@serve.zone/interfaces 25.1.0 → 25.2.0

package/dist_ts/runtime.corestore.js

@@ -0,0 +1,620 @@
+import * as plugins from './plugins.js';
+import { isSha256Digest } from './data/immutableimage.js';
+import { validateSecretRecipientMetadata, verifySecretEnvelopeContext, } from './data/secret.js';
+import { validateObjectStorageRetentionEvidence } from './platform/objectstorageretention.js';
+export const corestoreProviderConfigIds = Object.freeze({
+    database: 'cloudly-corestore-database',
+    objectstorage: 'cloudly-corestore-objectstorage',
+});
+export const corestoreControlUrl = 'http://corestore:3000';
+export const corestoreCredentialManagementScope = 'platform:cloudly-corestore';
+export const corestoreControlCredentialKey = 'CORESTORE_API_TOKEN';
+export const corestoreCredentialEnvironment = 'production';
+export const corestoreCredentialRuntimeLimits = Object.freeze({
+    maximumIdentifierLength: 200,
+    maximumPublicationGrants: 256,
+    maximumGrantLifetimeMs: 24 * 60 * 60 * 1000,
+    maximumCredentialStringBytes: 8 * 1024,
+    maximumSealedMaterialBytes: 64 * 1024,
+    minimumControlTokenBytes: 32,
+    maximumControlTokenBytes: 4096,
+    maximumSealedControlCredentialBytes: 12 * 1024,
+});
+export const getCorestoreProviderConfigId = (capabilityArg) => {
+    if (capabilityArg !== 'database' && capabilityArg !== 'objectstorage') {
+        throw new Error('corestore capability must be database or objectstorage');
+    }
+    return corestoreProviderConfigIds[capabilityArg];
+};
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9:._-]{0,199}$/;
+const bareSha256Pattern = /^[a-f0-9]{64}$/;
+const environmentKeyPattern = /^[A-Z_][A-Z0-9_]{0,127}$/;
+const isRecord = (valueArg) => (Boolean(valueArg)
+    && typeof valueArg === 'object'
+    && !Array.isArray(valueArg)
+    && (Object.getPrototypeOf(valueArg) === Object.prototype
+        || Object.getPrototypeOf(valueArg) === null));
+const hasExactKeys = (valueArg, keysArg) => {
+    const actual = Object.keys(valueArg).sort();
+    const expected = [...keysArg].sort();
+    return actual.length === expected.length
+        && actual.every((keyArg, indexArg) => keyArg === expected[indexArg]);
+};
+const hasKeys = (valueArg, requiredArg, optionalArg) => requiredArg.every((keyArg) => Object.hasOwn(valueArg, keyArg))
+    && Object.keys(valueArg).every((keyArg) => requiredArg.includes(keyArg)
+        || optionalArg.includes(keyArg));
+const isIdentifier = (valueArg) => (typeof valueArg === 'string' && identifierPattern.test(valueArg));
+const isPositiveSafeInteger = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg > 0);
+const isNonNegativeSafeInteger = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg >= 0 && !Object.is(valueArg, -0));
+const isJwtIdentity = (valueArg) => (isRecord(valueArg)
+    && hasExactKeys(valueArg, ['jwt'])
+    && typeof valueArg.jwt === 'string'
+    && valueArg.jwt.length > 0);
+const utf8ByteLength = (valueArg) => new TextEncoder().encode(valueArg).byteLength;
+const isCorestoreControlToken = (valueArg) => {
+    if (typeof valueArg !== 'string' || valueArg.length === 0 || /\s/u.test(valueArg))
+        return false;
+    const encoded = new TextEncoder().encode(valueArg);
+    let roundTrip;
+    try {
+        roundTrip = new TextDecoder('utf-8', { fatal: true }).decode(encoded);
+    }
+    catch {
+        return false;
+    }
+    return roundTrip === valueArg
+        && encoded.byteLength >= corestoreCredentialRuntimeLimits.minimumControlTokenBytes
+        && encoded.byteLength <= corestoreCredentialRuntimeLimits.maximumControlTokenBytes;
+};
+export const validateGetCorestoreControlCredentialMaterialRequest = (requestArg, activeRecipientArg) => {
+    if (!isRecord(requestArg)
+        || !hasExactKeys(requestArg, [
+            'identity',
+            'requestId',
+            'capability',
+            'expectedRecipientKeyId',
+            'expectedRecipientGeneration',
+        ])) {
+        return ['corestore control credential request must use its exact schema'];
+    }
+    const errors = [];
+    if (!isJwtIdentity(requestArg.identity)) {
+        errors.push('corestore control credential request requires only a JWT identity');
+    }
+    if (!isIdentifier(requestArg.requestId)
+        || !isIdentifier(requestArg.expectedRecipientKeyId)) {
+        errors.push('corestore control credential request identifiers must be canonical');
+    }
+    if (requestArg.capability !== 'database' && requestArg.capability !== 'objectstorage') {
+        errors.push('corestore control credential capability must be database or objectstorage');
+    }
+    if (!isPositiveSafeInteger(requestArg.expectedRecipientGeneration)) {
+        errors.push('corestore control credential recipient generation must be positive');
+    }
+    if (validateSecretRecipientMetadata(activeRecipientArg).length > 0
+        || activeRecipientArg.lifecycleState !== 'active'
+        || requestArg.expectedRecipientKeyId !== activeRecipientArg.recipientKeyId
+        || requestArg.expectedRecipientGeneration !== activeRecipientArg.generation) {
+        errors.push('corestore control credential request must target the active recipient');
+    }
+    return errors;
+};
+export const createCorestoreControlCredentialMaterialEnvelopeContext = (materialArg) => new TextEncoder().encode(JSON.stringify({
+    schemaVersion: 1,
+    purpose: 'serve.zone/corestore-control-credential-material',
+    requestId: materialArg.requestId,
+    clusterId: materialArg.clusterId,
+    capability: materialArg.capability,
+    providerConfigId: getCorestoreProviderConfigId(materialArg.capability),
+    controlUrl: corestoreControlUrl,
+    managementScope: corestoreCredentialManagementScope,
+    key: corestoreControlCredentialKey,
+    environment: corestoreCredentialEnvironment,
+    recipientKeyId: materialArg.recipientKeyId,
+    recipientGeneration: materialArg.recipientGeneration,
+}));
+export const validateCorestoreControlCredentialPlaintext = (plaintextArg) => {
+    if (!isRecord(plaintextArg)
+        || !hasExactKeys(plaintextArg, ['schemaVersion', 'key', 'environment', 'value'])) {
+        return ['corestore control credential plaintext must use its exact schema'];
+    }
+    const errors = [];
+    if (plaintextArg.schemaVersion !== 1
+        || plaintextArg.key !== corestoreControlCredentialKey
+        || plaintextArg.environment !== corestoreCredentialEnvironment) {
+        errors.push('corestore control credential plaintext constants must be canonical');
+    }
+    if (!isCorestoreControlToken(plaintextArg.value)) {
+        errors.push('corestore control credential value must be 32-4096 UTF-8 bytes without whitespace');
+    }
+    return errors;
+};
+export const validateCorestoreControlCredentialMaterial = async (materialArg, expectedArg) => {
+    if (!isRecord(materialArg)
+        || !hasExactKeys(materialArg, [
+            'schemaVersion',
+            'requestId',
+            'clusterId',
+            'capability',
+            'providerConfigId',
+            'controlUrl',
+            'managementScope',
+            'key',
+            'environment',
+            'recipientKeyId',
+            'recipientGeneration',
+            'envelope',
+        ])) {
+        return ['corestore control credential material must use its exact schema'];
+    }
+    const errors = [];
+    if (materialArg.schemaVersion !== 1
+        || !isIdentifier(materialArg.requestId)
+        || !isIdentifier(materialArg.clusterId)
+        || !isIdentifier(materialArg.recipientKeyId)
+        || !isPositiveSafeInteger(materialArg.recipientGeneration)) {
+        errors.push('corestore control credential material metadata must be canonical');
+    }
+    if (materialArg.capability !== 'database' && materialArg.capability !== 'objectstorage') {
+        errors.push('corestore control credential material capability must be canonical');
+    }
+    else if (materialArg.providerConfigId !== getCorestoreProviderConfigId(materialArg.capability)) {
+        errors.push('corestore control credential provider must be derived from capability');
+    }
+    if (materialArg.controlUrl !== corestoreControlUrl
+        || materialArg.managementScope !== corestoreCredentialManagementScope
+        || materialArg.key !== corestoreControlCredentialKey
+        || materialArg.environment !== corestoreCredentialEnvironment) {
+        errors.push('corestore control credential material constants must be canonical');
+    }
+    if (materialArg.requestId !== expectedArg.requestId
+        || materialArg.clusterId !== expectedArg.clusterId
+        || materialArg.capability !== expectedArg.capability
+        || materialArg.recipientKeyId !== expectedArg.expectedRecipientKeyId
+        || materialArg.recipientGeneration !== expectedArg.expectedRecipientGeneration) {
+        errors.push('corestore control credential material does not match its request authority');
+    }
+    let envelope;
+    try {
+        envelope = plugins.smartcrypto.parseX25519Envelope(materialArg.envelope);
+        if (envelope.ciphertext.length
+            > Math.ceil(corestoreCredentialRuntimeLimits.maximumSealedControlCredentialBytes * 4 / 3)) {
+            errors.push('corestore control credential envelope exceeds its byte limit');
+        }
+    }
+    catch {
+        errors.push('corestore control credential envelope must be strict');
+    }
+    if (envelope) {
+        if (envelope.recipientKeyId !== materialArg.recipientKeyId) {
+            errors.push('corestore control credential envelope recipient must match');
+        }
+        else if (errors.length === 0 && !await verifySecretEnvelopeContext(envelope, createCorestoreControlCredentialMaterialEnvelopeContext(materialArg))) {
+            errors.push('corestore control credential envelope context must match');
+        }
+    }
+    return errors;
+};
+export const validateCorestoreCredentialPublicationGrant = (grantArg, trustedNowArg) => {
+    if (!isRecord(grantArg)
+        || !hasExactKeys(grantArg, [
+            'schemaVersion',
+            'operationId',
+            'serviceId',
+            'bindingId',
+            'capability',
+            'reconciliationGeneration',
+            'expectedTargetSecretsRevision',
+            'bindingRequestDigest',
+            'issuedAt',
+            'expiresAt',
+        ])) {
+        return ['corestore credential publication grant must use its exact schema'];
+    }
+    const errors = [];
+    if (grantArg.schemaVersion !== 1) {
+        errors.push('corestore credential publication grant schemaVersion must be 1');
+    }
+    if (!isIdentifier(grantArg.operationId)
+        || !isIdentifier(grantArg.serviceId)
+        || !isIdentifier(grantArg.bindingId)) {
+        errors.push('corestore credential publication grant identifiers must be canonical');
+    }
+    if (grantArg.capability !== 'database' && grantArg.capability !== 'objectstorage') {
+        errors.push('corestore credential publication grant capability must be canonical');
+    }
+    if (!isPositiveSafeInteger(grantArg.reconciliationGeneration)
+        || !isNonNegativeSafeInteger(grantArg.expectedTargetSecretsRevision)) {
+        errors.push('corestore credential publication grant revisions must be canonical');
+    }
+    if (typeof grantArg.bindingRequestDigest !== 'string'
+        || !bareSha256Pattern.test(grantArg.bindingRequestDigest)) {
+        errors.push('corestore credential publication grant digest must be bare lowercase 64-hex');
+    }
+    if (!isPositiveSafeInteger(grantArg.issuedAt)
+        || !isPositiveSafeInteger(grantArg.expiresAt)
+        || grantArg.expiresAt <= grantArg.issuedAt
+        || grantArg.expiresAt - grantArg.issuedAt
+            > corestoreCredentialRuntimeLimits.maximumGrantLifetimeMs) {
+        errors.push('corestore credential publication grant lifetime must be positive and bounded');
+    }
+    if (trustedNowArg !== undefined
+        && (!isPositiveSafeInteger(trustedNowArg)
+            || trustedNowArg < grantArg.issuedAt
+            || trustedNowArg >= grantArg.expiresAt)) {
+        errors.push('corestore credential publication grant must be currently valid');
+    }
+    return errors;
+};
+export const corestoreCredentialPublicationGrantsEqual = (leftArg, rightArg) => validateCorestoreCredentialPublicationGrant(leftArg).length === 0
+    && validateCorestoreCredentialPublicationGrant(rightArg).length === 0
+    && leftArg.schemaVersion
+        === rightArg.schemaVersion
+    && leftArg.operationId
+        === rightArg.operationId
+    && leftArg.serviceId
+        === rightArg.serviceId
+    && leftArg.bindingId
+        === rightArg.bindingId
+    && leftArg.capability
+        === rightArg.capability
+    && leftArg.reconciliationGeneration
+        === rightArg.reconciliationGeneration
+    && leftArg.expectedTargetSecretsRevision
+        === rightArg.expectedTargetSecretsRevision
+    && leftArg.bindingRequestDigest
+        === rightArg.bindingRequestDigest
+    && leftArg.issuedAt
+        === rightArg.issuedAt
+    && leftArg.expiresAt
+        === rightArg.expiresAt;
+const comparePublicationGrants = (leftArg, rightArg) => leftArg.bindingId < rightArg.bindingId
+    ? -1
+    : leftArg.bindingId > rightArg.bindingId
+        ? 1
+        : leftArg.operationId < rightArg.operationId
+            ? -1
+            : leftArg.operationId > rightArg.operationId
+                ? 1
+                : 0;
+export const validateCorestoreCredentialPublicationGrants = (grantsArg, trustedNowArg) => {
+    if (!Array.isArray(grantsArg)
+        || grantsArg.length > corestoreCredentialRuntimeLimits.maximumPublicationGrants) {
+        return ['corestore credential publication grants must be a bounded array'];
+    }
+    const errors = [];
+    let previous;
+    for (const [index, grantArg] of grantsArg.entries()) {
+        const grantErrors = validateCorestoreCredentialPublicationGrant(grantArg, trustedNowArg);
+        errors.push(...grantErrors.map((errorArg) => `publication grants[${index}] ${errorArg}`));
+        if (grantErrors.length === 0) {
+            const grant = grantArg;
+            if (previous && comparePublicationGrants(previous, grant) >= 0) {
+                errors.push('corestore credential publication grants must be unique and sorted by bindingId then operationId');
+            }
+            previous = grant;
+        }
+    }
+    return errors;
+};
+export const corestoreDatabaseCredentialKeys = Object.freeze([
+    'MONGODB_URI',
+    'MONGODB_URL',
+    'MONGO_URL',
+    'MONGODB_HOST',
+    'MONGODB_PORT',
+    'MONGODB_DATABASE',
+    'MONGO_DBNAME',
+    'MONGODB_USERNAME',
+    'MONGO_DBUSER',
+    'MONGODB_PASSWORD',
+    'MONGO_DBPASS',
+]);
+export const corestoreObjectStorageCredentialKeys = Object.freeze([
+    'accessKeyId',
+    'secretAccessKey',
+]);
+const readCredentialString = (valueArg) => typeof valueArg === 'string'
+    && valueArg.length > 0
+    && utf8ByteLength(valueArg) <= corestoreCredentialRuntimeLimits.maximumCredentialStringBytes
+    && !valueArg.includes('\0');
+export const validateCorestoreDatabaseCredentialMaterial = (materialArg) => {
+    if (!isRecord(materialArg)
+        || !hasExactKeys(materialArg, ['schemaVersion', 'capability', 'values'])
+        || materialArg.schemaVersion !== 1
+        || materialArg.capability !== 'database'
+        || !isRecord(materialArg.values)
+        || !hasExactKeys(materialArg.values, corestoreDatabaseCredentialKeys)) {
+        return ['corestore database credential material must use its exact schema'];
+    }
+    const values = materialArg.values;
+    const errors = [];
+    if (corestoreDatabaseCredentialKeys.some((keyArg) => !readCredentialString(values[keyArg]))) {
+        errors.push('corestore database credential values must be bounded non-empty strings');
+    }
+    if (values.MONGODB_URI !== values.MONGODB_URL
+        || values.MONGODB_URI !== values.MONGO_URL) {
+        errors.push('corestore database URI aliases must be equal');
+    }
+    if (values.MONGODB_DATABASE !== values.MONGO_DBNAME) {
+        errors.push('corestore database name aliases must be equal');
+    }
+    if (values.MONGODB_USERNAME !== values.MONGO_DBUSER) {
+        errors.push('corestore database username aliases must be equal');
+    }
+    if (values.MONGODB_PASSWORD !== values.MONGO_DBPASS) {
+        errors.push('corestore database password aliases must be equal');
+    }
+    if (typeof values.MONGODB_PORT !== 'string'
+        || !/^[1-9][0-9]{0,4}$/.test(values.MONGODB_PORT)
+        || Number(values.MONGODB_PORT) > 65535) {
+        errors.push('corestore database port must be canonical');
+    }
+    return errors;
+};
+export const validateCorestoreObjectStorageCredentialMaterial = async (materialArg, retentionExpectationArg) => {
+    if (!isRecord(materialArg)
+        || !hasKeys(materialArg, ['schemaVersion', 'capability', 'values'], ['retention'])
+        || materialArg.schemaVersion !== 1
+        || materialArg.capability !== 'objectstorage'
+        || !isRecord(materialArg.values)
+        || !hasExactKeys(materialArg.values, corestoreObjectStorageCredentialKeys)) {
+        return ['corestore objectstorage credential material must use its exact schema'];
+    }
+    const errors = [];
+    if (!readCredentialString(materialArg.values.accessKeyId)
+        || !readCredentialString(materialArg.values.secretAccessKey)) {
+        errors.push('corestore objectstorage credential values must be bounded non-empty strings');
+    }
+    if (materialArg.retention !== undefined) {
+        if (!retentionExpectationArg) {
+            errors.push('corestore objectstorage retention evidence requires trusted binding authority');
+        }
+        else {
+            errors.push(...await validateObjectStorageRetentionEvidence(materialArg.retention, retentionExpectationArg));
+        }
+    }
+    return errors;
+};
+export const validateCorestoreCredentialPlaintextMaterial = async (materialArg, retentionExpectationArg) => isRecord(materialArg) && materialArg.capability === 'database'
+    ? validateCorestoreDatabaseCredentialMaterial(materialArg)
+    : validateCorestoreObjectStorageCredentialMaterial(materialArg, retentionExpectationArg);
+export const createPublishCorestoreCredentialMaterialEnvelopeContext = (requestArg) => new TextEncoder().encode(JSON.stringify({
+    schemaVersion: 1,
+    purpose: 'serve.zone/publish-corestore-credential-material',
+    mutationId: requestArg.mutationId,
+    grant: {
+        schemaVersion: requestArg.grant.schemaVersion,
+        operationId: requestArg.grant.operationId,
+        serviceId: requestArg.grant.serviceId,
+        bindingId: requestArg.grant.bindingId,
+        capability: requestArg.grant.capability,
+        reconciliationGeneration: requestArg.grant.reconciliationGeneration,
+        expectedTargetSecretsRevision: requestArg.grant.expectedTargetSecretsRevision,
+        bindingRequestDigest: requestArg.grant.bindingRequestDigest,
+        issuedAt: requestArg.grant.issuedAt,
+        expiresAt: requestArg.grant.expiresAt,
+    },
+    expectedIngressRecipientKeyId: requestArg.expectedIngressRecipientKeyId,
+    expectedIngressRecipientGeneration: requestArg.expectedIngressRecipientGeneration,
+}));
+export const validatePublishCorestoreCredentialMaterialRequest = async (requestArg, expectedGrantArg, activeRecipientArg, trustedNowArg) => {
+    if (!isRecord(requestArg)
+        || !hasExactKeys(requestArg, [
+            'identity',
+            'mutationId',
+            'grant',
+            'expectedIngressRecipientKeyId',
+            'expectedIngressRecipientGeneration',
+            'envelope',
+        ])) {
+        return ['publish corestore credential request must use its exact schema'];
+    }
+    const errors = validateCorestoreCredentialPublicationGrant(requestArg.grant, trustedNowArg);
+    if (!corestoreCredentialPublicationGrantsEqual(requestArg.grant, expectedGrantArg)) {
+        errors.push('publish corestore credential request grant must match current server authority');
+    }
+    if (!isJwtIdentity(requestArg.identity)) {
+        errors.push('publish corestore credential request requires only a JWT identity');
+    }
+    if (!isIdentifier(requestArg.mutationId)
+        || !isIdentifier(requestArg.expectedIngressRecipientKeyId)
+        || !isPositiveSafeInteger(requestArg.expectedIngressRecipientGeneration)) {
+        errors.push('publish corestore credential request recipient and mutation must be canonical');
+    }
+    let envelope;
+    try {
+        envelope = plugins.smartcrypto.parseX25519Envelope(requestArg.envelope);
+        if (envelope.ciphertext.length
+            > Math.ceil(corestoreCredentialRuntimeLimits.maximumSealedMaterialBytes * 4 / 3)) {
+            errors.push('publish corestore credential envelope exceeds its byte limit');
+        }
+    }
+    catch {
+        errors.push('publish corestore credential envelope must be strict');
+    }
+    if (validateSecretRecipientMetadata(activeRecipientArg).length > 0
+        || activeRecipientArg.lifecycleState !== 'active'
+        || activeRecipientArg.recipientKeyId !== requestArg.expectedIngressRecipientKeyId
+        || activeRecipientArg.generation !== requestArg.expectedIngressRecipientGeneration) {
+        errors.push('publish corestore credential request must target the active ingress recipient');
+    }
+    if (envelope) {
+        if (envelope.recipientKeyId !== requestArg.expectedIngressRecipientKeyId) {
+            errors.push('publish corestore credential envelope recipient must match');
+        }
+        else if (errors.length === 0 && !await verifySecretEnvelopeContext(envelope, createPublishCorestoreCredentialMaterialEnvelopeContext(requestArg))) {
+            errors.push('publish corestore credential envelope context must match');
+        }
+    }
+    return errors;
+};
+const expectedCoverageKeys = (capabilityArg) => capabilityArg === 'database'
+    ? corestoreDatabaseCredentialKeys
+    : corestoreObjectStorageCredentialKeys;
+const computeRuntimeSha256 = async (valueArg) => {
+    const digest = new Uint8Array(await globalThis.crypto.subtle.digest('SHA-256', new Uint8Array(valueArg)));
+    return [...digest].map((byteArg) => byteArg.toString(16).padStart(2, '0')).join('');
+};
+const verifyPublicationAdmissionBinding = async (bindingArg, envelopeArg, contextArg) => {
+    try {
+        const envelope = plugins.smartcrypto.parseX25519Envelope(envelopeArg);
+        if (envelope.recipientKeyId !== bindingArg.recipientKeyId
+            || !await verifySecretEnvelopeContext(envelope, contextArg)) {
+            return false;
+        }
+        const envelopeDigestInput = JSON.stringify({
+            schemaVersion: envelope.schemaVersion,
+            profile: envelope.profile,
+            recipientKeyId: envelope.recipientKeyId,
+            ephemeralPublicKey: envelope.ephemeralPublicKey,
+            nonce: envelope.nonce,
+            ciphertext: envelope.ciphertext,
+            tag: envelope.tag,
+            contextDigest: envelope.contextDigest,
+        });
+        return bindingArg.envelopeDigest
+            === `sha256:${await computeRuntimeSha256(new TextEncoder().encode(envelopeDigestInput))}`
+            && bindingArg.requestContextDigest
+                === `sha256:${await computeRuntimeSha256(contextArg)}`;
+    }
+    catch {
+        return false;
+    }
+};
+export const validateCorestoreCredentialPublicationReceipt = async (receiptArg, expectedArg) => {
+    if (!isRecord(receiptArg)
+        || !hasExactKeys(receiptArg, [
+            'schemaVersion',
+            'mutationId',
+            'organizationId',
+            'clusterId',
+            'serviceId',
+            'bindingId',
+            'capability',
+            'grant',
+            'coverage',
+            'expectedTargetSecretsRevision',
+            'targetSecretsRevision',
+            'ingressAdmissionBinding',
+            'acceptedAt',
+            'replayed',
+        ])) {
+        return ['corestore credential publication receipt must use its exact schema'];
+    }
+    const errors = validateCorestoreCredentialPublicationGrant(receiptArg.grant);
+    if (receiptArg.schemaVersion !== 1
+        || !isIdentifier(receiptArg.mutationId)
+        || !isIdentifier(receiptArg.organizationId)
+        || !isIdentifier(receiptArg.clusterId)
+        || !isIdentifier(receiptArg.serviceId)
+        || !isIdentifier(receiptArg.bindingId)) {
+        errors.push('corestore credential publication receipt identifiers must be canonical');
+    }
+    const grant = receiptArg.grant;
+    if ((receiptArg.capability !== 'database' && receiptArg.capability !== 'objectstorage')
+        || receiptArg.serviceId !== grant.serviceId
+        || receiptArg.bindingId !== grant.bindingId
+        || receiptArg.capability !== grant.capability
+        || receiptArg.expectedTargetSecretsRevision !== grant.expectedTargetSecretsRevision) {
+        errors.push('corestore credential publication receipt must exactly bind its grant');
+    }
+    if (receiptArg.mutationId !== expectedArg.request.mutationId
+        || receiptArg.organizationId !== expectedArg.organizationId
+        || receiptArg.clusterId !== expectedArg.clusterId
+        || !corestoreCredentialPublicationGrantsEqual(receiptArg.grant, expectedArg.request.grant)) {
+        errors.push('corestore credential publication receipt must match its trusted request scope');
+    }
+    if (!isRecord(receiptArg.coverage)
+        || !hasExactKeys(receiptArg.coverage, ['keys', 'versionReferences'])
+        || !Array.isArray(receiptArg.coverage.keys)
+        || !Array.isArray(receiptArg.coverage.versionReferences)) {
+        errors.push('corestore credential publication coverage must use its exact schema');
+    }
+    else if (receiptArg.capability === 'database' || receiptArg.capability === 'objectstorage') {
+        const requiredKeys = expectedCoverageKeys(receiptArg.capability);
+        if (JSON.stringify(receiptArg.coverage.keys) !== JSON.stringify(requiredKeys)
+            || receiptArg.coverage.versionReferences.length !== requiredKeys.length) {
+            errors.push('corestore credential publication coverage must be exact');
+        }
+        else {
+            const secretIds = new Set();
+            const secretVersionIds = new Set();
+            for (const [index, referenceArg] of receiptArg.coverage.versionReferences.entries()) {
+                if (!isRecord(referenceArg)
+                    || !hasExactKeys(referenceArg, ['key', 'secretId', 'secretVersionId'])
+                    || referenceArg.key !== requiredKeys[index]
+                    || !isIdentifier(referenceArg.secretId)
+                    || !isIdentifier(referenceArg.secretVersionId)) {
+                    errors.push('corestore credential publication version references must exactly cover keys');
+                    break;
+                }
+                if (secretIds.has(referenceArg.secretId)
+                    || secretVersionIds.has(referenceArg.secretVersionId)) {
+                    errors.push('corestore credential publication version references must be unique');
+                    break;
+                }
+                secretIds.add(referenceArg.secretId);
+                secretVersionIds.add(referenceArg.secretVersionId);
+            }
+        }
+    }
+    const referenceCount = isRecord(receiptArg.coverage)
+        && Array.isArray(receiptArg.coverage.versionReferences)
+        ? receiptArg.coverage.versionReferences.length
+        : 0;
+    if (!isNonNegativeSafeInteger(receiptArg.expectedTargetSecretsRevision)
+        || !isNonNegativeSafeInteger(receiptArg.targetSecretsRevision)
+        || receiptArg.targetSecretsRevision !== receiptArg.expectedTargetSecretsRevision + referenceCount) {
+        errors.push('corestore credential publication target Secrets revision must exactly cover created versions');
+    }
+    const admission = receiptArg.ingressAdmissionBinding;
+    if (!isRecord(admission)
+        || !hasExactKeys(admission, [
+            'schemaVersion',
+            'recipientKeyId',
+            'recipientGeneration',
+            'envelopeDigest',
+            'requestContextDigest',
+        ])
+        || admission.schemaVersion !== 1
+        || !isIdentifier(admission.recipientKeyId)
+        || !isPositiveSafeInteger(admission.recipientGeneration)
+        || typeof admission.envelopeDigest !== 'string'
+        || !isSha256Digest(admission.envelopeDigest)
+        || typeof admission.requestContextDigest !== 'string'
+        || !isSha256Digest(admission.requestContextDigest)) {
+        errors.push('corestore credential publication ingress admission binding must be canonical');
+    }
+    else if (admission.recipientKeyId !== expectedArg.request.expectedIngressRecipientKeyId
+        || admission.recipientGeneration !== expectedArg.request.expectedIngressRecipientGeneration
+        || !await verifyPublicationAdmissionBinding(admission, expectedArg.request.envelope, createPublishCorestoreCredentialMaterialEnvelopeContext(expectedArg.request))) {
+        errors.push('corestore credential publication ingress admission binding must match the request');
+    }
+    if (!isPositiveSafeInteger(receiptArg.acceptedAt)
+        || receiptArg.acceptedAt < grant.issuedAt
+        || receiptArg.acceptedAt >= grant.expiresAt
+        || typeof receiptArg.replayed !== 'boolean') {
+        errors.push('corestore credential publication receipt acceptance must be canonical');
+    }
+    return errors;
+};
+export const corestoreCredentialPublicationErrorMetadata = Object.freeze({
+    INVALID_IDENTITY: Object.freeze({ retryable: false }),
+    INVALID_REQUEST: Object.freeze({ retryable: false }),
+    GRANT_EXPIRED: Object.freeze({ retryable: false }),
+    GRANT_SCOPE_MISMATCH: Object.freeze({ retryable: false }),
+    GRANT_REVISION_MISMATCH: Object.freeze({ retryable: true }),
+    INGRESS_RECIPIENT_MISMATCH: Object.freeze({ retryable: true }),
+    ENVELOPE_INVALID: Object.freeze({ retryable: false }),
+    MATERIAL_INVALID: Object.freeze({ retryable: false }),
+    SECRETS_REVISION_CONFLICT: Object.freeze({ retryable: true }),
+    REPLAY_CONFLICT: Object.freeze({ retryable: false }),
+    INTERNAL_ERROR: Object.freeze({ retryable: true }),
+});
+export const getCorestoreCredentialPublicationErrorMetadata = (codeArg) => ({
+    schemaVersion: 1,
+    code: codeArg,
+    retryable: corestoreCredentialPublicationErrorMetadata[codeArg].retryable,
+});
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicnVudGltZS5jb3Jlc3RvcmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi90cy9ydW50aW1lLmNvcmVzdG9yZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQU14QyxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUFDMUQsT0FBTyxFQUNMLCtCQUErQixFQUMvQiwyQkFBMkIsR0FDNUIsTUFBTSxrQkFBa0IsQ0FBQztBQU0xQixPQUFPLEVBQUUsc0NBQXNDLEVBQUUsTUFBTSxzQ0FBc0MsQ0FBQztBQUk5RixNQUFNLENBQUMsTUFBTSwwQkFBMEIsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQ3RELFFBQVEsRUFBRSw0QkFBNEI7SUFDdEMsYUFBYSxFQUFFLGlDQUFpQztDQUN4QyxDQUFDLENBQUM7QUFDWixNQUFNLENBQUMsTUFBTSxtQkFBbUIsR0FBRyx1QkFBZ0MsQ0FBQztBQUNwRSxNQUFNLENBQUMsTUFBTSxrQ0FBa0MsR0FBRyw0QkFBcUMsQ0FBQztBQUN4RixNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxxQkFBOEIsQ0FBQztBQUM1RSxNQUFNLENBQUMsTUFBTSw4QkFBOEIsR0FBRyxZQUFxQixDQUFDO0FBRXBFLE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLE1BQU0sQ0FBQyxNQUFNLENBQUM7SUFDNUQsdUJBQXVCLEVBQUUsR0FBRztJQUM1Qix3QkFBd0IsRUFBRSxHQUFHO0lBQzdCLHNCQUFzQixFQUFFLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxHQUFHLElBQUk7SUFDM0MsNEJBQTRCLEVBQUUsQ0FBQyxHQUFHLElBQUk7SUFDdEMsMEJBQTBCLEVBQUUsRUFBRSxHQUFHLElBQUk7SUFDckMsd0JBQXdCLEVBQUUsRUFBRTtJQUM1Qix3QkFBd0IsRUFBRSxJQUFJO0lBQzlCLG1DQUFtQyxFQUFFLEVBQUUsR0FBRyxJQUFJO0NBQy9DLENBQUMsQ0FBQztBQUVILE1BQU0sQ0FBQyxNQUFNLDRCQUE0QixHQUFHLENBQzFDLGFBQTZDLEVBQ3NCLEVBQUU7SUFDckUsSUFBSSxhQUFhLEtBQUssVUFBVSxJQUFJLGFBQWEsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUN0RSxNQUFNLElBQUksS0FBSyxDQUFDLHdEQUF3RCxDQUFDLENBQUM7SUFDNUUsQ0FBQztJQUNELE9BQU8sMEJBQTBCLENBQUMsYUFBYSxDQUFDLENBQUM7QUFDbkQsQ0FBQyxDQUFDO0FBMERGLE1BQU0saUJBQWlCLEdBQUcscUNBQXFDLENBQUM7QUFDaEUsTUFBTSxpQkFBaUIsR0FBRyxnQkFBZ0IsQ0FBQztBQUMzQyxNQUFNLHFCQUFxQixHQUFHLDBCQUEwQixDQUFDO0FBRXpELE1BQU0sUUFBUSxHQUFHLENBQUMsUUFBaUIsRUFBdUMsRUFBRSxDQUFDLENBQzNFLE9BQU8sQ0FBQyxRQUFRLENBQUM7T0FDZCxPQUFPLFFBQVEsS0FBSyxRQUFRO09BQzVCLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7T0FDeEIsQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLFFBQVEsQ0FBQyxLQUFLLE1BQU0sQ0FBQyxTQUFTO1dBQ25ELE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQy9DLENBQUM7QUFFRixNQUFNLFlBQVksR0FBRyxDQUNuQixRQUFpQyxFQUNqQyxPQUEwQixFQUNqQixFQUFFO0lBQ1gsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUM1QyxNQUFNLFFBQVEsR0FBRyxDQUFDLEdBQUcsT0FBTyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7SUFDckMsT0FBTyxNQUFNLENBQUMsTUFBTSxLQUFLLFFBQVEsQ0FBQyxNQUFNO1dBQ25DLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxFQUFFLEVBQUUsQ0FBQyxNQUFNLEtBQUssUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7QUFDekUsQ0FBQyxDQUFDO0FBRUYsTUFBTSxPQUFPLEdBQUcsQ0FDZCxRQUFpQyxFQUNqQyxXQUE4QixFQUM5QixXQUE4QixFQUNyQixFQUFFLENBQUMsV0FBVyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7T0FDdkUsTUFBTSxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQyxLQUFLLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQ2xFLFdBQVcsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUVyQyxNQUFNLFlBQVksR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUM5RCxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksaUJBQWlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUNqRSxDQUFDO0FBRUYsTUFBTSxxQkFBcUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUN2RSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLEdBQUcsQ0FBQyxDQUMzRCxDQUFDO0FBRUYsTUFBTSx3QkFBd0IsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUMxRSxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FDeEYsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBaUIsRUFBbUMsRUFBRSxDQUFDLENBQzVFLFFBQVEsQ0FBQyxRQUFRLENBQUM7T0FDZixZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUM7T0FDL0IsT0FBTyxRQUFRLENBQUMsR0FBRyxLQUFLLFFBQVE7T0FDaEMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxDQUMzQixDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxRQUFnQixFQUFVLEVBQUUsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQyxVQUFVLENBQUM7QUFFbkcsTUFBTSx1QkFBdUIsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUU7SUFDeEUsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLElBQUksQ0FBQyxRQUFRLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUNoRyxNQUFNLE9BQU8sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztJQUNuRCxJQUFJLFNBQWlCLENBQUM7SUFDdEIsSUFBSSxDQUFDO1FBQ0gsU0FBUyxHQUFHLElBQUksV0FBVyxDQUFDLE9BQU8sRUFBRSxFQUFFLEtBQUssRUFBRSxJQUFJLEVBQUUsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztJQUN4RSxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBQ0QsT0FBTyxTQUFTLEtBQUssUUFBUTtXQUN4QixPQUFPLENBQUMsVUFBVSxJQUFJLGdDQUFnQyxDQUFDLHdCQUF3QjtXQUMvRSxPQUFPLENBQUMsVUFBVSxJQUFJLGdDQUFnQyxDQUFDLHdCQUF3QixDQUFDO0FBQ3ZGLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLG9EQUFvRCxHQUFHLENBQ2xFLFVBQW1CLEVBQ25CLGtCQUFrRCxFQUN4QyxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUM7V0FDcEIsQ0FBQyxZQUFZLENBQUMsVUFBVSxFQUFFO1lBQzNCLFVBQVU7WUFDVixXQUFXO1lBQ1gsWUFBWTtZQUNaLHdCQUF3QjtZQUN4Qiw2QkFBNkI7U0FDOUIsQ0FBQyxFQUFFLENBQUM7UUFDTCxPQUFPLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLElBQUksQ0FBQyxhQUFhLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDeEMsTUFBTSxDQUFDLElBQUksQ0FBQyxtRUFBbUUsQ0FBQyxDQUFDO0lBQ25GLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUM7V0FDbEMsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLHNCQUFzQixDQUFDLEVBQUUsQ0FBQztRQUN0RCxNQUFNLENBQUMsSUFBSSxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDcEYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxVQUFVLElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLDJFQUEyRSxDQUFDLENBQUM7SUFDM0YsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxVQUFVLENBQUMsMkJBQTJCLENBQUMsRUFBRSxDQUFDO1FBQ25FLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSwrQkFBK0IsQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzdELGtCQUFrQixDQUFDLGNBQWMsS0FBSyxRQUFRO1dBQzlDLFVBQVUsQ0FBQyxzQkFBc0IsS0FBSyxrQkFBa0IsQ0FBQyxjQUFjO1dBQ3ZFLFVBQVUsQ0FBQywyQkFBMkIsS0FBSyxrQkFBa0IsQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDdkYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHVEQUF1RCxHQUFHLENBQ3JFLFdBQThELEVBQ2xELEVBQUUsQ0FBQyxJQUFJLFdBQVcsRUFBRSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDO0lBQ3ZELGFBQWEsRUFBRSxDQUFDO0lBQ2hCLE9BQU8sRUFBRSxrREFBa0Q7SUFDM0QsU0FBUyxFQUFFLFdBQVcsQ0FBQyxTQUFTO0lBQ2hDLFNBQVMsRUFBRSxXQUFXLENBQUMsU0FBUztJQUNoQyxVQUFVLEVBQUUsV0FBVyxDQUFDLFVBQVU7SUFDbEMsZ0JBQWdCLEVBQUUsNEJBQTRCLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQztJQUN0RSxVQUFVLEVBQUUsbUJBQW1CO0lBQy9CLGVBQWUsRUFBRSxrQ0FBa0M7SUFDbkQsR0FBRyxFQUFFLDZCQUE2QjtJQUNsQyxXQUFXLEVBQUUsOEJBQThCO0lBQzNDLGNBQWMsRUFBRSxXQUFXLENBQUMsY0FBYztJQUMxQyxtQkFBbUIsRUFBRSxXQUFXLENBQUMsbUJBQW1CO0NBQ3JELENBQUMsQ0FBQyxDQUFDO0FBRUosTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsQ0FDekQsWUFBcUIsRUFDWCxFQUFFO0lBQ1osSUFBSSxDQUFDLFFBQVEsQ0FBQyxZQUFZLENBQUM7V0FDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLENBQUMsZUFBZSxFQUFFLEtBQUssRUFBRSxhQUFhLEVBQUUsT0FBTyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQ25GLE9BQU8sQ0FBQyxrRUFBa0UsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxZQUFZLENBQUMsYUFBYSxLQUFLLENBQUM7V0FDL0IsWUFBWSxDQUFDLEdBQUcsS0FBSyw2QkFBNkI7V0FDbEQsWUFBWSxDQUFDLFdBQVcsS0FBSyw4QkFBOEIsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSxDQUFDLHVCQUF1QixDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsbUZBQW1GLENBQUMsQ0FBQztJQUNuRyxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMENBQTBDLEdBQUcsS0FBSyxFQUM3RCxXQUFvQixFQUNwQixXQUE2RCxFQUMxQyxFQUFFO0lBQ3JCLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1dBQ3JCLENBQUMsWUFBWSxDQUFDLFdBQVcsRUFBRTtZQUM1QixlQUFlO1lBQ2YsV0FBVztZQUNYLFdBQVc7WUFDWCxZQUFZO1lBQ1osa0JBQWtCO1lBQ2xCLFlBQVk7WUFDWixpQkFBaUI7WUFDakIsS0FBSztZQUNMLGFBQWE7WUFDYixnQkFBZ0I7WUFDaEIscUJBQXFCO1lBQ3JCLFVBQVU7U0FDWCxDQUFDLEVBQUUsQ0FBQztRQUNMLE9BQU8sQ0FBQyxpRUFBaUUsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxXQUFXLENBQUMsYUFBYSxLQUFLLENBQUM7V0FDOUIsQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQztXQUNwQyxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDO1dBQ3BDLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUM7V0FDekMsQ0FBQyxxQkFBcUIsQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzdELE1BQU0sQ0FBQyxJQUFJLENBQUMsa0VBQWtFLENBQUMsQ0FBQztJQUNsRixDQUFDO0lBQ0QsSUFBSSxXQUFXLENBQUMsVUFBVSxLQUFLLFVBQVUsSUFBSSxXQUFXLENBQUMsVUFBVSxLQUFLLGVBQWUsRUFBRSxDQUFDO1FBQ3hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO1NBQU0sSUFBSSxXQUFXLENBQUMsZ0JBQWdCLEtBQUssNEJBQTRCLENBQUMsV0FBVyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDakcsTUFBTSxDQUFDLElBQUksQ0FBQyx1RUFBdUUsQ0FBQyxDQUFDO0lBQ3ZGLENBQUM7SUFDRCxJQUFJLFdBQVcsQ0FBQyxVQUFVLEtBQUssbUJBQW1CO1dBQzdDLFdBQVcsQ0FBQyxlQUFlLEtBQUssa0NBQWtDO1dBQ2xFLFdBQVcsQ0FBQyxHQUFHLEtBQUssNkJBQTZCO1dBQ2pELFdBQVcsQ0FBQyxXQUFXLEtBQUssOEJBQThCLEVBQUUsQ0FBQztRQUNoRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1FQUFtRSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELElBQUksV0FBVyxDQUFDLFNBQVMsS0FBSyxXQUFXLENBQUMsU0FBUztXQUM5QyxXQUFXLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQy9DLFdBQVcsQ0FBQyxVQUFVLEtBQUssV0FBVyxDQUFDLFVBQVU7V0FDakQsV0FBVyxDQUFDLGNBQWMsS0FBSyxXQUFXLENBQUMsc0JBQXNCO1dBQ2pFLFdBQVcsQ0FBQyxtQkFBbUIsS0FBSyxXQUFXLENBQUMsMkJBQTJCLEVBQUUsQ0FBQztRQUNqRixNQUFNLENBQUMsSUFBSSxDQUFDLDRFQUE0RSxDQUFDLENBQUM7SUFDNUYsQ0FBQztJQUNELElBQUksUUFBMkQsQ0FBQztJQUNoRSxJQUFJLENBQUM7UUFDSCxRQUFRLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQyxtQkFBbUIsQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDekUsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU07Y0FDMUIsSUFBSSxDQUFDLElBQUksQ0FBQyxnQ0FBZ0MsQ0FBQyxtQ0FBbUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM1RixNQUFNLENBQUMsSUFBSSxDQUFDLDhEQUE4RCxDQUFDLENBQUM7UUFDOUUsQ0FBQztJQUNILENBQUM7SUFBQyxNQUFNLENBQUM7UUFDUCxNQUFNLENBQUMsSUFBSSxDQUFDLHNEQUFzRCxDQUFDLENBQUM7SUFDdEUsQ0FBQztJQUNELElBQUksUUFBUSxFQUFFLENBQUM7UUFDYixJQUFJLFFBQVEsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzNELE1BQU0sQ0FBQyxJQUFJLENBQUMsNERBQTRELENBQUMsQ0FBQztRQUM1RSxDQUFDO2FBQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxDQUFDLE1BQU0sMkJBQTJCLENBQ2xFLFFBQVEsRUFDUix1REFBdUQsQ0FDckQsV0FBMkUsQ0FDNUUsQ0FDRixFQUFFLENBQUM7WUFDRixNQUFNLENBQUMsSUFBSSxDQUFDLDBEQUEwRCxDQUFDLENBQUM7UUFDMUUsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFlRixNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxDQUN6RCxRQUFpQixFQUNqQixhQUFzQixFQUNaLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUNsQixDQUFDLFlBQVksQ0FBQyxRQUFRLEVBQUU7WUFDekIsZUFBZTtZQUNmLGFBQWE7WUFDYixXQUFXO1lBQ1gsV0FBVztZQUNYLFlBQVk7WUFDWiwwQkFBMEI7WUFDMUIsK0JBQStCO1lBQy9CLHNCQUFzQjtZQUN0QixVQUFVO1lBQ1YsV0FBVztTQUNaLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLGtFQUFrRSxDQUFDLENBQUM7SUFDOUUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFFBQVEsQ0FBQyxhQUFhLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDakMsTUFBTSxDQUFDLElBQUksQ0FBQyxnRUFBZ0UsQ0FBQyxDQUFDO0lBQ2hGLENBQUM7SUFDRCxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUM7V0FDbEMsQ0FBQyxZQUFZLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztXQUNqQyxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxVQUFVLElBQUksUUFBUSxDQUFDLFVBQVUsS0FBSyxlQUFlLEVBQUUsQ0FBQztRQUNsRixNQUFNLENBQUMsSUFBSSxDQUFDLHFFQUFxRSxDQUFDLENBQUM7SUFDckYsQ0FBQztJQUNELElBQUksQ0FBQyxxQkFBcUIsQ0FBQyxRQUFRLENBQUMsd0JBQXdCLENBQUM7V0FDeEQsQ0FBQyx3QkFBd0IsQ0FBQyxRQUFRLENBQUMsNkJBQTZCLENBQUMsRUFBRSxDQUFDO1FBQ3ZFLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztJQUNwRixDQUFDO0lBQ0QsSUFBSSxPQUFPLFFBQVEsQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO1dBQ2hELENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7UUFDNUQsTUFBTSxDQUFDLElBQUksQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQztXQUN4QyxDQUFDLHFCQUFxQixDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUM7V0FDekMsUUFBUSxDQUFDLFNBQW9CLElBQUssUUFBUSxDQUFDLFFBQW1CO1dBQzlELFFBQVEsQ0FBQyxTQUFvQixHQUFJLFFBQVEsQ0FBQyxRQUFtQjtjQUM3RCxnQ0FBZ0MsQ0FBQyxzQkFBc0IsRUFBRSxDQUFDO1FBQzlELE1BQU0sQ0FBQyxJQUFJLENBQUMsOEVBQThFLENBQUMsQ0FBQztJQUM5RixDQUFDO0lBQ0QsSUFBSSxhQUFhLEtBQUssU0FBUztXQUMxQixDQUFDLENBQUMscUJBQXFCLENBQUMsYUFBYSxDQUFDO2VBQ3BDLGFBQWEsR0FBSSxRQUFRLENBQUMsUUFBbUI7ZUFDN0MsYUFBYSxJQUFLLFFBQVEsQ0FBQyxTQUFvQixDQUFDLEVBQUUsQ0FBQztRQUN4RCxNQUFNLENBQUMsSUFBSSxDQUFDLGdFQUFnRSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLHlDQUF5QyxHQUFHLENBQ3ZELE9BQWdCLEVBQ2hCLFFBQWlCLEVBQ1IsRUFBRSxDQUFDLDJDQUEyQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQzFFLDJDQUEyQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDO09BQ2pFLE9BQWtELENBQUMsYUFBYTtZQUM3RCxRQUFtRCxDQUFDLGFBQWE7T0FDcEUsT0FBa0QsQ0FBQyxXQUFXO1lBQzNELFFBQW1ELENBQUMsV0FBVztPQUNsRSxPQUFrRCxDQUFDLFNBQVM7WUFDekQsUUFBbUQsQ0FBQyxTQUFTO09BQ2hFLE9BQWtELENBQUMsU0FBUztZQUN6RCxRQUFtRCxDQUFDLFNBQVM7T0FDaEUsT0FBa0QsQ0FBQyxVQUFVO1lBQzFELFFBQW1ELENBQUMsVUFBVTtPQUNqRSxPQUFrRCxDQUFDLHdCQUF3QjtZQUN4RSxRQUFtRCxDQUFDLHdCQUF3QjtPQUMvRSxPQUFrRCxDQUFDLDZCQUE2QjtZQUM3RSxRQUFtRCxDQUFDLDZCQUE2QjtPQUNwRixPQUFrRCxDQUFDLG9CQUFvQjtZQUNwRSxRQUFtRCxDQUFDLG9CQUFvQjtPQUMzRSxPQUFrRCxDQUFDLFFBQVE7WUFDeEQsUUFBbUQsQ0FBQyxRQUFRO09BQy9ELE9BQWtELENBQUMsU0FBUztZQUN6RCxRQUFtRCxDQUFDLFNBQVMsQ0FBQztBQUV2RSxNQUFNLHdCQUF3QixHQUFHLENBQy9CLE9BQStDLEVBQy9DLFFBQWdELEVBQ3hDLEVBQUUsQ0FBQyxPQUFPLENBQUMsU0FBUyxHQUFHLFFBQVEsQ0FBQyxTQUFTO0lBQ2pELENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDSixDQUFDLENBQUMsT0FBTyxDQUFDLFNBQVMsR0FBRyxRQUFRLENBQUMsU0FBUztRQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNILENBQUMsQ0FBQyxPQUFPLENBQUMsV0FBVyxHQUFHLFFBQVEsQ0FBQyxXQUFXO1lBQzFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDSixDQUFDLENBQUMsT0FBTyxDQUFDLFdBQVcsR0FBRyxRQUFRLENBQUMsV0FBVztnQkFDMUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ0gsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUVaLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLENBQzFELFNBQWtCLEVBQ2xCLGFBQXNCLEVBQ1osRUFBRTtJQUNaLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQztXQUN4QixTQUFTLENBQUMsTUFBTSxHQUFHLGdDQUFnQyxDQUFDLHdCQUF3QixFQUFFLENBQUM7UUFDbEYsT0FBTyxDQUFDLGlFQUFpRSxDQUFDLENBQUM7SUFDN0UsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLFFBQTRELENBQUM7SUFDakUsS0FBSyxNQUFNLENBQUMsS0FBSyxFQUFFLFFBQVEsQ0FBQyxJQUFJLFNBQVMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3BELE1BQU0sV0FBVyxHQUFHLDJDQUEyQyxDQUFDLFFBQVEsRUFBRSxhQUFhLENBQUMsQ0FBQztRQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsV0FBVyxDQUFDLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsc0JBQXNCLEtBQUssS0FBSyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDMUYsSUFBSSxXQUFXLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzdCLE1BQU0sS0FBSyxHQUFHLFFBQWtELENBQUM7WUFDakUsSUFBSSxRQUFRLElBQUksd0JBQXdCLENBQUMsUUFBUSxFQUFFLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUMvRCxNQUFNLENBQUMsSUFBSSxDQUFDLGlHQUFpRyxDQUFDLENBQUM7WUFDakgsQ0FBQztZQUNELFFBQVEsR0FBRyxLQUFLLENBQUM7UUFDbkIsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSwrQkFBK0IsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDO0lBQzNELGFBQWE7SUFDYixhQUFhO0lBQ2IsV0FBVztJQUNYLGNBQWM7SUFDZCxjQUFjO0lBQ2Qsa0JBQWtCO0lBQ2xCLGNBQWM7SUFDZCxrQkFBa0I7SUFDbEIsY0FBYztJQUNkLGtCQUFrQjtJQUNsQixjQUFjO0NBQ04sQ0FBQyxDQUFDO0FBQ1osTUFBTSxDQUFDLE1BQU0sb0NBQW9DLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNoRSxhQUFhO0lBQ2IsaUJBQWlCO0NBQ1QsQ0FBQyxDQUFDO0FBaUNaLE1BQU0sb0JBQW9CLEdBQUcsQ0FBQyxRQUFpQixFQUFXLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRO09BQ3BGLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQztPQUNuQixjQUFjLENBQUMsUUFBUSxDQUFDLElBQUksZ0NBQWdDLENBQUMsNEJBQTRCO09BQ3pGLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQztBQUU5QixNQUFNLENBQUMsTUFBTSwyQ0FBMkMsR0FBRyxDQUN6RCxXQUFvQixFQUNWLEVBQUU7SUFDWixJQUFJLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQztXQUNyQixDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxlQUFlLEVBQUUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1dBQ3JFLFdBQVcsQ0FBQyxhQUFhLEtBQUssQ0FBQztXQUMvQixXQUFXLENBQUMsVUFBVSxLQUFLLFVBQVU7V0FDckMsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQztXQUM3QixDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsTUFBTSxFQUFFLCtCQUErQixDQUFDLEVBQUUsQ0FBQztRQUN4RSxPQUFPLENBQUMsa0VBQWtFLENBQUMsQ0FBQztJQUM5RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsV0FBVyxDQUFDLE1BQU0sQ0FBQztJQUNsQyxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSwrQkFBK0IsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsb0JBQW9CLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzVGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsV0FBVyxLQUFLLE1BQU0sQ0FBQyxXQUFXO1dBQ3hDLE1BQU0sQ0FBQyxXQUFXLEtBQUssTUFBTSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQzdDLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLEtBQUssTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsK0NBQStDLENBQUMsQ0FBQztJQUMvRCxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLEtBQUssTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsSUFBSSxNQUFNLENBQUMsZ0JBQWdCLEtBQUssTUFBTSxDQUFDLFlBQVksRUFBRSxDQUFDO1FBQ3BELE1BQU0sQ0FBQyxJQUFJLENBQUMsbURBQW1ELENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBQ0QsSUFBSSxPQUFPLE1BQU0sQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUN0QyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDO1dBQzlDLE1BQU0sQ0FBQyxNQUFNLENBQUMsWUFBWSxDQUFDLEdBQUcsS0FBSyxFQUFFLENBQUM7UUFDekMsTUFBTSxDQUFDLElBQUksQ0FBQywyQ0FBMkMsQ0FBQyxDQUFDO0lBQzNELENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxnREFBZ0QsR0FBRyxLQUFLLEVBQ25FLFdBQW9CLEVBQ3BCLHVCQUFzRSxFQUNuRCxFQUFFO0lBQ3JCLElBQUksQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDO1dBQ3JCLENBQUMsT0FBTyxDQUFDLFdBQVcsRUFBRSxDQUFDLGVBQWUsRUFBRSxZQUFZLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQyxXQUFXLENBQUMsQ0FBQztXQUMvRSxXQUFXLENBQUMsYUFBYSxLQUFLLENBQUM7V0FDL0IsV0FBVyxDQUFDLFVBQVUsS0FBSyxlQUFlO1dBQzFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUM7V0FDN0IsQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLE1BQU0sRUFBRSxvQ0FBb0MsQ0FBQyxFQUFFLENBQUM7UUFDN0UsT0FBTyxDQUFDLHVFQUF1RSxDQUFDLENBQUM7SUFDbkYsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsb0JBQW9CLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUM7V0FDcEQsQ0FBQyxvQkFBb0IsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxFQUFFLENBQUM7UUFDL0QsTUFBTSxDQUFDLElBQUksQ0FBQyw2RUFBNkUsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxJQUFJLFdBQVcsQ0FBQyxTQUFTLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDeEMsSUFBSSxDQUFDLHVCQUF1QixFQUFFLENBQUM7WUFDN0IsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO1FBQy9GLENBQUM7YUFBTSxDQUFDO1lBQ04sTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE1BQU0sc0NBQXNDLENBQ3pELFdBQVcsQ0FBQyxTQUFTLEVBQ3JCLHVCQUF1QixDQUN4QixDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDRDQUE0QyxHQUFHLEtBQUssRUFDL0QsV0FBb0IsRUFDcEIsdUJBQXNFLEVBQ25ELEVBQUUsQ0FBQyxRQUFRLENBQUMsV0FBVyxDQUFDLElBQUksV0FBVyxDQUFDLFVBQVUsS0FBSyxVQUFVO0lBQ3BGLENBQUMsQ0FBQywyQ0FBMkMsQ0FBQyxXQUFXLENBQUM7SUFDMUQsQ0FBQyxDQUFDLGdEQUFnRCxDQUFDLFdBQVcsRUFBRSx1QkFBdUIsQ0FBQyxDQUFDO0FBa0QzRixNQUFNLENBQUMsTUFBTSx1REFBdUQsR0FBRyxDQUNyRSxVQUF1RixFQUMzRSxFQUFFLENBQUMsSUFBSSxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQztJQUN2RCxhQUFhLEVBQUUsQ0FBQztJQUNoQixPQUFPLEVBQUUsa0RBQWtEO0lBQzNELFVBQVUsRUFBRSxVQUFVLENBQUMsVUFBVTtJQUNqQyxLQUFLLEVBQUU7UUFDTCxhQUFhLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxhQUFhO1FBQzdDLFdBQVcsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLFdBQVc7UUFDekMsU0FBUyxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsU0FBUztRQUNyQyxTQUFTLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxTQUFTO1FBQ3JDLFVBQVUsRUFBRSxVQUFVLENBQUMsS0FBSyxDQUFDLFVBQVU7UUFDdkMsd0JBQXdCLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyx3QkFBd0I7UUFDbkUsNkJBQTZCLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyw2QkFBNkI7UUFDN0Usb0JBQW9CLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxvQkFBb0I7UUFDM0QsUUFBUSxFQUFFLFVBQVUsQ0FBQyxLQUFLLENBQUMsUUFBUTtRQUNuQyxTQUFTLEVBQUUsVUFBVSxDQUFDLEtBQUssQ0FBQyxTQUFTO0tBQ3RDO0lBQ0QsNkJBQTZCLEVBQUUsVUFBVSxDQUFDLDZCQUE2QjtJQUN2RSxrQ0FBa0MsRUFBRSxVQUFVLENBQUMsa0NBQWtDO0NBQ2xGLENBQUMsQ0FBQyxDQUFDO0FBRUosTUFBTSxDQUFDLE1BQU0saURBQWlELEdBQUcsS0FBSyxFQUNwRSxVQUFtQixFQUNuQixnQkFBd0QsRUFDeEQsa0JBQWtELEVBQ2xELGFBQXFCLEVBQ0YsRUFBRTtJQUNyQixJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNwQixDQUFDLFlBQVksQ0FBQyxVQUFVLEVBQUU7WUFDM0IsVUFBVTtZQUNWLFlBQVk7WUFDWixPQUFPO1lBQ1AsK0JBQStCO1lBQy9CLG9DQUFvQztZQUNwQyxVQUFVO1NBQ1gsQ0FBQyxFQUFFLENBQUM7UUFDTCxPQUFPLENBQUMsZ0VBQWdFLENBQUMsQ0FBQztJQUM1RSxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQUcsMkNBQTJDLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxhQUFhLENBQUMsQ0FBQztJQUM1RixJQUFJLENBQUMseUNBQXlDLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxnQkFBZ0IsQ0FBQyxFQUFFLENBQUM7UUFDbkYsTUFBTSxDQUFDLElBQUksQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO0lBQ2hHLENBQUM7SUFDRCxJQUFJLENBQUMsYUFBYSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUVBQW1FLENBQUMsQ0FBQztJQUNuRixDQUFDO0lBQ0QsSUFBSSxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDO1dBQ25DLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyw2QkFBNkIsQ0FBQztXQUN2RCxDQUFDLHFCQUFxQixDQUFDLFVBQVUsQ0FBQyxrQ0FBa0MsQ0FBQyxFQUFFLENBQUM7UUFDM0UsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLFFBQTJELENBQUM7SUFDaEUsSUFBSSxDQUFDO1FBQ0gsUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDO1FBQ3hFLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNO2NBQzFCLElBQUksQ0FBQyxJQUFJLENBQUMsZ0NBQWdDLENBQUMsMEJBQTBCLEdBQUcsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDbkYsTUFBTSxDQUFDLElBQUksQ0FBQyw4REFBOEQsQ0FBQyxDQUFDO1FBQzlFLENBQUM7SUFDSCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsTUFBTSxDQUFDLElBQUksQ0FBQyxzREFBc0QsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxJQUFJLCtCQUErQixDQUFDLGtCQUFrQixDQUFDLENBQUMsTUFBTSxHQUFHLENBQUM7V0FDN0Qsa0JBQWtCLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDOUMsa0JBQWtCLENBQUMsY0FBYyxLQUFLLFVBQVUsQ0FBQyw2QkFBNkI7V0FDOUUsa0JBQWtCLENBQUMsVUFBVSxLQUFLLFVBQVUsQ0FBQyxrQ0FBa0MsRUFBRSxDQUFDO1FBQ3JGLE1BQU0sQ0FBQyxJQUFJLENBQUMsK0VBQStFLENBQUMsQ0FBQztJQUMvRixDQUFDO0lBQ0QsSUFBSSxRQUFRLEVBQUUsQ0FBQztRQUNiLElBQUksUUFBUSxDQUFDLGNBQWMsS0FBSyxVQUFVLENBQUMsNkJBQTZCLEVBQUUsQ0FBQztZQUN6RSxNQUFNLENBQUMsSUFBSSxDQUFDLDREQUE0RCxDQUFDLENBQUM7UUFDNUUsQ0FBQzthQUFNLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxDQUFDLElBQUksQ0FBQyxNQUFNLDJCQUEyQixDQUNsRSxRQUFRLEVBQ1IsdURBQXVELENBQ3JELFVBR0MsQ0FDRixDQUNGLEVBQUUsQ0FBQztZQUNGLE1BQU0sQ0FBQyxJQUFJLENBQUMsMERBQTBELENBQUMsQ0FBQztRQUMxRSxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sb0JBQW9CLEdBQUcsQ0FDM0IsYUFBNkMsRUFDVCxFQUFFLENBQUMsYUFBYSxLQUFLLFVBQVU7SUFDbkUsQ0FBQyxDQUFDLCtCQUErQjtJQUNqQyxDQUFDLENBQUMsb0NBQW9DLENBQUM7QUFRekMsTUFBTSxvQkFBb0IsR0FBRyxLQUFLLEVBQUUsUUFBb0IsRUFBbUIsRUFBRTtJQUMzRSxNQUFNLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxNQUFNLFVBQVUsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FDakUsU0FBUyxFQUNULElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUN6QixDQUFDLENBQUM7SUFDSCxPQUFPLENBQUMsR0FBRyxNQUFNLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUMsQ0FBQztBQUN0RixDQUFDLENBQUM7QUFFRixNQUFNLGlDQUFpQyxHQUFHLEtBQUssRUFDN0MsVUFBNkMsRUFDN0MsV0FBb0IsRUFDcEIsVUFBc0IsRUFDSixFQUFFO0lBQ3BCLElBQUksQ0FBQztRQUNILE1BQU0sUUFBUSxHQUFHLE9BQU8sQ0FBQyxXQUFXLENBQUMsbUJBQW1CLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdEUsSUFBSSxRQUFRLENBQUMsY0FBYyxLQUFLLFVBQVUsQ0FBQyxjQUFjO2VBQ3BELENBQUMsTUFBTSwyQkFBMkIsQ0FBQyxRQUFRLEVBQUUsVUFBVSxDQUFDLEVBQUUsQ0FBQztZQUM5RCxPQUFPLEtBQUssQ0FBQztRQUNmLENBQUM7UUFDRCxNQUFNLG1CQUFtQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7WUFDekMsYUFBYSxFQUFFLFFBQVEsQ0FBQyxhQUFhO1lBQ3JDLE9BQU8sRUFBRSxRQUFRLENBQUMsT0FBTztZQUN6QixjQUFjLEVBQUUsUUFBUSxDQUFDLGNBQWM7WUFDdkMsa0JBQWtCLEVBQUUsUUFBUSxDQUFDLGtCQUFrQjtZQUMvQyxLQUFLLEVBQUUsUUFBUSxDQUFDLEtBQUs7WUFDckIsVUFBVSxFQUFFLFFBQVEsQ0FBQyxVQUFVO1lBQy9CLEdBQUcsRUFBRSxRQUFRLENBQUMsR0FBRztZQUNqQixhQUFhLEVBQUUsUUFBUSxDQUFDLGFBQWE7U0FDdEMsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxVQUFVLENBQUMsY0FBYztnQkFDeEIsVUFBVSxNQUFNLG9CQUFvQixDQUFDLElBQUksV0FBVyxFQUFFLENBQUMsTUFBTSxDQUFDLG1CQUFtQixDQUFDLENBQUMsRUFBRTtlQUN4RixVQUFVLENBQUMsb0JBQW9CO29CQUM1QixVQUFVLE1BQU0sb0JBQW9CLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztJQUM3RCxDQUFDO0lBQUMsTUFBTSxDQUFDO1FBQ1AsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0FBQ0gsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sNkNBQTZDLEdBQUcsS0FBSyxFQUNoRSxVQUFtQixFQUNuQixXQUFnRSxFQUM3QyxFQUFFO0lBQ3JCLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1dBQ3BCLENBQUMsWUFBWSxDQUFDLFVBQVUsRUFBRTtZQUMzQixlQUFlO1lBQ2YsWUFBWTtZQUNaLGdCQUFnQjtZQUNoQixXQUFXO1lBQ1gsV0FBVztZQUNYLFdBQVc7WUFDWCxZQUFZO1lBQ1osT0FBTztZQUNQLFVBQVU7WUFDViwrQkFBK0I7WUFDL0IsdUJBQXVCO1lBQ3ZCLHlCQUF5QjtZQUN6QixZQUFZO1lBQ1osVUFBVTtTQUNYLENBQUMsRUFBRSxDQUFDO1FBQ0wsT0FBTyxDQUFDLG9FQUFvRSxDQUFDLENBQUM7SUFDaEYsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLDJDQUEyQyxDQUFDLFVBQVUsQ0FBQyxLQUFLLENBQUMsQ0FBQztJQUM3RSxJQUFJLFVBQVUsQ0FBQyxhQUFhLEtBQUssQ0FBQztXQUM3QixDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsVUFBVSxDQUFDO1dBQ3BDLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxjQUFjLENBQUM7V0FDeEMsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQztXQUNuQyxDQUFDLFlBQVksQ0FBQyxVQUFVLENBQUMsU0FBUyxDQUFDO1dBQ25DLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO1FBQ3pDLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0VBQXdFLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBQ0QsTUFBTSxLQUFLLEdBQUcsVUFBVSxDQUFDLEtBQStDLENBQUM7SUFDekUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxVQUFVLEtBQUssVUFBVSxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssZUFBZSxDQUFDO1dBQ2xGLFVBQVUsQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVM7V0FDeEMsVUFBVSxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUztXQUN4QyxVQUFVLENBQUMsVUFBVSxLQUFLLEtBQUssQ0FBQyxVQUFVO1dBQzFDLFVBQVUsQ0FBQyw2QkFBNkIsS0FBSyxLQUFLLENBQUMsNkJBQTZCLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLHNFQUFzRSxDQUFDLENBQUM7SUFDdEYsQ0FBQztJQUNELElBQUksVUFBVSxDQUFDLFVBQVUsS0FBSyxXQUFXLENBQUMsT0FBTyxDQUFDLFVBQVU7V0FDdkQsVUFBVSxDQUFDLGNBQWMsS0FBSyxXQUFXLENBQUMsY0FBYztXQUN4RCxVQUFVLENBQUMsU0FBUyxLQUFLLFdBQVcsQ0FBQyxTQUFTO1dBQzlDLENBQUMseUNBQXlDLENBQUMsVUFBVSxDQUFDLEtBQUssRUFBRSxXQUFXLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDN0YsTUFBTSxDQUFDLElBQUksQ0FBQywrRUFBK0UsQ0FBQyxDQUFDO0lBQy9GLENBQUM7SUFDRCxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7V0FDN0IsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxtQkFBbUIsQ0FBQyxDQUFDO1dBQ2pFLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztXQUN4QyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxFQUFFLENBQUM7UUFDM0QsTUFBTSxDQUFDLElBQUksQ0FBQyxxRUFBcUUsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7U0FBTSxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssVUFBVSxJQUFJLFVBQVUsQ0FBQyxVQUFVLEtBQUssZUFBZSxFQUFFLENBQUM7UUFDN0YsTUFBTSxZQUFZLEdBQUcsb0JBQW9CLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQyxDQUFDO1FBQ2pFLElBQUksSUFBSSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsWUFBWSxDQUFDO2VBQ3hFLFVBQVUsQ0FBQyxRQUFRLENBQUMsaUJBQWlCLENBQUMsTUFBTSxLQUFLLFlBQVksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLHlEQUF5RCxDQUFDLENBQUM7UUFDekUsQ0FBQzthQUFNLENBQUM7WUFDTixNQUFNLFNBQVMsR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1lBQ3BDLE1BQU0sZ0JBQWdCLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztZQUMzQyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDLElBQUksVUFBVSxDQUFDLFFBQVEsQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO2dCQUNwRixJQUFJLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQzt1QkFDdEIsQ0FBQyxZQUFZLENBQUMsWUFBWSxFQUFFLENBQUMsS0FBSyxFQUFFLFVBQVUsRUFBRSxpQkFBaUIsQ0FBQyxDQUFDO3VCQUNuRSxZQUFZLENBQUMsR0FBRyxLQUFLLFlBQVksQ0FBQyxLQUFLLENBQUM7dUJBQ3hDLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUM7dUJBQ3BDLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxlQUFlLENBQUMsRUFBRSxDQUFDO29CQUNqRCxNQUFNLENBQUMsSUFBSSxDQUFDLDZFQUE2RSxDQUFDLENBQUM7b0JBQzNGLE1BQU07Z0JBQ1IsQ0FBQztnQkFDRCxJQUFJLFNBQVMsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLFFBQWtCLENBQUM7dUJBQzdDLGdCQUFnQixDQUFDLEdBQUcsQ0FBQyxZQUFZLENBQUMsZUFBeUIsQ0FBQyxFQUFFLENBQUM7b0JBQ2xFLE1BQU0sQ0FBQyxJQUFJLENBQUMsb0VBQW9FLENBQUMsQ0FBQztvQkFDbEYsTUFBTTtnQkFDUixDQUFDO2dCQUNELFNBQVMsQ0FBQyxHQUFHLENBQUMsWUFBWSxDQUFDLFFBQWtCLENBQUMsQ0FBQztnQkFDL0MsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLFlBQVksQ0FBQyxlQUF5QixDQUFDLENBQUM7WUFDL0QsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBQ0QsTUFBTSxjQUFjLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUM7V0FDL0MsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDO1FBQ3ZELENBQUMsQ0FBQyxVQUFVLENBQUMsUUFBUSxDQUFDLGlCQUFpQixDQUFDLE1BQU07UUFDOUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNOLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxVQUFVLENBQUMsNkJBQTZCLENBQUM7V0FDbEUsQ0FBQyx3QkFBd0IsQ0FBQyxVQUFVLENBQUMscUJBQXFCLENBQUM7V0FDM0QsVUFBVSxDQUFDLHFCQUFxQixLQUFLLFVBQVUsQ0FBQyw2QkFBNkIsR0FBRyxjQUFjLEVBQUUsQ0FBQztRQUNwRyxNQUFNLENBQUMsSUFBSSxDQUFDLDhGQUE4RixDQUFDLENBQUM7SUFDOUcsQ0FBQztJQUNELE1BQU0sU0FBUyxHQUFHLFVBQVUsQ0FBQyx1QkFBdUIsQ0FBQztJQUNyRCxJQUFJLENBQUMsUUFBUSxDQUFDLFNBQVMsQ0FBQztXQUNuQixDQUFDLFlBQVksQ0FBQyxTQUFTLEVBQUU7WUFDMUIsZUFBZTtZQUNmLGdCQUFnQjtZQUNoQixxQkFBcUI7WUFDckIsZ0JBQWdCO1lBQ2hCLHNCQUFzQjtTQUN2QixDQUFDO1dBQ0MsU0FBUyxDQUFDLGFBQWEsS0FBSyxDQUFDO1dBQzdCLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUM7V0FDdkMsQ0FBQyxxQkFBcUIsQ0FBQyxTQUFTLENBQUMsbUJBQW1CLENBQUM7V0FDckQsT0FBTyxTQUFTLENBQUMsY0FBYyxLQUFLLFFBQVE7V0FDNUMsQ0FBQyxjQUFjLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQztXQUN6QyxPQUFPLFNBQVMsQ0FBQyxvQkFBb0IsS0FBSyxRQUFRO1dBQ2xELENBQUMsY0FBYyxDQUFDLFNBQVMsQ0FBQyxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7UUFDckQsTUFBTSxDQUFDLElBQUksQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO0lBQzlGLENBQUM7U0FBTSxJQUFJLFNBQVMsQ0FBQyxjQUFjLEtBQUssV0FBVyxDQUFDLE9BQU8sQ0FBQyw2QkFBNkI7V0FDcEYsU0FBUyxDQUFDLG1CQUFtQixLQUFLLFdBQVcsQ0FBQyxPQUFPLENBQUMsa0NBQWtDO1dBQ3hGLENBQUMsTUFBTSxpQ0FBaUMsQ0FDekMsU0FBeUQsRUFDekQsV0FBVyxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQzVCLHVEQUF1RCxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsQ0FDN0UsRUFBRSxDQUFDO1FBQ0osTUFBTSxDQUFDLElBQUksQ0FBQyxtRkFBbUYsQ0FBQyxDQUFDO0lBQ25HLENBQUM7SUFDRCxJQUFJLENBQUMscUJBQXFCLENBQUMsVUFBVSxDQUFDLFVBQVUsQ0FBQztXQUM1QyxVQUFVLENBQUMsVUFBVSxHQUFHLEtBQUssQ0FBQyxRQUFRO1dBQ3RDLFVBQVUsQ0FBQyxVQUFVLElBQUksS0FBSyxDQUFDLFNBQVM7V0FDeEMsT0FBTyxVQUFVLENBQUMsUUFBUSxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzlDLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUVBQXVFLENBQUMsQ0FBQztJQUN2RixDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxDQUFDLE1BQU0sMkNBQTJDLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUN2RSxnQkFBZ0IsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ3JELGVBQWUsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ3BELGFBQWEsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ2xELG9CQUFvQixFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLENBQUM7SUFDekQsdUJBQXVCLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLEVBQUUsQ0FBQztJQUMzRCwwQkFBMEIsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQzlELGdCQUFnQixFQUFFLE1BQU0sQ0FBQyxNQUFNLENBQUMsRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLENBQUM7SUFDckQsZ0JBQWdCLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQyxFQUFFLFNBQVMsRUFBRSxLQUFLLEVBQUUsQ0FBQztJQUNyRCx5QkFBeUIsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0lBQzdELGVBQWUsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLEtBQUssRUFBRSxDQUFDO0lBQ3BELGNBQWMsRUFBRSxNQUFNLENBQUMsTUFBTSxDQUFDLEVBQUUsU0FBUyxFQUFFLElBQUksRUFBRSxDQUFDO0NBQzFDLENBQUMsQ0FBQztBQVdaLE1BQU0sQ0FBQyxNQUFNLDhDQUE4QyxHQUFHLENBQzVELE9BQWlELEVBQ0QsRUFBRSxDQUFDLENBQUM7SUFDcEQsYUFBYSxFQUFFLENBQUM7SUFDaEIsSUFBSSxFQUFFLE9BQU87SUFDYixTQUFTLEVBQUUsMkNBQTJDLENBQUMsT0FBTyxDQUFDLENBQUMsU0FBUztDQUMxRSxDQUFDLENBQUMifQ==