reportSequence)
|
|
726
|
+
|| !isPositiveSafeInteger(requestArg.expectedPlanRevision)
|
|
727
|
+
|| !isPositiveSafeInteger(requestArg.reportedAt)) {
|
|
728
|
+
errors.push('secret deployment report revisions, sequence, and timestamp must be positive integers');
|
|
729
|
+
}
|
|
730
|
+
errors.push(...validateResolvedSecretManifestReference(requestArg.desiredManifest, expectedClusterIdArg).map((errorArg) => `desiredManifest: ${errorArg}`));
|
|
731
|
+
if (status === 'applied') {
|
|
732
|
+
errors.push(...validateResolvedSecretManifestReference(requestArg.appliedManifest, expectedClusterIdArg).map((errorArg) => `appliedManifest: ${errorArg}`));
|
|
733
|
+
if (!resolvedSecretManifestReferencesEqual(requestArg.appliedManifest, requestArg.desiredManifest)) {
|
|
734
|
+
errors.push('applied secret deployment report must apply the desired manifest');
|
|
735
|
+
}
|
|
736
|
+
}
|
|
737
|
+
if (status === 'drifted' && requestArg.observedManifest !== undefined) {
|
|
738
|
+
errors.push(...validateResolvedSecretManifestReference(requestArg.observedManifest, expectedClusterIdArg).map((errorArg) => `observedManifest: ${errorArg}`));
|
|
739
|
+
}
|
|
740
|
+
if ((status === 'drifted' || status === 'failed')
|
|
741
|
+
&& (typeof requestArg.failureCode !== 'string'
|
|
742
|
+
|| !runtimeFailureCodeRegex.test(requestArg.failureCode))) {
|
|
743
|
+
errors.push('secret deployment report failureCode must be canonical');
|
|
744
|
+
}
|
|
745
|
+
if (typeof requestArg.reportDigest !== 'string'
|
|
746
|
+
|| !isSha256Digest(requestArg.reportDigest)
|
|
747
|
+
|| !await verifySecretDeploymentReportDigest(requestArg)) {
|
|
748
|
+
errors.push('secret deployment report digest does not match its canonical payload');
|
|
749
|
+
}
|
|
750
|
+
return errors;
|
|
751
|
+
}
|
|
752
|
+
catch {
|
|
753
|
+
return ['secret deployment report request must be safely inspectable'];
|
|
754
|
+
}
|
|
755
|
+
};
|
|
756
|
+
//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uL3RzL3J1bnRpbWUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxjQUFjLENBQUM7QUFZeEMsT0FBTyxFQUNMLDJDQUEyQyxFQUMzQywrQ0FBK0MsRUFDL0MscUNBQXFDLEVBQ3JDLDhCQUE4QixFQUM5Qix1Q0FBdUMsRUFDdkMsK0JBQStCLEVBQy9CLDBCQUEwQixFQUMxQiwyQkFBMkIsRUFDM0Isa0NBQWtDLEdBQ25DLE1BQU0sa0JBQWtCLENBQUM7QUFDMUIsT0FBTyxFQUFFLGNBQWMsRUFBRSxNQUFNLDBCQUEwQixDQUFDO0FBbUMxRDs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sa0NBQWtDLEdBQUcsS0FBSyxFQUNyRCxXQUFvQixFQUNwQixXQUF1QyxFQUNyQixFQUFFO0lBQ3BCLElBQUksQ0FBQyxXQUFXLElBQUksT0FBTyxXQUFXLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDaEcsTUFBTSxRQUFRLEdBQUcsV0FBcUQsQ0FBQztJQUN2RSxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDbEUsU0FBUztRQUNULFVBQVU7UUFDVixlQUFlO0tBQ2hCLENBQUMsRUFBRSxDQUFDO1FBQ0gsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsYUFBYSxLQUFLLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQzNGLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELElBQUksOEJBQThCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzNELENBQUMsTUFBTSxrQ0FBa0MsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQztRQUNsRSxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxRQUFRLENBQUMsY0FBYyxLQUFLLFdBQVcsQ0FBQyxjQUFjO1dBQzlELFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQ3JELFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQ3JELFFBQVEsQ0FBQyxRQUFRLENBQUMsY0FBYyxLQUFLLFdBQVcsQ0FBQyxjQUFjO1dBQy9ELFFBQVEsQ0FBQyxRQUFRLENBQUMsc0JBQXNCLEtBQUssV0FBVyxDQUFDLHNCQUFzQjtXQUMvRSxRQUFRLENBQUMsUUFBUSxDQUFDLG9CQUFvQixLQUFLLFdBQVcsQ0FBQyxvQkFBb0I7V0FDM0UsUUFBUSxDQUFDLFFBQVEsQ0FBQyxlQUFlLEtBQUssV0FBVyxDQUFDLGVBQWU7V0FDakUsUUFBUSxDQUFDLFFBQVEsQ0FBQyx1QkFBdUIsS0FBSyxXQUFXLENBQUMsdUJBQXVCO1dBQ2pGLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxLQUFLLFdBQVcsQ0FBQyxVQUFVO1dBQy9DLFFBQVEsQ0FBQyxRQUFRLENBQUMsTUFBTSxLQUFLLFdBQVcsQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUM3RCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxHQUFHLEdBQUc7V0FDNUIsUUFBUSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDbEUsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU87U0FDakQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxRQUFRLENBQUMsZUFBZSxDQUFDO1NBQzNDLElBQUksRUFBRSxDQUFDO0lBQ1YsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsUUFBUSxDQUFDLGVBQWUsQ0FBQyxDQUFDO0lBQ3RGLElBQUksSUFBSSxHQUFHLENBQUMsZ0JBQWdCLENBQUMsQ0FBQyxJQUFJLEtBQUssZ0JBQWdCLENBQUMsTUFBTTtXQUN6RCxJQUFJLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxrQkFBa0IsQ0FBQyxFQUFFLENBQUM7UUFDN0UsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsTUFBTSx3QkFBd0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDO1FBQ25GLFFBQVEsQ0FBQyxlQUFlO1FBQ3hCLFFBQVE7S0FDVCxDQUFDLENBQUMsQ0FBQztJQUNKLEtBQUssTUFBTSxLQUFLLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3JDLElBQUksQ0FBQyxLQUFLLElBQUksT0FBTyxLQUFLLEtBQUssUUFBUSxJQUFJLE9BQU8sS0FBSyxDQUFDLGVBQWUsS0FBSyxRQUFRO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDbkcsSUFBSSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQy9ELFVBQVU7WUFDVixpQkFBaUI7U0FDbEIsQ0FBQyxFQUFFLENBQUM7WUFDSCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxNQUFNLGFBQWEsR0FBRyx3QkFBd0IsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQzFFLElBQUksQ0FBQyxhQUFhO1lBQUUsT0FBTyxLQUFLLENBQUM7UUFDakMsSUFBSSxRQUErQyxDQUFDO1FBQ3BELElBQUksQ0FBQztZQUNILFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLEtBQUssQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNyRSxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsY0FBYyxLQUFLLFdBQVcsQ0FBQyxzQkFBc0I7WUFBRSxPQUFPLEtBQUssQ0FBQztRQUNqRixNQUFNLE9BQU8sR0FBRywyQ0FBMkMsQ0FBQztZQUMxRCxjQUFjLEVBQUUsV0FBVyxDQUFDLHNCQUFzQjtZQUNsRCxjQUFjLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjO1lBQ2hELFNBQVMsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLFNBQVM7WUFDdEMsU0FBUyxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsU0FBUztZQUN0QyxjQUFjLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxjQUFjO1lBQ2hELHNCQUFzQixFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsc0JBQXNCO1lBQ2hFLG9CQUFvQixFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsb0JBQW9CO1lBQzVELGVBQWUsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDLGVBQWU7WUFDbEQsdUJBQXVCLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyx1QkFBdUI7WUFDbEUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRTtZQUNoQyxjQUFjLEVBQUUsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNO1lBQ3hDLFFBQVEsRUFBRSxhQUFhLENBQUMsUUFBUTtZQUNoQyxlQUFlLEVBQUUsYUFBYSxDQUFDLGVBQWU7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQztZQUFFLE9BQU8sS0FBSyxDQUFDO0lBQzFFLENBQUM7SUFDRCxPQUFPLElBQUksQ0FBQztBQUNkLENBQUMsQ0FBQztBQXNFRixNQUFNLHdCQUF3QixHQUFHLHFDQUFxQyxDQUFDO0FBQ3ZFLE1BQU0sdUJBQXVCLEdBQUcsdUNBQXVDLENBQUM7QUFFeEUsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsVUFBbUIsRUFDVCxFQUFFO0lBQ1osSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQy9FLE9BQU8sQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxVQUFxQyxDQUFDO0lBQ3RELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDakUsb0JBQW9CO1FBQ3BCLFVBQVU7UUFDVixtQkFBbUI7UUFDbkIsd0JBQXdCO0tBQ3pCLENBQUMsRUFBRSxDQUFDO1FBQ0gsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsSUFBSSxPQUFPLE9BQU8sQ0FBQyxRQUFRLEtBQUssUUFBUTtXQUN4RCxPQUFRLE9BQU8sQ0FBQyxRQUFvQyxDQUFDLEdBQUcsS0FBSyxRQUFRLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7SUFDOUQsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsc0JBQXNCLEtBQUssUUFBUTtXQUNqRCxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsc0JBQXNCLENBQUMsRUFBRSxDQUFDO1FBQ3BFLE1BQU0sQ0FBQyxJQUFJLENBQUMsNkNBQTZDLENBQUMsQ0FBQztJQUM3RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxpQkFBaUIsS0FBSyxRQUFRO1dBQzVDLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsa0JBQWtCLENBQUM7V0FDL0MsT0FBTyxDQUFDLGtCQUE2QixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2hELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztJQUNwRSxDQUFDO0lBQ0QsSUFBSSxXQUFXLElBQUksT0FBTyxJQUFJLGdCQUFnQixJQUFJLE9BQU8sRUFBRSxDQUFDO1FBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsa0VBQWtFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsS0FBSyxFQUM3RCxZQUFxQixFQUNGLEVBQUU7SUFDckIsSUFBSSxDQUFDLFlBQVksSUFBSSxPQUFPLFlBQVksS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsRUFBRSxDQUFDO1FBQ3JGLE9BQU8sQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO0lBQ3BELENBQUM7SUFDRCxNQUFNLFNBQVMsR0FBRyxZQUF1QyxDQUFDO0lBQzFELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDbkUsV0FBVztRQUNYLGNBQWM7UUFDZCxVQUFVO1FBQ1YsV0FBVztRQUNYLFlBQVk7UUFDWixXQUFXO1FBQ1gsZ0JBQWdCO1FBQ2hCLGVBQWU7S0FDaEIsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGdEQUFnRCxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELEtBQUssTUFBTSxLQUFLLElBQUksQ0FBQyxjQUFjLEVBQUUsV0FBVyxFQUFFLGdCQUFnQixDQUFVLEVBQUUsQ0FBQztRQUM3RSxJQUFJLE9BQU8sU0FBUyxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVE7ZUFDbkMsQ0FBQyx3QkFBd0IsQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssQ0FBVyxDQUFDLEVBQUUsQ0FBQztZQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdCQUF3QixLQUFLLG9CQUFvQixDQUFDLENBQUM7UUFDakUsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxhQUFhLEtBQUssQ0FBQztRQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUMvRixJQUFJLE9BQU8sU0FBUyxDQUFDLFNBQVMsS0FBSyxRQUFRO1dBQ3RDLENBQUMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFVBQVUsQ0FBQyxJQUFLLFNBQVMsQ0FBQyxVQUFxQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsa0RBQWtELENBQUMsQ0FBQztJQUNsRSxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDLFNBQVMsQ0FBQyxJQUFLLFNBQVMsQ0FBQyxTQUFvQixHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ3RGLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxRQUEyRCxDQUFDO0lBQ2hFLElBQUksQ0FBQztRQUNILFFBQVEsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUN6RSxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsTUFBTSxDQUFDLElBQUksQ0FBQyw4Q0FBOEMsQ0FBQyxDQUFDO0lBQzlELENBQUM7SUFDRCxJQUFJLFFBQVEsRUFBRSxDQUFDO1FBQ2IsSUFBSSxRQUFRLENBQUMsY0FBYyxLQUFLLFNBQVMsQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6RCxNQUFNLENBQUMsSUFBSSxDQUFDLCtDQUErQyxDQUFDLENBQUM7UUFDL0QsQ0FBQztRQUNELElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQywrREFBK0QsQ0FBQyxDQUFDO1FBQy9FLENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDeEIsTUFBTSxPQUFPLEdBQUcsK0NBQStDLENBQUM7Z0JBQzlELFlBQVksRUFBRSxTQUFTLENBQUMsWUFBc0I7Z0JBQzlDLFNBQVMsRUFBRSxTQUFTLENBQUMsU0FBbUI7Z0JBQ3hDLGNBQWMsRUFBRSxTQUFTLENBQUMsY0FBd0I7Z0JBQ2xELFNBQVMsRUFBRSxTQUFTLENBQUMsU0FBbUI7Z0JBQ3hDLFVBQVUsRUFBRSxTQUFTLENBQUMsVUFBb0I7Z0JBQzFDLFNBQVMsRUFBRSxTQUFTLENBQUMsU0FBbUI7YUFDekMsQ0FBQyxDQUFDO1lBQ0gsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQUMsUUFBUSxFQUFFLE9BQU8sQ0FBQyxFQUFFLENBQUM7Z0JBQzFELE1BQU0sQ0FBQyxJQUFJLENBQUMsNkNBQTZDLENBQUMsQ0FBQztZQUM3RCxDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxDQUM5RCxVQUFtQixFQUNULEVBQUU7SUFDWixJQUFJLENBQUMsVUFBVSxJQUFJLE9BQU8sVUFBVSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDL0UsT0FBTyxDQUFDLHlDQUF5QyxDQUFDLENBQUM7SUFDckQsQ0FBQztJQUNELE1BQU0sT0FBTyxHQUFHLFVBQXFDLENBQUM7SUFDdEQsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUNqRSxjQUFjO1FBQ2Qsb0JBQW9CO1FBQ3BCLFVBQVU7UUFDVixVQUFVO0tBQ1gsQ0FBQyxFQUFFLENBQUM7UUFDSCxNQUFNLENBQUMsSUFBSSxDQUFDLGlEQUFpRCxDQUFDLENBQUM7SUFDakUsQ0FBQztJQUNELElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRO1dBQ3hELE9BQVEsT0FBTyxDQUFDLFFBQW9DLENBQUMsR0FBRyxLQUFLLFFBQVEsRUFBRSxDQUFDO1FBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxPQUFPLE9BQU8sQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUN2QyxDQUFDLHdCQUF3QixDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztRQUMxRCxNQUFNLENBQUMsSUFBSSxDQUFDLGlDQUFpQyxDQUFDLENBQUM7SUFDakQsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQyxrQkFBa0IsQ0FBQztXQUMvQyxPQUFPLENBQUMsa0JBQTZCLEdBQUcsQ0FBQyxFQUFFLENBQUM7UUFDaEQsTUFBTSxDQUFDLElBQUksQ0FBQyxvREFBb0QsQ0FBQyxDQUFDO0lBQ3BFLENBQUM7SUFDRCxJQUFJLE9BQU8sT0FBTyxDQUFDLFFBQVEsS0FBSyxRQUFRLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDNUYsTUFBTSxDQUFDLElBQUksQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxJQUFJLFdBQVcsSUFBSSxPQUFPLElBQUksZ0JBQWdCLElBQUksT0FBTyxFQUFFLENBQUM7UUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixPQUFPLEVBQUUsK0JBQStCLEVBQUUsQ0FBQztBQUUzQyxNQUFNLHNCQUFzQixHQUFHLHFDQUFxQyxDQUFDO0FBQ3JFLE1BQU0sdUJBQXVCLEdBQUcseUJBQXlCLENBQUM7QUFDMUQsTUFBTSxnQkFBZ0IsR0FBRyxJQUFJLEdBQUcsQ0FBOEI7SUFDNUQsYUFBYTtJQUNiLGFBQWE7Q0FDZCxDQUFDLENBQUM7QUFDSCxNQUFNLG1CQUFtQixHQUFHLElBQUksQ0FBQztBQUVqQyxNQUFNLGVBQWUsR0FBRyxDQUFDLFFBQWlCLEVBQXVDLEVBQUUsQ0FBQyxDQUNsRixPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsQ0FDOUUsQ0FBQztBQUVGLE1BQU0sbUJBQW1CLEdBQUcsQ0FDMUIsUUFBaUMsRUFDakMsT0FBaUIsRUFDUixFQUFFLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztBQUVuRyxNQUFNLGtCQUFrQixHQUFHLENBQ3pCLFFBQWlDLEVBQ2pDLE9BQWlCLEVBQ1IsRUFBRSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7QUFFaEYsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUNyRSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksc0JBQXNCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUN0RSxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSxvQkFBb0IsR0FBRyxLQUFLLEVBQUUsUUFBZ0IsRUFBMEIsRUFBRTtJQUM5RSxNQUFNLEtBQUssR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNqRCxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULEtBQUssQ0FBQyxNQUFxQixDQUM1QixDQUFDLENBQUM7SUFDSCxPQUFPLFVBQVUsQ0FBQyxHQUFHLE1BQU0sQ0FBQztTQUN6QixHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztTQUN2RCxJQUFJLENBQUMsRUFBRSxDQUFDLEVBQW1CLENBQUM7QUFDakMsQ0FBQyxDQUFDO0FBMkJGLE1BQU0sQ0FBQyxNQUFNLGdEQUFnRCxHQUFHLENBQzlELFVBQW1CLEVBQ1QsRUFBRTtJQUNaLElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO2VBQzNCLENBQUMsbUJBQW1CLENBQUMsVUFBVSxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUM7ZUFDOUMsQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztlQUNyQyxDQUFDLG1CQUFtQixDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztlQUNsRCxPQUFPLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxLQUFLLFFBQVE7ZUFDM0MsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFDLE9BQU8sQ0FBQyw0RUFBNEUsQ0FBQyxDQUFDO1FBQ3hGLENBQUM7UUFDRCxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsc0VBQXNFLENBQUMsQ0FBQztJQUNsRixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsUUFBaUIsRUFDUCxFQUFFO0lBQ1osSUFBSSxDQUFDO1FBQ0gsSUFBSSxDQUFDLGVBQWUsQ0FBQyxRQUFRLENBQUM7ZUFDekIsQ0FBQyxtQkFBbUIsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNuRixPQUFPLENBQUMsNkRBQTZELENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksUUFBUSxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNqQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJEQUEyRCxDQUFDLENBQUM7UUFDM0UsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5QixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7Z0JBQzVFLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztZQUMxRSxDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQztRQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELE1BQU0sZUFBZSxHQUFHLDBCQUEwQixDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUN4RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsb0JBQW9CLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNsRixJQUFJLGVBQWUsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDakMsTUFBTSxVQUFVLEdBQUcsUUFBUSxDQUFDLFVBQXdDLENBQUM7WUFDckUsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEdBQUcsVUFBVSxDQUFDLEdBQUcsQ0FBQyxDQUFDLFlBQVksRUFBRSxFQUFFLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUM7WUFDbEcsSUFBSSxRQUFRLENBQUMsVUFBVSxLQUFLLGtCQUFrQixFQUFFLENBQUM7Z0JBQy9DLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztZQUMvRixDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsOERBQThELENBQUMsQ0FBQztJQUMxRSxDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBNkJGLCtFQUErRTtBQUMvRSxNQUFNLENBQUMsTUFBTSxzQ0FBc0MsR0FDakQsbUNBQTRDLENBQUM7QUFpQi9DLE1BQU0sQ0FBQyxNQUFNLDhEQUE4RCxHQUFHLENBQzVFLFVBQW1CLEVBQ1QsRUFBRTtJQUNaLElBQUksQ0FBQztRQUNILElBQUksQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDO2VBQzNCLENBQUMsbUJBQW1CLENBQUMsVUFBVSxFQUFFLENBQUMsVUFBVSxDQUFDLENBQUM7ZUFDOUMsQ0FBQyxlQUFlLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQztlQUNyQyxDQUFDLG1CQUFtQixDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQztlQUNsRCxPQUFPLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxLQUFLLFFBQVE7ZUFDM0MsVUFBVSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzFDLE9BQU8sQ0FBQyxrRkFBa0YsQ0FBQyxDQUFDO1FBQzlGLENBQUM7UUFDRCxPQUFPLEVBQUUsQ0FBQztJQUNaLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsNEVBQTRFLENBQUMsQ0FBQztJQUN4RixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBZUYsTUFBTSxxQkFBcUIsR0FBRyxDQUM1QixPQUEyQyxFQUMzQyxRQUE0QyxFQUNwQyxFQUFFO0lBQ1YsS0FBSyxNQUFNLENBQUMsSUFBSSxFQUFFLEtBQUssQ0FBQyxJQUFJO1FBQzFCLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTSxDQUFDO1FBQ2pDLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDO1FBQ3JDLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsUUFBUSxDQUFDO0tBQ3RDLEVBQUUsQ0FBQztRQUNGLElBQUksSUFBSSxHQUFHLEtBQUs7WUFBRSxPQUFPLENBQUMsQ0FBQyxDQUFDO1FBQzVCLElBQUksSUFBSSxHQUFHLEtBQUs7WUFBRSxPQUFPLENBQUMsQ0FBQztJQUM3QixDQUFDO0lBQ0QsT0FBTyxDQUFDLENBQUM7QUFDWCxDQUFDLENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQzdCLFNBQTZDLEVBQ1QsRUFBRSxDQUFDLENBQUM7SUFDeEMsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNO0lBQ3hCLFFBQVEsRUFBRSxTQUFTLENBQUMsUUFBUTtJQUM1QixRQUFRLEVBQUUsU0FBUyxDQUFDLFFBQVE7Q0FDN0IsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsQ0FDM0QsVUFBZ0QsRUFDeEMsRUFBRSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUM7SUFDMUIsYUFBYSxFQUFFLENBQUM7SUFDaEIsT0FBTyxFQUFFLFVBQVUsQ0FBQyxHQUFHLENBQUMsc0JBQXNCLENBQUM7Q0FDaEQsQ0FBQyxDQUFDO0FBRUgsTUFBTSxDQUFDLE1BQU0seUNBQXlDLEdBQUcsS0FBSyxFQUM1RCxVQUFnRCxFQUN4QixFQUFFLENBQUMsb0JBQW9CLENBQy9DLDZDQUE2QyxDQUFDLFVBQVUsQ0FBQyxDQUMxRCxDQUFDO0FBRUYsTUFBTSxzQkFBc0IsR0FBRyxDQUM3QixVQUFtQixFQUNuQixPQUFlLEVBQ0wsRUFBRTtJQUNaLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQztXQUN6QixVQUFVLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDdkIsVUFBVSxDQUFDLE1BQU0sR0FBRyxtQkFBbUIsRUFBRSxDQUFDO1FBQzdDLE9BQU8sQ0FBQyxHQUFHLE9BQU8sb0NBQW9DLENBQUMsQ0FBQztJQUMxRCxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksUUFBd0QsQ0FBQztJQUM3RCxNQUFNLE9BQU8sR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO0lBQ2xDLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUFVLENBQUM7SUFDcEMsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFNBQVMsQ0FBQyxJQUFJLFVBQVUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3RELElBQUksQ0FBQyxlQUFlLENBQUMsU0FBUyxDQUFDO2VBQzFCLENBQUMsbUJBQW1CLENBQUMsU0FBUyxFQUFFLENBQUMsUUFBUSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxLQUFLLDZCQUE2QixDQUFDLENBQUM7WUFDOUQsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxLQUFLLG1DQUFtQyxDQUFDLENBQUM7UUFDdEUsQ0FBQztRQUNELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLFFBQXVDLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFDRCxJQUFJLG1CQUFtQixDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUM7ZUFDcEMsbUJBQW1CLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQztlQUN2QyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsU0FBUyxDQUFDLFFBQXVDLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sTUFBTSxHQUFHLFNBQTBELENBQUM7WUFDMUUsSUFBSSxRQUFRLElBQUkscUJBQXFCLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUM3RCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw0REFBNEQsQ0FBQyxDQUFDO1lBQ3RGLENBQUM7WUFDRCxRQUFRLEdBQUcsTUFBTSxDQUFDO1lBQ2xCLElBQUksT0FBTyxDQUFDLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDO2dCQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHlCQUF5QixDQUFDLENBQUM7WUFDakYsSUFBSSxTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUM7Z0JBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sMkJBQTJCLENBQUMsQ0FBQztZQUN2RixPQUFPLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMzQixTQUFTLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztRQUNqQyxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sd0JBQXdCLEdBQUcsQ0FDL0IsWUFBcUIsRUFDckIsT0FBZSxFQUNMLEVBQUU7SUFDWixJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUM7V0FDM0IsWUFBWSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3pCLFlBQVksQ0FBQyxNQUFNLEdBQUcsZ0JBQWdCLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDakQsT0FBTyxDQUFDLEdBQUcsT0FBTyxvQ0FBb0MsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsTUFBTSxTQUFTLEdBQWEsRUFBRSxDQUFDO0lBQy9CLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUMxRCxJQUFJLENBQUMsZUFBZSxDQUFDLFdBQVcsQ0FBQztlQUM1QixDQUFDLG1CQUFtQixDQUFDLFdBQVcsRUFBRTtnQkFDbkMsVUFBVTtnQkFDVixvQ0FBb0M7Z0JBQ3BDLDhCQUE4QjthQUMvQixDQUFDLEVBQUUsQ0FBQztZQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksS0FBSyw2QkFBNkIsQ0FBQyxDQUFDO1lBQzlELFNBQVM7UUFDWCxDQUFDO1FBQ0QsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBa0IsQ0FBQyxDQUFDO1FBQy9DLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLFFBQXVDLENBQUMsRUFBRSxDQUFDO1lBQy9FLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksS0FBSyw4QkFBOEIsQ0FBQyxDQUFDO1FBQ2pFLENBQUM7UUFDRCxJQUFJLE9BQU8sV0FBVyxDQUFDLGtDQUFrQyxLQUFLLFFBQVE7ZUFDakUsQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLGtDQUFrQyxDQUFDO2VBQy9ELE9BQU8sV0FBVyxDQUFDLDRCQUE0QixLQUFLLFFBQVE7ZUFDNUQsQ0FBQyxjQUFjLENBQUMsV0FBVyxDQUFDLDRCQUE0QixDQUFDLEVBQUUsQ0FBQztZQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxJQUFJLEtBQUssNkJBQTZCLENBQUMsQ0FBQztRQUNoRSxDQUFDO0lBQ0gsQ0FBQztJQUNELElBQUksSUFBSSxHQUFHLENBQUMsU0FBUyxDQUFDLENBQUMsSUFBSSxLQUFLLFNBQVMsQ0FBQyxNQUFNO1dBQzNDLElBQUksQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxDQUFDLEdBQUcsU0FBUyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxDQUFDO1FBQ3pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLHNDQUFzQyxDQUFDLENBQUM7SUFDaEUsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sMEJBQTBCLEdBQUcsQ0FBQyxZQUE0QyxFQUFVLEVBQUUsQ0FBQyxDQUMzRixJQUFJLENBQUMsU0FBUyxDQUFDO0lBQ2IsYUFBYSxFQUFFLFlBQVksQ0FBQyxhQUFhO0lBQ3pDLGNBQWMsRUFBRSxZQUFZLENBQUMsY0FBYztJQUMzQyxTQUFTLEVBQUUsWUFBWSxDQUFDLFNBQVM7SUFDakMsVUFBVSxFQUFFLFlBQVksQ0FBQyxVQUFVO0lBQ25DLFdBQVcsRUFBRSxZQUFZLENBQUMsV0FBVztJQUNyQyxjQUFjLEVBQUUsWUFBWSxDQUFDLGNBQWM7Q0FDNUMsQ0FBQyxDQUNILENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSx5Q0FBeUMsR0FBRyxLQUFLLEVBQzVELGVBQXdCLEVBQ3hCLGNBQXVCLEVBQ0osRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7UUFDNUIsSUFBSSxDQUFDLGVBQWUsQ0FBQyxjQUFjLENBQUM7ZUFDL0IsQ0FBQyxtQkFBbUIsQ0FBQyxjQUFjLEVBQUU7Z0JBQ3RDLG9CQUFvQjtnQkFDcEIsbUJBQW1CO2dCQUNuQixTQUFTO2dCQUNULDhCQUE4QjtnQkFDOUIsdUJBQXVCO2dCQUN2QixpQkFBaUI7YUFDbEIsQ0FBQyxFQUFFLENBQUM7WUFDTCxPQUFPLENBQUMsbUVBQW1FLENBQUMsQ0FBQztRQUMvRSxDQUFDO1FBQ0QsSUFBSSxjQUFjLENBQUMsa0JBQWtCLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDNUMsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO1FBQzFFLENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsY0FBYyxDQUFDLGlCQUFpQixDQUFDLEVBQUUsQ0FBQztZQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLDZEQUE2RCxDQUFDLENBQUM7UUFDN0UsQ0FBQztRQUNELE1BQU0sb0JBQW9CLEdBQUcsc0JBQXNCLENBQUMsY0FBYyxDQUFDLE9BQU8sRUFBRSxrQkFBa0IsQ0FBQyxDQUFDO1FBQ2hHLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx3QkFBd0IsQ0FDckMsY0FBYyxDQUFDLHFCQUFxQixFQUNwQyxpQ0FBaUMsQ0FDbEMsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxPQUFPLGNBQWMsQ0FBQyw0QkFBNEIsS0FBSyxRQUFRO2VBQzlELENBQUMsY0FBYyxDQUFDLGNBQWMsQ0FBQyw0QkFBNEIsQ0FBQyxFQUFFLENBQUM7WUFDbEUsTUFBTSxDQUFDLElBQUksQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1FBQzVFLENBQUM7UUFDRCxNQUFNLHVCQUF1QixHQUFHLCtCQUErQixDQUFDLGNBQWMsQ0FBQyxlQUFlLENBQUMsQ0FBQztRQUNoRyxJQUFJLHVCQUF1QixDQUFDLE1BQU0sR0FBRyxDQUFDO2VBQ2pDLENBQUMsZUFBZSxDQUFDLGNBQWMsQ0FBQyxlQUFlLENBQUM7ZUFDaEQsY0FBYyxDQUFDLGVBQWUsQ0FBQyxjQUFjLEtBQUssUUFBUSxFQUFFLENBQUM7WUFDaEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO1FBQ3hFLENBQUM7UUFDRCxJQUFJLENBQUMsZUFBZSxDQUFDLGVBQWUsQ0FBQztlQUNoQyxDQUFDLG1CQUFtQixDQUFDLGVBQWUsRUFBRTtnQkFDdkMscUJBQXFCO2dCQUNyQixtQkFBbUI7Z0JBQ25CLGNBQWM7Z0JBQ2QsU0FBUztnQkFDVCxlQUFlO2dCQUNmLGNBQWM7Z0JBQ2QsY0FBYztnQkFDZCxpQkFBaUI7Z0JBQ2pCLDhCQUE4QjtnQkFDOUIsd0JBQXdCO2FBQ3pCLENBQUMsRUFBRSxDQUFDO1lBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQyx1REFBdUQsQ0FBQyxDQUFDO1lBQ3JFLE9BQU8sTUFBTSxDQUFDO1FBQ2hCLENBQUM7UUFDRCxJQUFJLGVBQWUsQ0FBQyxtQkFBbUIsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUM5QyxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDOUQsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxlQUFlLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1lBQzVELE1BQU0sQ0FBQyxJQUFJLENBQUMsb0RBQW9ELENBQUMsQ0FBQztRQUNwRSxDQUFDO2FBQU0sSUFBSSxlQUFlLENBQUMsaUJBQWlCLEtBQUssY0FBYyxDQUFDLGlCQUFpQixFQUFFLENBQUM7WUFDbEYsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7UUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsZUFBZSxDQUFDLFlBQVksQ0FBQztlQUNuRCxDQUFDLHFCQUFxQixDQUFDLGVBQWUsQ0FBQyxzQkFBc0IsQ0FBQyxFQUFFLENBQUM7WUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7UUFDRCxNQUFNLHdCQUF3QixHQUFHLHNCQUFzQixDQUNyRCxlQUFlLENBQUMsT0FBTyxFQUN2QixzQkFBc0IsQ0FDdkIsQ0FBQztRQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx3QkFBd0IsQ0FBQyxDQUFDO1FBQ3pDLElBQUksT0FBTyxlQUFlLENBQUMsYUFBYSxLQUFLLFFBQVE7ZUFDaEQsQ0FBQyxjQUFjLENBQUMsZUFBZSxDQUFDLGFBQWEsQ0FBQyxFQUFFLENBQUM7WUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQyxnREFBZ0QsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7UUFDRCxJQUFJLE9BQU8sZUFBZSxDQUFDLDRCQUE0QixLQUFLLFFBQVE7ZUFDL0QsQ0FBQyxjQUFjLENBQUMsZUFBZSxDQUFDLDRCQUE0QixDQUFDLEVBQUUsQ0FBQztZQUNuRSxNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7UUFDbEYsQ0FBQztRQUNELE1BQU0sMkJBQTJCLEdBQUcsK0JBQStCLENBQUMsZUFBZSxDQUFDLGVBQWUsQ0FBQyxDQUFDO1FBQ3JHLElBQUksMkJBQTJCLENBQUMsTUFBTSxHQUFHLENBQUM7ZUFDckMsQ0FBQyxlQUFlLENBQUMsZUFBZSxDQUFDLGVBQWUsQ0FBQztlQUNqRCxlQUFlLENBQUMsZUFBZSxDQUFDLGNBQWMsS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUNqRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7UUFDcEYsQ0FBQztRQUNELElBQUksQ0FBQyxlQUFlLENBQUMsZUFBZSxDQUFDLFlBQVksQ0FBQztlQUM3QyxDQUFDLGtCQUFrQixDQUFDLGVBQWUsQ0FBQyxZQUFZLEVBQUU7Z0JBQ25ELGlDQUFpQztnQkFDakMsMkJBQTJCO2dCQUMzQix1QkFBdUI7Z0JBQ3ZCLDZCQUE2QjtnQkFDN0Isa0NBQWtDO2dCQUNsQyxnQ0FBZ0M7Z0JBQ2hDLCtCQUErQjthQUNoQyxDQUFDO2VBQ0MsZUFBZSxDQUFDLFlBQVksQ0FBQywrQkFBK0IsS0FBSyxDQUFDO2VBQ2xFLGVBQWUsQ0FBQyxZQUFZLENBQUMscUJBQXFCLEtBQUssQ0FBQztlQUN4RCxlQUFlLENBQUMsWUFBWSxDQUFDLDJCQUEyQixLQUFLLENBQUM7ZUFDOUQsZUFBZSxDQUFDLFlBQVksQ0FBQyxnQ0FBZ0MsS0FBSyxDQUFDO2VBQ25FLGVBQWUsQ0FBQyxZQUFZLENBQUMsOEJBQThCLEtBQUssQ0FBQztlQUNqRSxlQUFlLENBQUMsWUFBWSxDQUFDLDZCQUE2QixLQUFLLENBQUM7ZUFDaEUsQ0FBQyxlQUFlLENBQUMsWUFBWSxDQUFDLHlCQUF5QixLQUFLLFNBQVM7bUJBQ25FLGVBQWUsQ0FBQyxZQUFZLENBQUMseUJBQXlCLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNyRSxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7UUFDeEYsQ0FBQztRQUNELElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLGVBQWUsQ0FBQyxZQUFZLENBQUM7ZUFDM0MsZUFBZSxDQUFDLFlBQVksQ0FBQyxNQUFNLEtBQUssQ0FBQztlQUN6QyxlQUFlLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxtQkFBbUIsRUFBRSxDQUFDO1lBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztRQUNoRixDQUFDO2FBQU0sQ0FBQztZQUNOLE1BQU0sZUFBZSxHQUF5QyxFQUFFLENBQUM7WUFDakUsTUFBTSxpQkFBaUIsR0FBdUMsRUFBRSxDQUFDO1lBQ2pFLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsSUFBSSxlQUFlLENBQUMsWUFBWSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7Z0JBQzFFLElBQUksQ0FBQyxlQUFlLENBQUMsV0FBVyxDQUFDO3VCQUM1QixDQUFDLG1CQUFtQixDQUFDLFdBQVcsRUFBRTt3QkFDbkMsUUFBUTt3QkFDUixVQUFVO3dCQUNWLFVBQVU7d0JBQ1Ysb0NBQW9DO3dCQUNwQyw4QkFBOEI7cUJBQy9CLENBQUMsRUFBRSxDQUFDO29CQUNMLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLEtBQUssNkJBQTZCLENBQUMsQ0FBQztvQkFDL0UsU0FBUztnQkFDWCxDQUFDO2dCQUNELGVBQWUsQ0FBQyxJQUFJLENBQUM7b0JBQ25CLE1BQU0sRUFBRSxXQUFXLENBQUMsTUFBZ0I7b0JBQ3BDLFFBQVEsRUFBRSxXQUFXLENBQUMsUUFBa0I7b0JBQ3hDLFFBQVEsRUFBRSxXQUFXLENBQUMsUUFBdUM7aUJBQzlELENBQUMsQ0FBQztnQkFDSCxpQkFBaUIsQ0FBQyxJQUFJLENBQUM7b0JBQ3JCLFFBQVEsRUFBRSxXQUFXLENBQUMsUUFBdUM7b0JBQzdELGtDQUFrQyxFQUNoQyxXQUFXLENBQUMsa0NBQW1EO29CQUNqRSw0QkFBNEIsRUFBRSxXQUFXLENBQUMsNEJBQTZDO2lCQUN4RixDQUFDLENBQUM7Z0JBQ0gsSUFBSSxPQUFPLFdBQVcsQ0FBQyxrQ0FBa0MsS0FBSyxRQUFRO3VCQUNqRSxDQUFDLGNBQWMsQ0FBQyxXQUFXLENBQUMsa0NBQWtDLENBQUM7dUJBQy9ELE9BQU8sV0FBVyxDQUFDLDRCQUE0QixLQUFLLFFBQVE7dUJBQzVELENBQUMsY0FBYyxDQUFDLFdBQVcsQ0FBQyw0QkFBNEIsQ0FBQyxFQUFFLENBQUM7b0JBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0JBQStCLEtBQUssNkJBQTZCLENBQUMsQ0FBQztnQkFDakYsQ0FBQztZQUNILENBQUM7WUFDRCxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsZUFBZSxFQUFFLGlDQUFpQyxDQUFDLENBQUMsQ0FBQztZQUMzRixJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztnQkFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1lBQy9GLENBQUM7WUFDRCxNQUFNLGlCQUFpQixHQUFHLElBQUksR0FBRyxDQUc5QixjQUFjLENBQUMscUJBQTREO2lCQUMzRSxHQUFHLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUMsV0FBVyxDQUFDLFFBQVEsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDOUQsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFdBQVcsQ0FBQyxJQUFJLGlCQUFpQixDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7Z0JBQy9ELE1BQU0sZ0JBQWdCLEdBQUcsaUJBQWlCLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsQ0FBQztnQkFDckUsSUFBSSxDQUFDLGdCQUFnQjt1QkFDaEIsZ0JBQWdCLENBQUMsa0NBQWtDOzRCQUNoRCxXQUFXLENBQUMsa0NBQWtDO3VCQUNqRCxnQkFBZ0IsQ0FBQyw0QkFBNEI7NEJBQzFDLFdBQVcsQ0FBQyw0QkFBNEIsRUFBRSxDQUFDO29CQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLCtCQUErQixLQUFLLHdDQUF3QyxDQUFDLENBQUM7Z0JBQzVGLENBQUM7WUFDSCxDQUFDO1FBQ0gsQ0FBQztRQUNELElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLEtBQUssSUFBSSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztZQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLDJFQUEyRSxDQUFDLENBQUM7UUFDM0YsQ0FBQztRQUNELElBQUksb0JBQW9CLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSx3QkFBd0IsQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFLENBQUM7WUFDL0UsTUFBTSxxQkFBcUIsR0FBRyxNQUFNLHlDQUF5QyxDQUMzRSxjQUFjLENBQUMsT0FBK0MsQ0FDL0QsQ0FBQztZQUNGLElBQUksZUFBZSxDQUFDLGFBQWEsS0FBSyxxQkFBcUIsRUFBRSxDQUFDO2dCQUM1RCxNQUFNLENBQUMsSUFBSSxDQUFDLHdFQUF3RSxDQUFDLENBQUM7WUFDeEYsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLGVBQWUsQ0FBQyw0QkFBNEI7Z0JBQzFDLGNBQWMsQ0FBQyw0QkFBNEIsRUFBRSxDQUFDO1lBQ2xELE1BQU0sQ0FBQyxJQUFJLENBQUMseURBQXlELENBQUMsQ0FBQztRQUN6RSxDQUFDO1FBQ0QsSUFBSSwyQkFBMkIsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLHVCQUF1QixDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQy9FLDBCQUEwQixDQUMzQixlQUFlLENBQUMsZUFBNEQsQ0FDN0UsS0FBSywwQkFBMEIsQ0FDOUIsY0FBYyxDQUFDLGVBQTRELENBQzVFLEVBQUUsQ0FBQztZQUNKLE1BQU0sQ0FBQyxJQUFJLENBQUMsMkVBQTJFLENBQUMsQ0FBQztRQUMzRixDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNQLE9BQU8sQ0FBQyx3RUFBd0UsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7QUFDSCxDQUFDLENBQUM7QUFnRUYsTUFBTSwwQkFBMEIsR0FBRyxDQUNqQyxZQUE4QyxFQUNaLEVBQUUsQ0FBQyxDQUFDO0lBQ3RDLFVBQVUsRUFBRSxZQUFZLENBQUMsVUFBVTtJQUNuQyxjQUFjLEVBQUUsWUFBWSxDQUFDLGNBQWM7SUFDM0MsU0FBUyxFQUFFLFlBQVksQ0FBQyxTQUFTO0lBQ2pDLGNBQWMsRUFBRSxZQUFZLENBQUMsY0FBYztJQUMzQyxzQkFBc0IsRUFBRSxZQUFZLENBQUMsc0JBQXNCO0lBQzNELG9CQUFvQixFQUFFLFlBQVksQ0FBQyxvQkFBb0I7SUFDdkQsZ0JBQWdCLEVBQUUsWUFBWSxDQUFDLGdCQUFnQjtJQUMvQyxlQUFlLEVBQUUsWUFBWSxDQUFDLGVBQWU7SUFDN0MsdUJBQXVCLEVBQUUsWUFBWSxDQUFDLHVCQUF1QjtDQUM5RCxDQUFDLENBQUM7QUFFSCxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxTQUE2RSxFQUNyRSxFQUFFO0lBQ1YsTUFBTSxNQUFNLEdBQUc7UUFDYixhQUFhLEVBQUUsU0FBUyxDQUFDLGFBQWE7UUFDdEMsaUJBQWlCLEVBQUUsU0FBUyxDQUFDLGlCQUFpQjtRQUM5QyxjQUFjLEVBQUUsU0FBUyxDQUFDLGNBQWM7UUFDeEMsU0FBUyxFQUFFLFNBQVMsQ0FBQyxTQUFTO1FBQzlCLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxvQkFBb0I7UUFDcEQsZUFBZSxFQUFFLDBCQUEwQixDQUFDLFNBQVMsQ0FBQyxlQUFlLENBQUM7UUFDdEUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNO0tBQ3pCLENBQUM7SUFDRixJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDbkMsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3BCLEdBQUcsTUFBTTtZQUNULGVBQWUsRUFBRSwwQkFBMEIsQ0FBQyxTQUFTLENBQUMsZUFBZSxDQUFDO1lBQ3RFLFVBQVUsRUFBRSxTQUFTLENBQUMsVUFBVTtTQUNqQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBQ0QsSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQ25DLE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQztZQUNwQixHQUFHLE1BQU07WUFDVCxHQUFHLENBQUMsU0FBUyxDQUFDLGdCQUFnQjtnQkFDNUIsQ0FBQyxDQUFDLEVBQUUsZ0JBQWdCLEVBQUUsMEJBQTBCLENBQUMsU0FBUyxDQUFDLGdCQUFnQixDQUFDLEVBQUU7Z0JBQzlFLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDUCxXQUFXLEVBQUUsU0FBUyxDQUFDLFdBQVc7WUFDbEMsVUFBVSxFQUFFLFNBQVMsQ0FBQyxVQUFVO1NBQ2pDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFDRCxJQUFJLFNBQVMsQ0FBQyxNQUFNLEtBQUssUUFBUSxFQUFFLENBQUM7UUFDbEMsT0FBTyxJQUFJLENBQUMsU0FBUyxDQUFDO1lBQ3BCLEdBQUcsTUFBTTtZQUNULFdBQVcsRUFBRSxTQUFTLENBQUMsV0FBVztZQUNsQyxVQUFVLEVBQUUsU0FBUyxDQUFDLFVBQVU7U0FDakMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUNELE9BQU8sSUFBSSxDQUFDLFNBQVMsQ0FBQyxFQUFFLEdBQUcsTUFBTSxFQUFFLFVBQVUsRUFBRSxTQUFTLENBQUMsVUFBVSxFQUFFLENBQUMsQ0FBQztBQUN6RSxDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxLQUFLLEVBQ3RELFNBQTZFLEVBQ3JELEVBQUUsQ0FBQyxvQkFBb0IsQ0FDL0MsdUNBQXVDLENBQUMsU0FBUyxDQUFDLENBQ25ELENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyxLQUFLLEVBQ3JELFNBQWtCLEVBQ0EsRUFBRTtJQUNwQixJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsZUFBZSxDQUFDLFNBQVMsQ0FBQztlQUMxQixPQUFPLFNBQVMsQ0FBQyxZQUFZLEtBQUssUUFBUTtlQUMxQyxDQUFDLGNBQWMsQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUM3QyxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxPQUFPLFNBQVMsQ0FBQyxZQUFZLEtBQUssTUFBTSxtQ0FBbUMsQ0FDekUsU0FBaUQsQ0FDbEQsQ0FBQztJQUNKLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLEtBQUssQ0FBQztJQUNmLENBQUM7QUFDSCxDQUFDLENBQUM7QUFFRjs7O0dBR0c7QUFDSCxNQUFNLENBQUMsTUFBTSxxQ0FBcUMsR0FBRyxLQUFLLEVBQ3hELFVBQW1CLEVBQ25CLG9CQUE0QixFQUM1Qiw0QkFBb0MsRUFDakIsRUFBRTtJQUNyQixJQUFJLENBQUM7UUFDSCxJQUFJLENBQUMsbUJBQW1CLENBQUMsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQy9DLE9BQU8sQ0FBQywrQ0FBK0MsQ0FBQyxDQUFDO1FBQzNELENBQUM7UUFDRCxJQUFJLENBQUMsbUJBQW1CLENBQUMsNEJBQTRCLENBQUMsRUFBRSxDQUFDO1lBQ3ZELE9BQU8sQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFDRCxJQUFJLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7WUFDakMsT0FBTyxDQUFDLG9EQUFvRCxDQUFDLENBQUM7UUFDaEUsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxNQUFNLENBQUM7UUFDakMsTUFBTSxVQUFVLEdBQUc7WUFDakIsVUFBVTtZQUNWLGVBQWU7WUFDZixtQkFBbUI7WUFDbkIsZ0JBQWdCO1lBQ2hCLFdBQVc7WUFDWCxzQkFBc0I7WUFDdEIsaUJBQWlCO1lBQ2pCLFFBQVE7WUFDUixZQUFZO1lBQ1osY0FBYztTQUNmLENBQUM7UUFDRixNQUFNLFlBQVksR0FBRyxNQUFNLEtBQUssU0FBUztZQUN2QyxDQUFDLENBQUMsQ0FBQyxHQUFHLFVBQVUsRUFBRSxpQkFBaUIsQ0FBQztZQUNwQyxDQUFDLENBQUMsTUFBTSxLQUFLLFNBQVM7Z0JBQ3BCLENBQUMsQ0FBQyxDQUFDLEdBQUcsVUFBVSxFQUFFLGFBQWEsRUFBRSxHQUFHLENBQUMsVUFBVSxDQUFDLGdCQUFnQixLQUFLLFNBQVM7d0JBQzVFLENBQUMsQ0FBQyxFQUFFO3dCQUNKLENBQUMsQ0FBQyxDQUFDLGtCQUFrQixDQUFDLENBQUMsQ0FBQztnQkFDMUIsQ0FBQyxDQUFDLE1BQU0sS0FBSyxRQUFRO29CQUNuQixDQUFDLENBQUMsQ0FBQyxHQUFHLFVBQVUsRUFBRSxhQUFhLENBQUM7b0JBQ2hDLENBQUMsQ0FBQyxVQUFVLENBQUM7UUFDbkIsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO1FBQzVCLElBQUksQ0FBQyxDQUFDLFVBQVUsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxNQUFnQixDQUFDO2VBQ3ZFLENBQUMsbUJBQW1CLENBQUMsVUFBVSxFQUFFLFlBQVksQ0FBQyxFQUFFLENBQUM7WUFDcEQsTUFBTSxDQUFDLElBQUksQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1FBQzNFLENBQUM7UUFDRCxJQUFJLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7ZUFDcEMsQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7ZUFDbEQsT0FBTyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsS0FBSyxRQUFRO2VBQzNDLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUMxQyxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksVUFBVSxDQUFDLGFBQWEsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNuQyxNQUFNLENBQUMsSUFBSSxDQUFDLGtEQUFrRCxDQUFDLENBQUM7UUFDbEUsQ0FBQztRQUNELElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLENBQUMsaUJBQWlCLENBQUM7ZUFDakQsQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztZQUNoRCxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7UUFDNUUsQ0FBQzthQUFNLElBQUksVUFBVSxDQUFDLGlCQUFpQixLQUFLLDRCQUE0QixFQUFFLENBQUM7WUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyw0RUFBNEUsQ0FBQyxDQUFDO1FBQzVGLENBQUM7UUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLGNBQWMsQ0FBQztlQUNoRCxDQUFDLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQztlQUN2RCxDQUFDLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQ25ELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUZBQXVGLENBQUMsQ0FBQztRQUN2RyxDQUFDO1FBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHVDQUF1QyxDQUNwRCxVQUFVLENBQUMsZUFBZSxFQUMxQixvQkFBb0IsQ0FDckIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLG9CQUFvQixRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDckQsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDekIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHVDQUF1QyxDQUNwRCxVQUFVLENBQUMsZUFBZSxFQUMxQixvQkFBb0IsQ0FDckIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLG9CQUFvQixRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDckQsSUFBSSxDQUFDLHFDQUFxQyxDQUN4QyxVQUFVLENBQUMsZUFBbUQsRUFDOUQsVUFBVSxDQUFDLGVBQW1ELENBQy9ELEVBQUUsQ0FBQztnQkFDRixNQUFNLENBQUMsSUFBSSxDQUFDLGtFQUFrRSxDQUFDLENBQUM7WUFDbEYsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLE1BQU0sS0FBSyxTQUFTLElBQUksVUFBVSxDQUFDLGdCQUFnQixLQUFLLFNBQVMsRUFBRSxDQUFDO1lBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyx1Q0FBdUMsQ0FDcEQsVUFBVSxDQUFDLGdCQUFnQixFQUMzQixvQkFBb0IsQ0FDckIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLHFCQUFxQixRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDeEQsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLE1BQU0sS0FBSyxRQUFRLENBQUM7ZUFDNUMsQ0FBQyxPQUFPLFVBQVUsQ0FBQyxXQUFXLEtBQUssUUFBUTttQkFDekMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFdBQVcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM5RCxNQUFNLENBQUMsSUFBSSxDQUFDLHdEQUF3RCxDQUFDLENBQUM7UUFDeEUsQ0FBQztRQUNELElBQUksT0FBTyxVQUFVLENBQUMsWUFBWSxLQUFLLFFBQVE7ZUFDMUMsQ0FBQyxjQUFjLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztlQUN4QyxDQUFDLE1BQU0sa0NBQWtDLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUMzRCxNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7UUFDdEYsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxPQUFPLENBQUMsNkRBQTZELENBQUMsQ0FBQztJQUN6RSxDQUFDO0FBQ0gsQ0FBQyxDQUFDIn0=
|