@serve.zone/interfaces 31.3.0 → 31.5.0

package/dist_ts/data/clusteringress.js

@@ -0,0 +1,302 @@
+import { isPlausibleUnicastIpv4 } from '../private/ipv4.js';
+import { isUtcCalendarDay } from '../private/utccalendarday.js';
+/**
+ * The cluster ingress contracts.
+ *
+ * A cluster's ingress terminates TLS for the hostnames its services publish and
+ * forwards to the host ports Pallet published for the workloads behind them.
+ * Cloudly computes the table — it is the only party that knows every service,
+ * every ready endpoint and every certificate — and the relay carries it to the
+ * ingress and the ingress's counters back.
+ *
+ * Names here carry no version suffix and no schema field: the protocol version
+ * is the installed `@serve.zone/interfaces` version.
+ */
+export const clusterIngressLimits = Object.freeze({
+    minimumIngressBearerLength: 16,
+    maximumIngressBearerLength: 4096,
+    maximumHostNameLength: 253,
+    maximumRoutes: 4096,
+    maximumPortRoutes: 1024,
+    maximumDestinationsPerRoute: 64,
+    maximumStatisticsPageSize: 1000,
+    maximumCursorLength: 512,
+    maximumIdentifierLength: 200,
+    maximumIngressCapabilities: 32,
+});
+const isRecord = (valueArg) => (Boolean(valueArg)
+    && typeof valueArg === 'object'
+    && !Array.isArray(valueArg)
+    && (Object.getPrototypeOf(valueArg) === Object.prototype
+        || Object.getPrototypeOf(valueArg) === null));
+const hasExactKeys = (valueArg, keysArg, optionalKeysArg = []) => {
+    const actualKeys = Object.keys(valueArg);
+    return keysArg.every((keyArg) => actualKeys.includes(keyArg))
+        && actualKeys.every((keyArg) => keysArg.includes(keyArg) || optionalKeysArg.includes(keyArg));
+};
+const isCounter = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg >= 0);
+const isPort = (valueArg) => (Number.isSafeInteger(valueArg) && valueArg >= 1 && valueArg <= 65_535);
+const hostLabelPattern = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/;
+// Built from the limit rather than beside it, so the two can never disagree.
+const identifierPattern = new RegExp(`^[A-Za-z0-9][A-Za-z0-9:._-]{0,${clusterIngressLimits.maximumIdentifierLength - 1}}$`);
+/**
+ * A hostname a certificate can be issued for and a browser can present.
+ *
+ * Lowercase labels only, because a certificate names the lowercase form and a
+ * table that carried both would serve one of them without a certificate.
+ */
+export const isClusterIngressHostName = (valueArg) => {
+    if (typeof valueArg !== 'string'
+        || valueArg.length === 0
+        || valueArg.length > clusterIngressLimits.maximumHostNameLength) {
+        return false;
+    }
+    const labels = valueArg.split('.');
+    return labels.length >= 2 && labels.every((labelArg) => hostLabelPattern.test(labelArg));
+};
+const validateDestinations = (valueArg, pathArg) => {
+    if (!Array.isArray(valueArg)
+        || valueArg.length === 0
+        || valueArg.length > clusterIngressLimits.maximumDestinationsPerRoute) {
+        return [`${pathArg} must list 1 to `
+                + `${clusterIngressLimits.maximumDestinationsPerRoute} destinations`];
+    }
+    const errors = [];
+    for (const [index, destination] of valueArg.entries()) {
+        const destinationPath = `${pathArg}[${index}]`;
+        if (!isRecord(destination) || !hasExactKeys(destination, ['address', 'port'])) {
+            errors.push(`${destinationPath} must use its exact schema`);
+            continue;
+        }
+        if (!isPlausibleUnicastIpv4(destination.address)) {
+            errors.push(`${destinationPath} address must be a unicast IPv4 literal`);
+        }
+        if (!isPort(destination.port)) {
+            errors.push(`${destinationPath} port must be an integer from 1 to 65535`);
+        }
+    }
+    return errors;
+};
+const validateCertificate = (valueArg, pathArg) => {
+    // Presence and shape only. The material itself is never described in a reason:
+    // a validation message travels into logs, and this one would carry a key.
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['publicKey', 'privateKey'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (typeof valueArg.publicKey !== 'string' || valueArg.publicKey.length === 0) {
+        errors.push(`${pathArg} publicKey must be a non-empty PEM string`);
+    }
+    if (typeof valueArg.privateKey !== 'string' || valueArg.privateKey.length === 0) {
+        errors.push(`${pathArg} privateKey must be a non-empty PEM string`);
+    }
+    return errors;
+};
+const validateAuthentication = (valueArg, pathArg) => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['type', 'user', 'pass'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    return valueArg.type === 'Basic'
+        && typeof valueArg.user === 'string' && valueArg.user.length > 0
+        && typeof valueArg.pass === 'string' && valueArg.pass.length > 0
+        ? []
+        : [`${pathArg} must be Basic authentication with a user and a pass`];
+};
+const validateHttpRoute = (valueArg, pathArg) => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['hostName', 'destinations', 'certificate'], ['authentication'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!isClusterIngressHostName(valueArg.hostName)) {
+        errors.push(`${pathArg} hostName must be a lowercase dotted hostname a certificate can name`);
+    }
+    errors.push(...validateDestinations(valueArg.destinations, `${pathArg} destinations`));
+    errors.push(...validateCertificate(valueArg.certificate, `${pathArg} certificate`));
+    if (valueArg.authentication !== undefined) {
+        errors.push(...validateAuthentication(valueArg.authentication, `${pathArg} authentication`));
+    }
+    return errors;
+};
+const validatePortRoute = (valueArg, pathArg) => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['name', 'listenPort', 'transport', 'destinations'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (typeof valueArg.name !== 'string' || !identifierPattern.test(valueArg.name)) {
+        errors.push(`${pathArg} name must be a bounded identifier`);
+    }
+    if (!isPort(valueArg.listenPort)) {
+        errors.push(`${pathArg} listenPort must be an integer from 1 to 65535`);
+    }
+    if (valueArg.transport !== 'tcp' && valueArg.transport !== 'udp') {
+        errors.push(`${pathArg} transport must be tcp or udp`);
+    }
+    errors.push(...validateDestinations(valueArg.destinations, `${pathArg} destinations`));
+    return errors;
+};
+/**
+ * Validates one route table and names every reason it is refused.
+ *
+ * Shape only. Whether a hostname belongs to the cluster, whether a certificate
+ * matches it, and whether a destination is a node of this cluster are decisions
+ * for the party that computed the table; a table that passes here has claimed
+ * none of them. No reason ever quotes certificate material.
+ */
+export const validateClusterRouteTable = (valueArg, pathArg = 'cluster route table') => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['revision', 'issuedAt', 'routes', 'portRoutes'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!isCounter(valueArg.revision)) {
+        errors.push(`${pathArg} revision must be a non-negative safe integer`);
+    }
+    if (!Number.isSafeInteger(valueArg.issuedAt) || valueArg.issuedAt <= 0) {
+        errors.push(`${pathArg} issuedAt must be a positive epoch millisecond timestamp`);
+    }
+    if (!Array.isArray(valueArg.routes)
+        || valueArg.routes.length > clusterIngressLimits.maximumRoutes) {
+        errors.push(`${pathArg} routes must list at most ${clusterIngressLimits.maximumRoutes} routes`);
+    }
+    else {
+        const seenHostNames = new Set();
+        for (const [index, route] of valueArg.routes.entries()) {
+            errors.push(...validateHttpRoute(route, `${pathArg} routes[${index}]`));
+            const hostName = isRecord(route) ? route.hostName : undefined;
+            if (typeof hostName === 'string') {
+                if (seenHostNames.has(hostName)) {
+                    errors.push(`${pathArg} routes[${index}] repeats hostName ${hostName}`);
+                }
+                seenHostNames.add(hostName);
+            }
+        }
+    }
+    if (!Array.isArray(valueArg.portRoutes)
+        || valueArg.portRoutes.length > clusterIngressLimits.maximumPortRoutes) {
+        errors.push(`${pathArg} portRoutes must list at most `
+            + `${clusterIngressLimits.maximumPortRoutes} port routes`);
+    }
+    else {
+        const seenPorts = new Set();
+        for (const [index, portRoute] of valueArg.portRoutes.entries()) {
+            errors.push(...validatePortRoute(portRoute, `${pathArg} portRoutes[${index}]`));
+            if (!isRecord(portRoute)) {
+                continue;
+            }
+            const key = `${String(portRoute.transport)}:${String(portRoute.listenPort)}`;
+            if (seenPorts.has(key)) {
+                errors.push(`${pathArg} portRoutes[${index}] repeats ${key}`);
+            }
+            seenPorts.add(key);
+        }
+    }
+    return errors;
+};
+/** Validates one day bucket of ingress counters. */
+export const validateClusterTrafficStatistics = (valueArg, pathArg = 'cluster traffic statistics') => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, [
+        'serviceId', 'hostName', 'nodeId', 'dayUtc', 'requests', 'bytesIn', 'bytesOut',
+        'connections', 'backendErrors', 'updatedAt',
+    ])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    for (const key of ['serviceId', 'nodeId']) {
+        const value = valueArg[key];
+        if (typeof value !== 'string' || !identifierPattern.test(value)) {
+            errors.push(`${pathArg} ${key} must be a bounded identifier`);
+        }
+    }
+    if (!isClusterIngressHostName(valueArg.hostName)) {
+        errors.push(`${pathArg} hostName must be a lowercase dotted hostname`);
+    }
+    if (!isUtcCalendarDay(valueArg.dayUtc)) {
+        errors.push(`${pathArg} dayUtc must be a real YYYY-MM-DD UTC calendar day`);
+    }
+    for (const key of ['requests', 'bytesIn', 'bytesOut', 'connections']) {
+        if (!isCounter(valueArg[key])) {
+            errors.push(`${pathArg} ${key} must be a non-negative safe integer`);
+        }
+    }
+    const backendErrors = valueArg.backendErrors;
+    if (!isRecord(backendErrors)
+        || !hasExactKeys(backendErrors, ['connect', 'handshake', 'request'])
+        || !isCounter(backendErrors.connect)
+        || !isCounter(backendErrors.handshake)
+        || !isCounter(backendErrors.request)) {
+        errors.push(`${pathArg} backendErrors must count connect, handshake and request failures`);
+    }
+    if (!Number.isSafeInteger(valueArg.updatedAt) || valueArg.updatedAt <= 0) {
+        errors.push(`${pathArg} updatedAt must be a positive epoch millisecond timestamp`);
+    }
+    return errors;
+};
+/**
+ * Validates one page of ingress counters, as a reader receives it.
+ *
+ * The cursor is opaque to everyone but the ingress that issued it: bounded and
+ * printable here, meaningful only there.
+ */
+export const validateClusterTrafficStatisticsPage = (valueArg, pathArg = 'cluster traffic statistics page') => {
+    if (!isRecord(valueArg) || !hasExactKeys(valueArg, ['statistics'], ['nextCursor'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (!Array.isArray(valueArg.statistics)
+        || valueArg.statistics.length > clusterIngressLimits.maximumStatisticsPageSize) {
+        errors.push(`${pathArg} statistics must list at most `
+            + `${clusterIngressLimits.maximumStatisticsPageSize} entries`);
+    }
+    else {
+        for (const [index, item] of valueArg.statistics.entries()) {
+            errors.push(...validateClusterTrafficStatistics(item, `${pathArg} statistics[${index}]`));
+        }
+    }
+    if (valueArg.nextCursor !== undefined
+        && (typeof valueArg.nextCursor !== 'string'
+            || valueArg.nextCursor.length === 0
+            || valueArg.nextCursor.length > clusterIngressLimits.maximumCursorLength)) {
+        errors.push(`${pathArg} nextCursor must be 1 to `
+            + `${clusterIngressLimits.maximumCursorLength} characters when present`);
+    }
+    return errors;
+};
+/**
+ * Validates one cluster ingress registration and names every reason it is refused.
+ *
+ * Shape only, and deliberately so: whether the bearer is the one Cloudly minted
+ * for this cluster's ingress is Cloudly's to verify against its own records, and
+ * which cluster is speaking comes from the identity tag on the relay's session.
+ * A registration that passes here has proven nothing — and no reason it returns
+ * ever quotes the bearer, because a reason travels into logs.
+ */
+export const validateClusterIngressRegistration = (valueArg, pathArg = 'cluster ingress registration') => {
+    if (!isRecord(valueArg)
+        || !hasExactKeys(valueArg, ['bearer', 'version', 'nodeId'], ['capabilities'])) {
+        return [`${pathArg} must use its exact schema`];
+    }
+    const errors = [];
+    if (typeof valueArg.bearer !== 'string'
+        || valueArg.bearer.length < clusterIngressLimits.minimumIngressBearerLength
+        || valueArg.bearer.length > clusterIngressLimits.maximumIngressBearerLength) {
+        errors.push(`${pathArg} bearer must be ${clusterIngressLimits.minimumIngressBearerLength} to `
+            + `${clusterIngressLimits.maximumIngressBearerLength} characters`);
+    }
+    if (typeof valueArg.version !== 'string' || !identifierPattern.test(valueArg.version)) {
+        errors.push(`${pathArg} version must be a bounded identifier`);
+    }
+    if (typeof valueArg.nodeId !== 'string' || !identifierPattern.test(valueArg.nodeId)) {
+        errors.push(`${pathArg} nodeId must be a bounded identifier`);
+    }
+    if (valueArg.capabilities !== undefined
+        && (!Array.isArray(valueArg.capabilities)
+            || valueArg.capabilities.length > clusterIngressLimits.maximumIngressCapabilities
+            || !valueArg.capabilities.every((capabilityArg) => (typeof capabilityArg === 'string' && identifierPattern.test(capabilityArg))))) {
+        errors.push(`${pathArg} capabilities must be at most `
+            + `${clusterIngressLimits.maximumIngressCapabilities} bounded identifiers when present`);
+    }
+    return errors;
+};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2x1c3RlcmluZ3Jlc3MuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9kYXRhL2NsdXN0ZXJpbmdyZXNzLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sRUFBRSxzQkFBc0IsRUFBRSxNQUFNLG9CQUFvQixDQUFDO0FBQzVELE9BQU8sRUFBRSxnQkFBZ0IsRUFBRSxNQUFNLDhCQUE4QixDQUFDO0FBRWhFOzs7Ozs7Ozs7OztHQVdHO0FBRUgsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLEdBQUcsTUFBTSxDQUFDLE1BQU0sQ0FBQztJQUNoRCwwQkFBMEIsRUFBRSxFQUFFO0lBQzlCLDBCQUEwQixFQUFFLElBQUk7SUFDaEMscUJBQXFCLEVBQUUsR0FBRztJQUMxQixhQUFhLEVBQUUsSUFBSTtJQUNuQixpQkFBaUIsRUFBRSxJQUFJO0lBQ3ZCLDJCQUEyQixFQUFFLEVBQUU7SUFDL0IseUJBQXlCLEVBQUUsSUFBSTtJQUMvQixtQkFBbUIsRUFBRSxHQUFHO0lBQ3hCLHVCQUF1QixFQUFFLEdBQUc7SUFDNUIsMEJBQTBCLEVBQUUsRUFBRTtDQUMvQixDQUFDLENBQUM7QUFzRkgsTUFBTSxRQUFRLEdBQUcsQ0FBQyxRQUFpQixFQUF1QyxFQUFFLENBQUMsQ0FDM0UsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUNkLE9BQU8sUUFBUSxLQUFLLFFBQVE7T0FDNUIsQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQztPQUN4QixDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLEtBQUssTUFBTSxDQUFDLFNBQVM7V0FDbkQsTUFBTSxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsS0FBSyxJQUFJLENBQUMsQ0FDL0MsQ0FBQztBQUVGLE1BQU0sWUFBWSxHQUFHLENBQ25CLFFBQWlDLEVBQ2pDLE9BQTBCLEVBQzFCLGtCQUFxQyxFQUFFLEVBQzlCLEVBQUU7SUFDWCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDO0lBQ3pDLE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsQ0FBQztXQUN4RCxVQUFVLENBQUMsS0FBSyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxJQUFJLGVBQWUsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztBQUNsRyxDQUFDLENBQUM7QUFFRixNQUFNLFNBQVMsR0FBRyxDQUFDLFFBQWlCLEVBQXNCLEVBQUUsQ0FBQyxDQUMzRCxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxJQUFLLFFBQW1CLElBQUksQ0FBQyxDQUM1RCxDQUFDO0FBRUYsTUFBTSxNQUFNLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFLENBQUMsQ0FDeEQsTUFBTSxDQUFDLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSyxRQUFtQixJQUFJLENBQUMsSUFBSyxRQUFtQixJQUFJLE1BQU0sQ0FDOUYsQ0FBQztBQUVGLE1BQU0sZ0JBQWdCLEdBQUcsd0NBQXdDLENBQUM7QUFDbEUsNkVBQTZFO0FBQzdFLE1BQU0saUJBQWlCLEdBQUcsSUFBSSxNQUFNLENBQ2xDLGlDQUFpQyxvQkFBb0IsQ0FBQyx1QkFBdUIsR0FBRyxDQUFDLElBQUksQ0FDdEYsQ0FBQztBQUVGOzs7OztHQUtHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sd0JBQXdCLEdBQUcsQ0FBQyxRQUFpQixFQUFzQixFQUFFO0lBQ2hGLElBQUksT0FBTyxRQUFRLEtBQUssUUFBUTtXQUMzQixRQUFRLENBQUMsTUFBTSxLQUFLLENBQUM7V0FDckIsUUFBUSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyxxQkFBcUIsRUFBRSxDQUFDO1FBQ2xFLE9BQU8sS0FBSyxDQUFDO0lBQ2YsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7SUFDbkMsT0FBTyxNQUFNLENBQUMsTUFBTSxJQUFJLENBQUMsSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUMzRixDQUFDLENBQUM7QUFFRixNQUFNLG9CQUFvQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUM1RSxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUM7V0FDdkIsUUFBUSxDQUFDLE1BQU0sS0FBSyxDQUFDO1dBQ3JCLFFBQVEsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMkJBQTJCLEVBQUUsQ0FBQztRQUN4RSxPQUFPLENBQUMsR0FBRyxPQUFPLGtCQUFrQjtrQkFDaEMsR0FBRyxvQkFBb0IsQ0FBQywyQkFBMkIsZUFBZSxDQUFDLENBQUM7SUFDMUUsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsV0FBVyxDQUFDLElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7UUFDdEQsTUFBTSxlQUFlLEdBQUcsR0FBRyxPQUFPLElBQUksS0FBSyxHQUFHLENBQUM7UUFDL0MsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxlQUFlLDRCQUE0QixDQUFDLENBQUM7WUFDNUQsU0FBUztRQUNYLENBQUM7UUFDRCxJQUFJLENBQUMsc0JBQXNCLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGVBQWUseUNBQXlDLENBQUMsQ0FBQztRQUMzRSxDQUFDO1FBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM5QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsZUFBZSwwQ0FBMEMsQ0FBQyxDQUFDO1FBQzVFLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxtQkFBbUIsR0FBRyxDQUFDLFFBQWlCLEVBQUUsT0FBZSxFQUFZLEVBQUU7SUFDM0UsK0VBQStFO0lBQy9FLDBFQUEwRTtJQUMxRSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFdBQVcsRUFBRSxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFFBQVEsQ0FBQyxTQUFTLEtBQUssUUFBUSxJQUFJLFFBQVEsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJDQUEyQyxDQUFDLENBQUM7SUFDckUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsVUFBVSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUNoRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyw0Q0FBNEMsQ0FBQyxDQUFDO0lBQ3RFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLHNCQUFzQixHQUFHLENBQUMsUUFBaUIsRUFBRSxPQUFlLEVBQVksRUFBRTtJQUM5RSxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1FBQzdFLE9BQU8sQ0FBQyxHQUFHLE9BQU8sNEJBQTRCLENBQUMsQ0FBQztJQUNsRCxDQUFDO0lBQ0QsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLE9BQU87V0FDM0IsT0FBTyxRQUFRLENBQUMsSUFBSSxLQUFLLFFBQVEsSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sR0FBRyxDQUFDO1dBQzdELE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLEdBQUcsQ0FBQztRQUNoRSxDQUFDLENBQUMsRUFBRTtRQUNKLENBQUMsQ0FBQyxDQUFDLEdBQUcsT0FBTyxzREFBc0QsQ0FBQyxDQUFDO0FBQ3pFLENBQUMsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQ3pFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFVBQVUsRUFBRSxjQUFjLEVBQUUsYUFBYSxDQUFDLEVBQUUsQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUM5RixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsd0JBQXdCLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sc0VBQXNFLENBQUMsQ0FBQztJQUNoRyxDQUFDO0lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsR0FBRyxPQUFPLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDdkYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG1CQUFtQixDQUFDLFFBQVEsQ0FBQyxXQUFXLEVBQUUsR0FBRyxPQUFPLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDcEYsSUFBSSxRQUFRLENBQUMsY0FBYyxLQUFLLFNBQVMsRUFBRSxDQUFDO1FBQzFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxzQkFBc0IsQ0FBQyxRQUFRLENBQUMsY0FBYyxFQUFFLEdBQUcsT0FBTyxpQkFBaUIsQ0FBQyxDQUFDLENBQUM7SUFDL0YsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0saUJBQWlCLEdBQUcsQ0FBQyxRQUFpQixFQUFFLE9BQWUsRUFBWSxFQUFFO0lBQ3pFLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxZQUFZLEVBQUUsV0FBVyxFQUFFLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNsRixPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLE9BQU8sUUFBUSxDQUFDLElBQUksS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7UUFDaEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sb0NBQW9DLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsSUFBSSxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLEVBQUUsQ0FBQztRQUNqQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxnREFBZ0QsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssS0FBSyxJQUFJLFFBQVEsQ0FBQyxTQUFTLEtBQUssS0FBSyxFQUFFLENBQUM7UUFDakUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sK0JBQStCLENBQUMsQ0FBQztJQUN6RCxDQUFDO0lBQ0QsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLG9CQUFvQixDQUFDLFFBQVEsQ0FBQyxZQUFZLEVBQUUsR0FBRyxPQUFPLGVBQWUsQ0FBQyxDQUFDLENBQUM7SUFDdkYsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUY7Ozs7Ozs7R0FPRztBQUNILE1BQU0sQ0FBQyxNQUFNLHlCQUF5QixHQUFHLENBQ3ZDLFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxxQkFBcUIsRUFDckIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFVBQVUsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFlBQVksQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMvRSxPQUFPLENBQUMsR0FBRyxPQUFPLDRCQUE0QixDQUFDLENBQUM7SUFDbEQsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFhLEVBQUUsQ0FBQztJQUM1QixJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2xDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLCtDQUErQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsSUFBSyxRQUFRLENBQUMsUUFBbUIsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNuRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywwREFBMEQsQ0FBQyxDQUFDO0lBQ3BGLENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDO1dBQzlCLFFBQVEsQ0FBQyxNQUFNLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ2pFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDZCQUE2QixvQkFBb0IsQ0FBQyxhQUFhLFNBQVMsQ0FBQyxDQUFDO0lBQ2xHLENBQUM7U0FBTSxDQUFDO1FBQ04sTUFBTSxhQUFhLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUN4QyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDLElBQUksUUFBUSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQ3ZELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxLQUFLLEVBQUUsR0FBRyxPQUFPLFdBQVcsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3hFLE1BQU0sUUFBUSxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDO1lBQzlELElBQUksT0FBTyxRQUFRLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ2pDLElBQUksYUFBYSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO29CQUNoQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxXQUFXLEtBQUssc0JBQXNCLFFBQVEsRUFBRSxDQUFDLENBQUM7Z0JBQzFFLENBQUM7Z0JBQ0QsYUFBYSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUM5QixDQUFDO1FBQ0gsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDO1dBQ2xDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLGlCQUFpQixFQUFFLENBQUM7UUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sZ0NBQWdDO2NBQ2xELEdBQUcsb0JBQW9CLENBQUMsaUJBQWlCLGNBQWMsQ0FBQyxDQUFDO0lBQy9ELENBQUM7U0FBTSxDQUFDO1FBQ04sTUFBTSxTQUFTLEdBQUcsSUFBSSxHQUFHLEVBQVUsQ0FBQztRQUNwQyxLQUFLLE1BQU0sQ0FBQyxLQUFLLEVBQUUsU0FBUyxDQUFDLElBQUksUUFBUSxDQUFDLFVBQVUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1lBQy9ELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxpQkFBaUIsQ0FBQyxTQUFTLEVBQUUsR0FBRyxPQUFPLGVBQWUsS0FBSyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ2hGLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDekIsU0FBUztZQUNYLENBQUM7WUFDRCxNQUFNLEdBQUcsR0FBRyxHQUFHLE1BQU0sQ0FBQyxTQUFTLENBQUMsU0FBUyxDQUFDLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1lBQzdFLElBQUksU0FBUyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUN2QixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxlQUFlLEtBQUssYUFBYSxHQUFHLEVBQUUsQ0FBQyxDQUFDO1lBQ2hFLENBQUM7WUFDRCxTQUFTLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3JCLENBQUM7SUFDSCxDQUFDO0lBQ0QsT0FBTyxNQUFNLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsb0RBQW9EO0FBQ3BELE1BQU0sQ0FBQyxNQUFNLGdDQUFnQyxHQUFHLENBQzlDLFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyw0QkFBNEIsRUFDNUIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFO1FBQ2pELFdBQVcsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFFBQVEsRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLFVBQVU7UUFDOUUsYUFBYSxFQUFFLGVBQWUsRUFBRSxXQUFXO0tBQzVDLENBQUMsRUFBRSxDQUFDO1FBQ0gsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsS0FBSyxNQUFNLEdBQUcsSUFBSSxDQUFDLFdBQVcsRUFBRSxRQUFRLENBQVUsRUFBRSxDQUFDO1FBQ25ELE1BQU0sS0FBSyxHQUFHLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUM1QixJQUFJLE9BQU8sS0FBSyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLElBQUksR0FBRywrQkFBK0IsQ0FBQyxDQUFDO1FBQ2hFLENBQUM7SUFDSCxDQUFDO0lBQ0QsSUFBSSxDQUFDLHdCQUF3QixDQUFDLFFBQVEsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1FBQ2pELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLCtDQUErQyxDQUFDLENBQUM7SUFDekUsQ0FBQztJQUNELElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxRQUFRLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUN2QyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxvREFBb0QsQ0FBQyxDQUFDO0lBQzlFLENBQUM7SUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLENBQUMsVUFBVSxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsYUFBYSxDQUFVLEVBQUUsQ0FBQztRQUM5RSxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFLENBQUM7WUFDOUIsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sSUFBSSxHQUFHLHNDQUFzQyxDQUFDLENBQUM7UUFDdkUsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsYUFBYSxDQUFDO0lBQzdDLElBQUksQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDO1dBQ3ZCLENBQUMsWUFBWSxDQUFDLGFBQWEsRUFBRSxDQUFDLFNBQVMsRUFBRSxXQUFXLEVBQUUsU0FBUyxDQUFDLENBQUM7V0FDakUsQ0FBQyxTQUFTLENBQUMsYUFBYSxDQUFDLE9BQU8sQ0FBQztXQUNqQyxDQUFDLFNBQVMsQ0FBQyxhQUFhLENBQUMsU0FBUyxDQUFDO1dBQ25DLENBQUMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1FBQ3ZDLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLG1FQUFtRSxDQUFDLENBQUM7SUFDN0YsQ0FBQztJQUNELElBQUksQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsSUFBSyxRQUFRLENBQUMsU0FBb0IsSUFBSSxDQUFDLEVBQUUsQ0FBQztRQUNyRixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTywyREFBMkQsQ0FBQyxDQUFDO0lBQ3JGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7R0FLRztBQUNILE1BQU0sQ0FBQyxNQUFNLG9DQUFvQyxHQUFHLENBQ2xELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyxpQ0FBaUMsRUFDakMsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxZQUFZLENBQUMsUUFBUSxFQUFFLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQyxZQUFZLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDbkYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQztXQUNsQyxRQUFRLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQyx5QkFBeUIsRUFBRSxDQUFDO1FBQ2pGLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQztjQUNsRCxHQUFHLG9CQUFvQixDQUFDLHlCQUF5QixVQUFVLENBQUMsQ0FBQztJQUNuRSxDQUFDO1NBQU0sQ0FBQztRQUNOLEtBQUssTUFBTSxDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsSUFBSSxRQUFRLENBQUMsVUFBVSxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUM7WUFDMUQsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLGdDQUFnQyxDQUFDLElBQUksRUFBRSxHQUFHLE9BQU8sZUFBZSxLQUFLLEdBQUcsQ0FBQyxDQUFDLENBQUM7UUFDNUYsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFFBQVEsQ0FBQyxVQUFVLEtBQUssU0FBUztXQUNoQyxDQUFDLE9BQU8sUUFBUSxDQUFDLFVBQVUsS0FBSyxRQUFRO2VBQ3RDLFFBQVEsQ0FBQyxVQUFVLENBQUMsTUFBTSxLQUFLLENBQUM7ZUFDaEMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsbUJBQW1CLENBQUMsRUFBRSxDQUFDO1FBQzlFLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLDJCQUEyQjtjQUM3QyxHQUFHLG9CQUFvQixDQUFDLG1CQUFtQiwwQkFBMEIsQ0FBQyxDQUFDO0lBQzdFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7R0FRRztBQUNILE1BQU0sQ0FBQyxNQUFNLGtDQUFrQyxHQUFHLENBQ2hELFFBQWlCLEVBQ2pCLE9BQU8sR0FBRyw4QkFBOEIsRUFDOUIsRUFBRTtJQUNaLElBQUksQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDO1dBQ2xCLENBQUMsWUFBWSxDQUFDLFFBQVEsRUFBRSxDQUFDLFFBQVEsRUFBRSxTQUFTLEVBQUUsUUFBUSxDQUFDLEVBQUUsQ0FBQyxjQUFjLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDaEYsT0FBTyxDQUFDLEdBQUcsT0FBTyw0QkFBNEIsQ0FBQyxDQUFDO0lBQ2xELENBQUM7SUFDRCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFFBQVEsQ0FBQyxNQUFNLEtBQUssUUFBUTtXQUNsQyxRQUFRLENBQUMsTUFBTSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEI7V0FDeEUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxNQUFNLEdBQUcsb0JBQW9CLENBQUMsMEJBQTBCLEVBQUUsQ0FBQztRQUM5RSxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyxtQkFBbUIsb0JBQW9CLENBQUMsMEJBQTBCLE1BQU07Y0FDMUYsR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEIsYUFBYSxDQUFDLENBQUM7SUFDdkUsQ0FBQztJQUNELElBQUksT0FBTyxRQUFRLENBQUMsT0FBTyxLQUFLLFFBQVEsSUFBSSxDQUFDLGlCQUFpQixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLEVBQUUsQ0FBQztRQUN0RixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsT0FBTyx1Q0FBdUMsQ0FBQyxDQUFDO0lBQ2pFLENBQUM7SUFDRCxJQUFJLE9BQU8sUUFBUSxDQUFDLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDcEYsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLE9BQU8sc0NBQXNDLENBQUMsQ0FBQztJQUNoRSxDQUFDO0lBQ0QsSUFBSSxRQUFRLENBQUMsWUFBWSxLQUFLLFNBQVM7V0FDbEMsQ0FBQyxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQztlQUNwQyxRQUFRLENBQUMsWUFBWSxDQUFDLE1BQU0sR0FBRyxvQkFBb0IsQ0FBQywwQkFBMEI7ZUFDOUUsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxDQUFDLGFBQWEsRUFBRSxFQUFFLENBQUMsQ0FDakQsT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLGlCQUFpQixDQUFDLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FDM0UsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUNSLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxPQUFPLGdDQUFnQztjQUNsRCxHQUFHLG9CQUFvQixDQUFDLDBCQUEwQixtQ0FBbUMsQ0FBQyxDQUFDO0lBQzdGLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUMifQ==