@serve.zone/interfaces 31.9.0 → 32.0.0

package/.smartconfig.json

@@ -20,6 +20,7 @@
       ]
     },
     "release": {
+      "versionFloor": "32.0.0",
       "preflight": {
         "test": true,
         "build": true

package/changelog.md

@@ -1,5 +1,472 @@
 # Changelog
 
+## 2026-09-18 - 32.0.0
+
+### Breaking Changes
+
+- Remove the Cloudly legacy deployment settlement contracts:
+  `runtime.cloudlylegacydeploymentsettlement`, its golden vectors, its offline export and that
+  export's golden vectors (10 031 lines, 317 exported names). Production has passed the settlement
+  cutover, and the family's HMAC and AAD evidence is bound to `…-hmac-v1`, `…-hmac-v2` and
+  `…-aad-v1` domains whose bytes cannot be recomputed under unsuffixed domains, so the contracts are
+  deleted instead of renamed. The `cloudly_legacy_deployment_settlement_export_attempt_v1`
+  collection name goes with them.
+- Remove the Spark Swarm observation v1 family: `TSparkSwarmObservationV1`, and with it the v1
+  meaning of `ISparkSwarmObservationRequest`, `ISparkSwarmObservationResponse` and
+  `validateSparkSwarmObservation()`. The former v2 observation supersedes it as
+  `TSparkSwarmObservation` on `/spark/swarm-nodes/swarm-observation`, and a consumer must never
+  accept a v1 observation as an authority fallback.
+- Remove the Corestore credential binding request v1 family:
+  `TCorestoreCredentialBindingRequestV1`, `validateCorestoreCredentialBindingRequest()`,
+  `createCorestoreCredentialBindingRequestDigestInput()` and
+  `computeCorestoreCredentialBindingRequestSha256()`. Schema v2 binds every object-storage request
+  to its exact durable `bucketName`, which the v1 request cannot express.
+- Remove `IRequest_Spark_Cloudly_SendHeartbeat` (method `sparkNodeHeartbeat`). It has no handler and
+  no sender in any serve.zone repository; `sparkNodeHeartbeatContract` is the live heartbeat path.
+- Remove `runtimeSessionV1Contract.relayRegistrationRequiresNodeInstanceNonce`. Nothing read the
+  flag, and from 32.0.0 the node instance nonce is part of the registration shape itself rather than
+  a rule a controller has to police.
+- Strip the version suffix from the runtime and network authority chain, and remove `schemaVersion`
+  from every shape in it. 134 declared names, 11 digest and signature domains, 16 request method
+  strings and 13 shape members change; nothing is kept under the old spelling. **Digests and
+  signatures produced under the old domains no longer verify**, because the domain bytes and the
+  hashed payload both change: a value hashed under `serve.zone/runtime-config-v1` with a
+  `schemaVersion` member has no relation to the same value hashed under `serve.zone/runtime-config`
+  without it. Every stored digest, signature and reference in this chain is recomputed by the owning
+  service's migration, and the signed projection envelope is now `{ domain, authority, projection }`.
+  - Digest and signature domains: `serve.zone/runtime-config-v1` → `serve.zone/runtime-config`;
+    `serve.zone/runtime-assignment-v1` → `serve.zone/runtime-assignment`;
+    `serve.zone/runtime-assignment-observation-v1` → `serve.zone/runtime-assignment-observation`;
+    `serve.zone/runtime-assignment-terminal-receipt-v1` →
+    `serve.zone/runtime-assignment-terminal-receipt`;
+    `serve.zone/runtime-network-protected-authority-v1` →
+    `serve.zone/runtime-network-protected-authority`;
+    `serve.zone/runtime-network-handoff-lease-v1` → `serve.zone/runtime-network-handoff-lease`;
+    `serve.zone/runtime-network-projection-v1` → `serve.zone/runtime-network-projection`;
+    `serve.zone/runtime-network-workload-lease-v1` → `serve.zone/runtime-network-workload-lease`;
+    `serve.zone/runtime-network-protection-receipt-v1` →
+    `serve.zone/runtime-network-protection-receipt`;
+    `serve.zone/runtime-network-signing-authority-v1` →
+    `serve.zone/runtime-network-signing-authority`;
+    `serve.zone/runtime-network-projection-signature-v1` →
+    `serve.zone/runtime-network-projection-signature`.
+  - Request methods: `applyRuntimeAssignmentV1`, `reportRuntimeAssignmentObservationV1`,
+    `reportRuntimeAssignmentTerminalReceiptV1`, `applyRuntimeNetworkProjectionV1`,
+    `applyRuntimeNetworkSigningAuthorityV1`, `reportRuntimeNetworkProtectionV1` and
+    `getRuntimeManagedVpnCredentialV1` in `requests.runtimesession`, and
+    `listOwnedOrganizationsV1`, `listPrivateNetworksV1`, `listPrivateNetworkServiceCandidatesV1`,
+    `getPrivateNetworkV1`, `mutatePrivateNetworkV1`, `getServicePrivateNetworksV1`,
+    `setServicePrivateNetworksV1`, `getServicePublishedPortsV1` and `setServicePublishedPortsV1` in
+    `requests.network`, all lose their `V1` suffix; their `IReq_*` contract interfaces follow.
+  - Types, validators, snapshots, digest helpers and contract constants lose their `V1` suffix in
+    `data/runtimeassignment` (19 names), `data/runtimeterminalreceipt` (15), `data/runtimeconfig`
+    (11), `data/networkprojection` (24), `data/networkprotection` (12), `data/networkauthority`
+    (10), `data/networkdelivery` (9), `data/networksigning` (7), `data/networkcredential` (6),
+    `data/networkrouter` (2) and `runtime.networkprojection` (3). Examples:
+    `IRuntimeAssignmentV1` → `IRuntimeAssignment`, `computeRuntimeConfigV1Digest` →
+    `computeRuntimeConfigDigest`, `runtimeNetworkProjectionV1Contract` →
+    `runtimeNetworkProjectionContract`, `signRuntimeNetworkProjectionV1` →
+    `signRuntimeNetworkProjection`.
+  - `schemaVersion` is gone from `IRuntimeConfig`, `IRuntimeAssignment`,
+    `IRuntimeAssignmentObservation`, `IRuntimeAssignmentTerminalReceipt`,
+    `IRuntimeNetworkProtectedAuthority`, `IRuntimeNetworkHandoffLease`, `IRuntimeNetworkProjection`,
+    `IRuntimeNetworkWorkloadLease`, `IRuntimeNetworkProtectionReceipt`,
+    `IRuntimeNetworkSigningAuthority`, `ISignedRuntimeNetworkProjection`, `IServicePublishedPorts`
+    and `ISetServicePublishedPorts`, together with the validation that pinned it. Nothing replaces
+    it: the installed `@serve.zone/interfaces` version is the contract version.
+
+- Strip the version suffix from the session, cluster and node family, and remove `schemaVersion`
+  from every shape in it. 77 declared names, 13 request method strings, two HTTP endpoints and one
+  digest domain change; nothing is kept under the old spelling and no alias is exported.
+  - Request methods: `registerPalletRuntimeSessionV1`, `getRuntimeRegistryCredentialV1` and
+    `registerCloudlyClientSessionV1` in `requests.runtimesession`; `registerClusterRelayV1`,
+    `enableClusterRelayV1` and `disableClusterRelayV1` in `requests.cluster`; `enrollNodeV1` and
+    `getNodeEnrollmentStateV1` in `requests.node`; `preparePalletNodeEnrollmentV1`,
+    `bindPalletNodeEnrollmentV1` and `activatePalletNodeEnrollmentV1` in `requests.pallet`;
+    `getServiceMachineCredentialV1` and `mutateServiceMachineCredentialV1` in `requests.admin`.
+    Their `IReq_*` contract interfaces follow.
+  - Types, validators, snapshots and contract constants lose their suffix in `data/runtimesession`
+    (31 names), `data/clusternode` (20), `data/sparknodereport` (8) and `data/cluster` (5).
+    Examples: `IRuntimeSessionBindingV1` → `IRuntimeSessionBinding`, `runtimeSessionV1Contract` →
+    `runtimeSessionContract`, `TSparkSwarmObservationV2` → `TSparkSwarmObservation`,
+    `sparkNodeHeartbeatV2Contract` → `sparkNodeHeartbeatContract`.
+  - One collision with a live name, resolved by role rather than by a suffix: the registration a
+    relay sends becomes `IRegisterClusterRelayRequest` / `IRegisterClusterRelayResponse` with
+    `validateRegisterClusterRelayRequest`, while `IClusterRelayRegistration` stays the read model
+    Cloudly serves to an administrator.
+  - `schemaVersion` is gone from `IRuntimeSessionBinding`, `IRegisterPalletRuntimeSessionRequest`,
+    `IRegisterCloudlyClientSessionRequest`, `IClusterRelay`, `IRegisterClusterRelayRequest`,
+    `ISparkNodeReport`, `ISparkNodeHeartbeatReceipt`, `ISparkSwarmObservation*`,
+    `IClusterRuntimeTargetSetReady` and `IClusterRuntimeTargetSetUnavailable`, together with
+    `ISwarmManagerSnapshot.snapshotVersion`. The validators are exact-key, so a body that still
+    carries either field is refused as an unknown key rather than accepted as an older shape.
+  - **Digests produced under the old shapes no longer verify**: the Spark Swarm observation domain
+    becomes `serve.zone/spark-swarm-observation` and its payload loses `schemaVersion`, and the
+    Swarm manager snapshot and cluster runtime target-set digest inputs lose their version members.
+    Every stored digest in this family is recomputed by the owning service.
+  - **Two spellings the v1 observation family freed are re-used by the former v2 shapes**:
+    `ISparkSwarmObservationRequest` is now the v2 request, and `validateSparkSwarmObservation()`
+    keeps its 31.9.0 signature `(observation: unknown) => Promise<string[]>` while judging the v2
+    observation. A 31.x call site therefore still compiles and is now judged by the new exact-key
+    schema — no `schemaVersion`, and the request carries `protocol` — so a v1 body it used to pass
+    is refused at runtime. The v1 `ISparkSwarmObservationResponse` has no successor under that
+    name: the answer is `TSparkSwarmObservationResponse`, one of two request-bound receipts, and a
+    reference to the old interface fails to compile instead.
+- Every registration carrier now carries the protocol handshake, and the Pallet registration
+  answers a new shape. `registerPalletRuntimeSession`, `registerCloudlyClientSession`,
+  `registerClusterRelay` and `registerClusterIngress` take `protocol: IProtocolOffer` on the
+  request and answer with the accepting side's own offer;
+  `registerPalletRuntimeSession` answers `{ session, protocol }` instead of the bare binding, and
+  `bindRegisterPalletRuntimeSessionResponseV1` becomes
+  `bindRegisterPalletRuntimeSessionResponse(response, request)`, which binds that answer and
+  negotiates the two offers from the client's side. A server judges every carrier body in one
+  order, written down once at `protocol.readProtocolOffer` and referred to by every carrier: the
+  bounded body, `protocol.readProtocolOffer`, `protocol.negotiateProtocol` against that session
+  kind's offer, and only then the exact-key validator, the credential and any mutation. A
+  validator that also checks `protocol` checks it for self-consistency within one major; by then
+  the offer has already been negotiated.
+- `IRegisterPalletRuntimeSessionRequest.nodeInstanceNonce` is required. A controller no longer has
+  a nonce-less registration to decide about, and a relayed cluster can no longer present one.
+- `IRegisterPalletRuntimeSessionRequest.resolvedAuthorities` is required: the sorted, duplicate-free
+  list of `data.runtimeWorkloadAuthorities` this node build can resolve. A replay that states
+  different authorities is a conflict, not an update, and a controller refuses an assignment whose
+  `data.requiredWorkloadAuthorities(workload)` the list does not cover.
+- The Spark routes lose their version segment and split by runtime. The node runtime posts
+  `sparkNodeHeartbeatContract.endpoint`, now `/spark/nodes/heartbeat`, and the Swarm-era runtime
+  posts the four routes of the new `data.sparkSwarmNodeContracts`, each of them an
+  `{ endpoint, maxRequestBytes, maxResponseBytes }` beside the other three:
+  `heartbeat` (`/spark/swarm-nodes/heartbeat`, 32 768 / 2048 bytes), `metricsSample`
+  (`/spark/swarm-nodes/metrics-sample`, 4096 / 32 768), `actionResult`
+  (`/spark/swarm-nodes/action-result`, 8192 / 2048) and `swarmObservation`
+  (`/spark/swarm-nodes/swarm-observation`, 786 432 / 2048, which is what the 1024 observed nodes
+  of a manager snapshot cost). `sparkSwarmObservationContract` loses its `endpoint`
+  member, because those four endpoints now have exactly one owner. Every body on these five routes,
+  request and answer alike, carries `protocol`, and a refused offer is answered with
+  `protocolRefusalStatus` (422) and an `IProtocolRefusal` body before the node is authenticated.
+- Five first-contact exchanges still carry no protocol offer, so they name no major to the peer:
+  the Spark-to-Cloudly typed requests `getNodeEnrollmentState` and `enrollNode`, and the three
+  node-local Pallet IPC methods `preparePalletNodeEnrollment`, `bindPalletNodeEnrollment` and
+  `activatePalletNodeEnrollment`. Each is judged by its exact-key contract alone, so a 31.x sender
+  whose body still carries `schemaVersion` meets that contract's generic refusal
+  (`Node enrollment contract rejected.`) instead of a named `IProtocolRefusal` telling it which
+  major to speak. Upgrade both sides of an enrollment together: a refused enrollment body is the
+  only signal a mixed-major pair gets.
+- Strip the version suffix from the identity and secret families, and remove `schemaVersion` and
+  every constant-literal `*Version` member from them. 69 declared names, one digest domain, one
+  hashing domain, two provenance URIs and two on-disk paths change, and 21 shape members are gone;
+  nothing is kept under the old spelling and no alias is exported. Every validator and snapshot in
+  these families is exact-key, so a 31.x body that still carries a removed member is refused as an
+  unknown key instead of being read as an older shape.
+  - Types, validators, snapshots, digest helpers and contract constants lose their `V1` suffix in
+    `data/nodeenrollment` (27 names), `data/privatenetwork` (16), `data/servicecredential` (9),
+    `runtime.workloadinit` (8), `data/secret` (6) and `data/nodecredential` (3). Examples:
+    `INodeEnrollmentV1` → `INodeEnrollment`, `computeNodeEnrollmentV1Digest` →
+    `computeNodeEnrollmentDigest`, `palletNodeEnrollmentV1Contract` →
+    `palletNodeEnrollmentContract`, `snapshotPrivateNetworkV1` → `snapshotPrivateNetwork`,
+    `privateNetworkV1Contract` → `privateNetworkContract`, `IServiceMachineGrantV1` →
+    `IServiceMachineGrant`, `IWorkloadInitReleaseApprovalV1` → `IWorkloadInitReleaseApproval`,
+    `TSecretVersionPurgeOperationV1` → `TSecretVersionPurgeOperation`. No target name collided with
+    a live one, so no family needed a role word.
+  - Wire tokens: the enrollment digest domain `serve.zone/node-enrollment-v1` →
+    `serve.zone/node-enrollment`; the Docker secret resource domain
+    `serve.zone/docker-secret-resource/v1` → `serve.zone/docker-secret-resource`; the WorkloadInit
+    provenance identifiers `https://serve.zone/buildtypes/workloadinit-gitzone-tsdocker/v1` →
+    `https://serve.zone/buildtypes/workloadinit-gitzone-tsdocker` and
+    `https://serve.zone/builders/workloadinit-manual-release/v1` →
+    `https://serve.zone/builders/workloadinit-manual-release`; and the two WorkloadInit paths
+    `/run/serve.zone/workloadinit-map-v1.json` → `/run/serve.zone/workloadinit-map.json` and
+    `/opt/serve.zone/runtime-assets/workloadinit/v1/workloadinit` →
+    `/opt/serve.zone/runtime-assets/workloadinit/workloadinit`. The in-toto statement type, the
+    SLSA predicate type, `cosign-dsse-bundle-v0.3` and the OCI index media type keep their bytes:
+    they are defined by someone else's specification, and a verifier matches them literally.
+  - `schemaVersion` is gone from `INodeEnrollment`, `INodeEnrollmentAcknowledgement`,
+    `INodeEnrollmentState`, `IPalletNodeEnrollmentPreparation`, the Pallet confirmation base,
+    `INodeCredentialMetadata`, `INodeCredentialMutationPreconditions`,
+    `IServiceMachineCredentialMetadata`, the service-machine mutation base, `IPrivateNetwork`,
+    `IServicePrivateNetworks`, the private-network mutation base, `ISecretVersionPurgeIntent`, the
+    purge operation base, `IServiceSecretConfiguration`, `IResolvedSecretManifest`,
+    `IServiceSecretDeploymentPlan`, `IWorkloadInitEnvironmentMap`, the secret recipient base and
+    `IWorkloadInitReleaseApproval`. `IWorkloadInitApprovalAuthorityReference.authorityVersion`
+    goes with them, because its type was the literal `1`; the counter `authorityGeneration` stays,
+    as do every `generation`, `sessionEpoch`, `revision` and `secretsRevision` in these families.
+  - **Values derived from these domains and shapes change, so nothing computed under 31.x
+    verifies**: `createDockerSecretResourceName` gives every SecretVersion a different `szsv-*`
+    Docker resource name (and therefore a different `/run/serve.zone/secrets/<resource>` path and a
+    different WorkloadInit map), the enrollment `requestDigest`, the purge `intentDigest`, the
+    resolved-manifest `digest` and the WorkloadInit `approvalDigest` all hash payloads that lost a
+    member, and the five X25519 envelope contexts — create, rotate, App Store install,
+    resolved-secret material and recipient-enrollment challenge — lost theirs too, so an envelope
+    sealed under a 31.x context fails `verifySecretEnvelopeContext`. Cloudly recomputes the stored
+    digests and re-issues the affected material in its own migration; WorkloadInit releases are
+    re-approved under the new provenance URIs.
+  - **The WorkloadInit executable path is a rebuild, not only a token**: the literal path
+    `workloadInitExecutablePath` is the command `createWorkloadInitWrappedInvocation` puts in
+    front of a workload, so the read-only runtime-asset tree mounted at
+    `workloadRuntimeAssetRoot` has to ship the wrapper at
+    `/opt/serve.zone/runtime-assets/workloadinit/workloadinit` before any 32.0.0 workload starts.
+    An asset image built under 31.x carries it only under `.../workloadinit/v1/`, where every
+    wrapped container start fails to exec, so that image is rebuilt and rolled out with this major.
+- `IServiceSecretConfiguration` never had a second shape in this package; its `schemaVersion: 2`
+  was the token consumers discriminated on. The member is gone, so a consumer that tested
+  `secretConfiguration?.schemaVersion === 2` now tests for the presence of `secretConfiguration`
+  itself. `IResolvedSecretManifest` and `IServiceSecretDeploymentPlan` lose the same field.
+- Strip the version suffix from the storage and platform families, and remove every shape-version
+  member from them: 59 declared names, seven wire tokens and one object-key path change, and 44
+  shapes lose `schemaVersion` (45 member declarations: `TSecretRecipientEnrollmentState` declared
+  it on both union branches). With this the package carries no version token and no shape version
+  anywhere, and the naming specification proves both: it reads every `version` and `*Version`
+  member whose type or value is a constant — in a shape, in a frozen contract constant, and inside
+  a regex literal — and its backlog is empty. Two members keep the name because they state
+  something else: `commitinfo.version` is the package's own release, which `protocol.protocolVersion`
+  publishes, and `coreMailCredentialVerifierPolicy.version` is Argon2's version 19 as the PHC
+  string spells it.
+  - Types, validators, normalizers and golden vectors lose their `V<n>` suffix in
+    `runtime.corestore` (21 names), `runtime.corestore.databaseexportpackage` (11 + 1 golden),
+    `platform/objectstorageretention` (8), `runtime.ts` (16) and `data/immutableimage` (2).
+    Examples: `ICorestoreControlCredentialMaterialV1` → `ICorestoreControlCredentialMaterial`,
+    `TCorestoreCredentialBindingRequestV2` → `TCorestoreCredentialBindingRequest`,
+    `ICorestoreDatabaseExportPackageRequestV1` → `ICorestoreDatabaseExportPackageRequest`,
+    `IObjectStorageRetentionBindingV1` → `IObjectStorageRetentionBinding`,
+    `ICoreflowSecretRuntimeRegistrationV2` → `ICoreflowSecretRuntimeRegistration`,
+    `ISecretDeploymentReportResponseV1` → `ISecretDeploymentReportResponse`,
+    `IImmutableContainerInvocationV1` → `IImmutableContainerInvocation`.
+  - **Three spellings the deleted Corestore binding request v1 family freed are re-used by the
+    former v2 functions**: `validateCorestoreCredentialBindingRequest()`,
+    `createCorestoreCredentialBindingRequestDigestInput()` and
+    `computeCorestoreCredentialBindingRequestSha256()` keep their 31.x signatures and now judge and
+    hash the request that binds every object-storage request to its exact durable `bucketName`. A
+    31.x call site therefore still compiles and is judged by the new schema, so a v1 request body
+    it used to pass is refused at runtime.
+  - Wire tokens: the App Store storage feature ids `storage.bindings.v2` → `storage.bindings`,
+    `storage.filesystem.v1` → `storage.filesystem`, `storage.object-storage.v2` →
+    `storage.object-storage` and `storage.object-storage.file.v2` → `storage.object-storage.file`
+    (their keys in `appstore.appStoreStorageFeatureIds` lose the suffix with them); the
+    object-storage file delivery format `servezone-object-storage-v1` → `servezone-object-storage`;
+    the CoreMail verifier format `argon2id-v1` → `argon2id`, which keeps the KDF's own name and the
+    verification-hash bytes; the Corestore backup format `corestore.database.backup.v1` →
+    `corestore.database.backup`; and the retention sentinel object key
+    `.smartstorage-retention/v1/sentinel-<sha256>.json` → `.smartstorage-retention/sentinel-…`.
+    A sentinel written under the old key is the one value here that cannot be recomputed: it is an
+    object in a bucket under compliance retention, so it can be neither renamed nor deleted until
+    its `retainUntil`. The owning service writes a new sentinel at the new key and re-verifies the
+    binding in its own 32 slice; `validateObjectStorageRetentionEvidence` refuses the old spelling
+    until it does.
+    `smartdb.database.export.v1`, the OCI and Docker media types, the in-toto and SLSA URIs and the
+    Cosign bundle name keep their bytes: another specification defines them.
+  - `schemaVersion` is gone from 44 shapes across `runtime.corestore` (11),
+    `runtime.corestore.databaseexportpackage` (6), `runtime.ts` (6 shapes, 7 declarations, because
+    `TSecretRecipientEnrollmentState` declared it on both union branches), `platform/storagemigration`
+    (5), `data/coremail` (4), `platform/storage` (2), `data/deploymentadoption` (2),
+    `data/deploymentpreflight` (2), `appstore/types` (2: `parseAppStoreIndex` already ignored the
+    member, and `parseServezoneAppStoreManifest` drops its `schemaVersion !== 1` guard in the App
+    Store's own 32 slice — published index and manifest documents keep the member in their bytes,
+    which the type simply no longer declares), `data/immutableimage`, `data/webpush`,
+    `platform/objectstorageretention` and
+    `requests/secret` (1 each). The constant-literal siblings go with it:
+    `ICorestoreDatabaseBackupClosureReceipt.formatVersion`, the retention capability and sentinel
+    `version`, `ICoreflowSecretRuntimeRegistrationExpectation.expectationVersion` and
+    `ICoreflowSecretRuntimeRegistration.registrationVersion`. Counters stay and keep their meaning:
+    `revision`, `secretsRevision`, `generation`, `reconciliationGeneration`, `authorityGeneration`,
+    `recordRevision`, `migrationRevision`, `configEpoch`, the CoreMail credential and runtime-key
+    `version` counters and `policyGeneration`.
+  - The constant-literal versions the rest of the package still stated go with them, now that the
+    naming specification sees them: `ICorestoreNodeInventory.protocolVersion` and
+    `ICoreflowInventoryRegistration.registrationVersion` (`requests/corestore`),
+    `IBackupArchiveManifest.version` (`data/backup`), `IIsolatedRestoreGrantClaims.grantVersion`
+    and the `version` of `IIsolatedRestoreAuthorityProjection`,
+    `IIsolatedRestoreDurableChunkReceipt`, `IIsolatedRestoreDurableCompletedObjectProof`,
+    `isolatedRestoreContractLimits`, `isolatedRestoreRepositoryPathProfile` and the isolated-restore
+    golden vector set, `storageMigrationContractLimits.version`, and `strictCanonicalJsonRules.version`
+    (published as `storageMigrationCanonicalJsonRules`, `coreMailCanonicalJsonRules` and
+    `isolatedRestoreCanonicalJsonRules`). Every reader of these shapes is exact-key, so a 31.x body
+    that still carries one is refused as an unknown key — including the `protocolVersion: 1` Cloudly
+    writes on a Coreflow inventory today, which its own 32 slice drops.
+    `ICorestoreInventoryProbe.capabilityVersion` is deleted without replacement: it stated a
+    capability *number* for a set that is now stated by name in the registration, and no consumer
+    read it.
+  - **The isolated-restore digests change with those members**: the archive-manifest canonical JSON
+    and its SHA-256, the grant-claims canonical JSON and its SHA-256 (which carries the manifest
+    digest inside it), the authority-projection digest, and every durable chunk-receipt and
+    completed-object-proof digest built on them. The portable vectors in
+    `data.isolatedRestoreCanonicalDigestGoldenVectors` are regenerated from their inputs and are
+    reproduced in the specification by a canonicalizer written from the rule rather than called
+    from the implementation. A signer, relay or Corestore that stored one of these digests under
+    31.x recomputes it in its own migration.
+  - `data.optionalCoreflowRuntimeCapabilities` is exported beside the vocabulary and
+    `data.requiredCoreflowRuntimeCapabilities` is now derived from it, so a capability added to
+    `data.coreflowRuntimeCapabilities` is required from that moment unless it is named optional.
+    `validateServiceDeploymentAdoptionRetentionAttestation` judges the envelope's
+    `reporterCapabilities` with `data.isCoreflowRuntimeCapabilityList` and answers "retention
+    attestation reporter capabilities must be a canonical capability list", so the list a reporter
+    attests is held to the rule its registration was held to.
+  - Validators that were not exact-key became exact-key, so a 31.x body that still carries a
+    removed member is refused as an unknown key instead of being read as an older shape:
+    `validateServiceDeploymentAdoptionReport` (per decision),
+    `validateServiceDeploymentAdoptionRetentionAttestation`,
+    `validateDeploymentProposedConfiguration` and `validateObjectStorageRetentionBinding`.
+  - `ICoreflowRuntimeCapabilities` is replaced by `capabilities: TCoreflowRuntimeCapability[]` on
+    `ICoreflowSecretRuntimeRegistration` and by `reporterCapabilities` on
+    `IImmutableRolloutReportEnvelope`: a sorted, duplicate-free list of the names in
+    `coreflowRuntimeCapabilities`, judged by `isCoreflowRuntimeCapabilityList` and required to
+    contain every name in `requiredCoreflowRuntimeCapabilities`. The seven `*Version: 1 | 2`
+    members said two things at once — that a contract exists and which shape was meant — and the
+    shape is the interfaces version the peers exchanged. `corestore-inventory` stays the one
+    optional capability.
+  - **One owner per constant**: `runtime.corestoreDatabaseBackupMediaType`
+    (`application/vnd.serve-zone.corestore-database-backup`) and
+    `runtime.corestoreDatabaseBackupFormat` (`corestore.database.backup`) are defined once here.
+    Corestore's control server, its export packager, Onebox and the cluster relay delete their own
+    copies and import these, so a transfer cannot be served under one spelling and read under
+    another.
+  - **Values derived from these shapes change, so nothing computed under 31.x verifies**: the
+    immutable invocation digest loses `schemaVersion`, and with it every runtime config, assignment
+    and run digest of that chain and every `invocationDigest` in a resolved manifest reference; the
+    Coreflow secret-runtime `expectationDigest` loses a `schemaVersion` literal that was still
+    hashed into its payload; every secret deployment `reportDigest`; the object-storage retention
+    `intentSha256`; the storage-migration snapshot, migration, binding, staging and activation
+    digests; the Corestore binding-request digest, the control-credential and publication envelope
+    contexts, the control-credential plaintext bytes, the database backup receipt and restore
+    request bytes and the whole export-package digest chain; and the CoreMail desired-state digest.
+    Each owning service recomputes its stored digests in its own migration; nothing of the old
+    computation stays in this package.
+
+- Route the isolated restore over the cluster relay, by node id. The four `Cloudly_Coreflow_*`
+  control contracts and `stageIsolatedRestoreArchive` are replaced by five contracts of one shape,
+  `{ nodeId, control }` → `{ progress }`: `prepareIsolatedRestoreOnNode`,
+  `stageIsolatedRestoreArchive`, `getIsolatedRestoreProgressOnNode`,
+  `executeIsolatedRestoreOnNode` and `cleanupIsolatedRestoreOnNode`
+  (`IReq_Cloudly_Relay_PrepareIsolatedRestoreOnNode` and its four siblings). `control` is the body
+  Corestore itself reads — the existing `data.IIsolatedRestoreControl*Request` family, with the
+  signed grant inside it — so the relay forwards it untouched instead of restating its fields, and
+  the old flattened `restoreGrant`/`clusterId`/`targetNodeName`/`restoreId`/`expectedRevision`
+  request bodies are gone. `stageIsolatedRestoreArchive` no longer carries a `TVirtualStream`: it
+  takes one bounded chunk per call, as Corestore's `write-object` route accepts it, and the answer
+  says where the next chunk continues. No contract carries an identity or a protocol offer: the
+  cluster is the one the verified machine identity on the session `registerCloudlyClientSession`
+  opened names, and the protocol offer was exchanged by that handshake and again by
+  `registerClusterRelay`'s own `protocol` member. Nothing served or called these methods, so no
+  deployment changes with them.
+- Remove `IIsolatedRestoreNodeState` and `TIsolatedRestoreNodeStatus`. They were the response of
+  those five contracts and no component could author one: a node knows Corestore's staging summary
+  and nothing of the source backup, the requesting actor or the control plane's verification, and
+  its ten-state status vocabulary was never Corestore's five. `data.IIsolatedRestoreProgress`
+  replaces them with what a node can actually state, and Cloudly composes its record from that and
+  its own knowledge, exactly as it does with the Corestore inventory.
+- `createIsolatedRestore` takes `targetNodeId` instead of `targetNodeName`, and
+  `IIsolatedRestoreRecord` states both: the cluster document's node id is what a relay routes on,
+  the node name is what the signed grant authorizes and Corestore verifies, and Cloudly is the one
+  party that holds both. `getIsolatedRestores` filters by either. `targetNodeName` is refused as
+  caller input on creation, like every other value Cloudly derives.
+- The Spark node report's bundle version (`data.snapshotSparkNodeReport`) is judged by the release
+  grammar `ts/private/releaseversion.ts` owns instead of its own copy of the pattern, so its bound
+  tightens from 64 characters to 32 and a component beyond the safe-integer range is refused. A
+  stored bundle version longer than 32 characters is refused from 32.0.0 on; every version this
+  package accepts is one `compareReleaseVersions` can order.
+- Three peer-visible reasons in the isolated-restore family lose a word that is no longer true:
+  `… does not match its exact versioned schema` → `… does not match its exact schema`,
+  `archiveManifest object sizes exceed the versioned total-size limit` → `… exceed the total-size
+  limit`, and `write request decoded chunk exceeds the versioned chunk limit` → `… exceeds the
+  chunk limit`. The shapes behind them carry no version since 32.0.0. These are breaking message
+  changes: a consumer matching on the old text must drop the word, as this package's own contract
+  specs did.
+
+### Features
+
+- Add what one node can state about an isolated restore it holds, in Corestore's own words.
+  `data.IIsolatedRestoreProgress { nodeId, restoreId, stagingArchiveId, status, revision,
+  lastFence, expectedObjects, receivedObjects, completedMappings, totalMappings, preparedAt,
+  updatedAt, executedAt?, stagedObject? }` is Corestore's staging summary plus the node the control
+  was carried to, and `data.isolatedRestoreProgressStatuses` is its status vocabulary taken
+  verbatim from Corestore's control server: `prepared`, `executing`, `failed`, `executed`,
+  `cleaned`. `data.normalizeIsolatedRestoreProgress` reads it exactly — refusing an unknown status,
+  a count larger than the plan it belongs to, a `revision` or `lastFence` below 1, an `executing`
+  or `executed` answer that does not hold the whole archive, an `executed` answer that left a
+  mapping behind or does not say when it finished, and any member backed by an accessor — and
+  `data.bindIsolatedRestoreProgressToNode(progress, { nodeId, restoreId })` ties an answer back to
+  the call it answers, which nothing else can do: the control body names neither the node nor the
+  restore. `data.IIsolatedRestoreObjectProgress { path, nextOffset, completed }` rides along as
+  `stagedObject` on a staged chunk — named apart from Corestore's own `object` receipt, which is a
+  different shape and is not carried — so an interrupted staging run resumes at the byte the node
+  already holds.
+- `data.IIsolatedRestoreControlAuthority` is the base the five
+  `data.IIsolatedRestoreControl*Request` bodies extend, so the signed `restoreGrant` — and the
+  warning that it is a bearer credential to keep out of hooks, logs, diagnostics and durable
+  journals — is declared once, where the grant is, instead of once per contract. The bodies are
+  unchanged on the wire.
+- `data.normalizeIsolatedRestoreNodeControl(value, normalizeControl)` reads one `{ nodeId,
+  control }` request with the normalizer of the operation it serves, so there is one reader for the
+  envelope and one judge per control body, and `data.isolatedRestoreNodeControlRefusals` with
+  `data.TIsolatedRestoreNodeControlRefusal` names the three answers a relay gives instead of a
+  progress: `restore-node-not-carried` and `restore-node-unreachable` are the relay's own statement
+  that the control never reached Corestore, and `restore-node-refused` carries Corestore's own
+  reason behind it rather than inventing a second vocabulary for it.
+
+- Add the protocol handshake two peers exchange when a session opens, exported from the root as
+  `protocol`. The protocol version is the installed `@serve.zone/interfaces` release
+  (`protocol.protocolVersion`, taken from the package's own commit info): there is no protocol
+  number beside it, no per-shape version suffix and no `schemaVersion` field.
+  - `IProtocolOffer { interfacesVersion; minimumPeerVersion }` states what one side speaks and the
+    oldest peer it accepts. `createProtocolOffer` builds this build's offer and throws on a minimum
+    above the installed release or in another major, so a wrong minimum fails at a deployable's
+    start-up rather than at its first registration. `validateProtocolOffer` names every reason an
+    offer is refused, and `readProtocolOffer` reads the `protocol` key of a body alone and returns
+    it detached, which is what lets a server negotiate before its exact-key validators see a body
+    from a later major. `validateProtocolOfferOn(body, path?)` is its naming twin for a validator
+    that lists reasons instead of throwing, so both doors into a body read that key the same way.
+  - `negotiateProtocol(local, remote)` is pure and checks in a fixed order: `major-mismatch` even
+    when a minimum would also fail, then `peer-below-minimum`, then `self-below-peer-minimum`. The
+    last two are mirror images of one another and can never hold at once.
+  - `IProtocolRefusal { code: 'protocol-incompatible'; reason; refusing; refused }` is the named
+    refusal a peer carries as `TypedResponseError.errorData` or as a plain HTTP JSON body;
+    `readProtocolRefusal` recovers it from either and answers `null` for every other error, and
+    `describeProtocolRefusal` writes the log line. `refusedOfferRetryIntervalMs` (300000) is the one
+    cadence at which a refused client offers again, so no client invents its own.
+  - Every carrier reads the offer once, as data: a `protocol` key, or a member of the offer under
+    it, that is an accessor rather than a plain value is refused as "must use its exact schema" and
+    is never invoked, by every function above. Every offer and refusal the module hands out is
+    frozen and built from the values that were validated, so what a session was negotiated over
+    cannot change afterwards — not through the body it arrived on, not through code a peer attached
+    to it, and not through the caller's own offer.
+  - `ts/private/releaseversion.ts` owns the release-version grammar — `MAJOR.MINOR.PATCH`, at most
+    32 characters, no prerelease or build metadata, safe-integer components compared per component —
+    behind one predicate, `isReleaseVersion`, which every validator goes through.
+  - `protocol.protocolRefusalHttpStatus` (422) is the status a route that carries no typed error
+    answers a refusal with. The Spark contracts state that same constant rather than their own
+    number, so the refusal status has one owner.
+- Export the refusal vocabularies two processes have to agree on, so neither keeps its own copy:
+  `data.holdRuntimeNetworkDnsLeaseRenewalsRefusals` with
+  `data.THoldRuntimeNetworkDnsLeaseRenewalsRefusal` names the six reasons a cluster relay refuses
+  to hold a run of DNS lease renewals (`escrow-run-invalid`, `escrow-node-not-carried`,
+  `escrow-run-foreign-session`, `escrow-run-stale`, `escrow-run-unordered`, `escrow-cloudly-only`),
+  and `data.clusterRelayUndispatchedRefusals` with `data.TClusterRelayUndispatchedRefusal` names
+  the three registration refusals that end a relay's custody (`relay-cluster-not-enabled`,
+  `relay-node-foreign`, `relay-sequence-not-advancing`). A hold is answered only by its refusal,
+  and those three registration refusals are Cloudly reading its own records, so a relay that hears
+  one drops what it holds instead of waiting.
+- Add the workload authority vocabulary to `data/runtimeassignment`, beside the workload whose keys
+  define it: `runtimeWorkloadAuthorities` (`network`, `secrets`, `storage`) with
+  `TRuntimeWorkloadAuthority`, `requiredWorkloadAuthorities(workload)` for what a workload cannot
+  run without, and `isResolvedWorkloadAuthorities(value)` for a receiver checking a list it was
+  sent. Canonical is strictly increasing in the code-unit order of the names, which both functions
+  compare through, so the rule that builds a list and the rule that judges one cannot disagree
+  about what an assignment demands whatever order the vocabulary itself is written in.
+- Move the Swarm-era Spark heartbeat shape into this package as
+  `data.ISparkSwarmNodeHeartbeatRequest` / `ISparkSwarmNodeHeartbeatResponse`. Cloudly and Spark
+  each carried a private copy of it, which is how the two drifted apart; the four Swarm-era routes
+  now have one owner in `data.sparkSwarmNodeContracts`.
+
+### Maintenance
+
+- Three internal reader modules now own the rules the contracts used to restate:
+  `ts/private/dataproperties.ts` reads own enumerable data properties only
+  (`isPlainRecord`, `readDataProperty`, `readDataProperties`, `readDataElements`, `hasExactKeys`,
+  `readExactDataRecord`), `ts/private/tokenlist.ts` judges a canonical token list
+  (`isCanonicalTokenList`), and `ts/private/canonicaljson.ts` orders wire tokens
+  (`compareWireTokens`). They are internal: nothing under `ts/private` is exported from the
+  package, so a consumer sees only the validators that go through them.
+- The naming spec reads the compiler from `@git.zone/tsbuild/typescript` (tsbuild 4.5.0), so the
+  package no longer declares its own `typescript` dev dependency.
+
 ## 2026-09-17 - 31.9.0
 
 ### Features

package/dist_ts/00_commitinfo_data.js

@@ -2,8 +2,8 @@
  * autocreated commitinfo by @push.rocks/commitinfo
  */
 export const commitinfo = {
-    name: '@serve.zone/interfaces',
-    version: '31.9.0',
-    description: 'Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem.'
+    name: "@serve.zone/interfaces",
+    version: "32.0.0",
+    description: "Shared TypeScript interfaces and TypedRequest contracts for the serve.zone ecosystem."
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vdHMvMDBfY29tbWl0aW5mb19kYXRhLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBOztHQUVHO0FBQ0gsTUFBTSxDQUFDLE1BQU0sVUFBVSxHQUFHO0lBQ3hCLElBQUksRUFBRSx3QkFBd0I7SUFDOUIsT0FBTyxFQUFFLFFBQVE7SUFDakIsV0FBVyxFQUFFLHVGQUF1RjtDQUNyRyxDQUFBIn0=

package/dist_ts/appstore/types.d.ts

@@ -24,10 +24,10 @@ export type TAppStoreSourceType = 'inline' | 'repoManifest' | 'dockerImage';
 export type TAppStoreTrackingMode = 'tag' | 'digest';
 export type TAppStoreUpgradeStrategy = 'semver' | 'branch' | 'dockerDigest';
 export declare const appStoreStorageFeatureIds: {
-    readonly bindingsV2: "storage.bindings.v2";
-    readonly filesystemV1: "storage.filesystem.v1";
-    readonly objectStorageV2: "storage.object-storage.v2";
-    readonly objectStorageFileV2: "storage.object-storage.file.v2";
+    readonly bindings: "storage.bindings";
+    readonly filesystem: "storage.filesystem";
+    readonly objectStorage: "storage.object-storage";
+    readonly objectStorageFile: "storage.object-storage.file";
 };
 export type TAppStoreStorageFeatureId = typeof appStoreStorageFeatureIds[keyof typeof appStoreStorageFeatureIds];
 export type TAppStoreStoragePurpose = 'runtime' | 'database' | 'registry' | 'backup';
@@ -182,7 +182,6 @@ export interface IAppStoreApp {
     resolvedSource?: IAppStoreResolvedSource;
 }
 export interface IAppStoreIndex {
-    schemaVersion: number;
     updatedAt: string;
     resolvedAt?: string;
     apps: IAppStoreApp[];
@@ -267,7 +266,6 @@ export interface IServezoneAppStoreVersion extends IAppStoreVersionConfig {
     version: string;
 }
 export interface IServezoneAppStoreManifest {
-    schemaVersion: number;
     app: IServezoneAppStoreAppInfo;
     latestVersion?: string;
     channel?: string;

package/dist_ts/appstore/types.js

@@ -1,10 +1,10 @@
 import { createAppStoreInstallSecretEnvelopeContext, validateSecretDelivery, validateSecretValueInput, validateSecretValueInputForRecipient, } from '../data/secret.js';
 import { validateHostedAppRoleDefinitions, } from '../data/hostedapp.js';
 export const appStoreStorageFeatureIds = {
-    bindingsV2: 'storage.bindings.v2',
-    filesystemV1: 'storage.filesystem.v1',
-    objectStorageV2: 'storage.object-storage.v2',
-    objectStorageFileV2: 'storage.object-storage.file.v2',
+    bindings: 'storage.bindings',
+    filesystem: 'storage.filesystem',
+    objectStorage: 'storage.object-storage',
+    objectStorageFile: 'storage.object-storage.file',
 };
 const appStorePublicEnvKeyRegex = /^[A-Za-z_][A-Za-z0-9_]{0,252}$/;
 const appStoreSecretKeyRegex = /^[A-Z_][A-Z0-9_]{0,252}$/;
@@ -282,4 +282,4 @@ export const validateAppStoreInstallRequest = async (requestArg, configArg, acti
     }
     return errors;
 };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hcHBzdG9yZS90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsMENBQTBDLEVBQzFDLHNCQUFzQixFQUN0Qix3QkFBd0IsRUFDeEIsb0NBQW9DLEdBS3JDLE1BQU0sbUJBQW1CLENBQUM7QUFDM0IsT0FBTyxFQUNMLGdDQUFnQyxHQUVqQyxNQUFNLHNCQUFzQixDQUFDO0FBNkM5QixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRztJQUN2QyxVQUFVLEVBQUUscUJBQXFCO0lBQ2pDLFlBQVksRUFBRSx1QkFBdUI7SUFDckMsZUFBZSxFQUFFLDJCQUEyQjtJQUM1QyxtQkFBbUIsRUFBRSxnQ0FBZ0M7Q0FDN0MsQ0FBQztBQThLWCxNQUFNLHlCQUF5QixHQUFHLGdDQUFnQyxDQUFDO0FBQ25FLE1BQU0sc0JBQXNCLEdBQUcsMEJBQTBCLENBQUM7QUFFMUQsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsYUFBc0IsRUFDWixFQUFFO0lBQ1osSUFBSSxhQUFhLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQzNDLElBQUksQ0FBQyxhQUFhLElBQUksT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsYUFBd0MsQ0FBQztJQUM1RCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMxQyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN4QyxVQUFVLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7V0FDeEMsVUFBVSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1dBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztXQUNwQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsWUFBWSxFQUFFLHFCQUFxQixDQUFDLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNsRyxNQUFNLENBQUMsSUFBSSxDQUFDLDBGQUEwRixDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQ0FBZ0MsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1NBQzlELEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUVsRCxNQUFNLFdBQVcsR0FBRyxVQUFVLENBQUMsb0JBQW9CLENBQUM7SUFDcEQsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztJQUNyRSxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sSUFBSSxHQUFHLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLFVBQVUsQ0FBVSxDQUFDO1FBQzNGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFFLFdBQXVDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN0RixJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFO1lBQ2hDLElBQUksT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUTttQkFDbkMsQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBVyxDQUFDLEVBQUUsQ0FBQztnQkFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsTUFBTSxrQ0FBa0MsQ0FBQyxDQUFDO1lBQzdGLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMzQyxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxxQkFBcUI7V0FDOUQsVUFBVSxDQUFDLDBCQUEwQixLQUFLLG9CQUFvQixFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxDQUNqRCxTQUFrQixFQUNSLEVBQUU7SUFDWixJQUFJLENBQUMsU0FBUyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFNBQW9DLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUc7UUFDYixHQUFHLHNDQUFzQyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUM7UUFDOUQsR0FBRyx1Q0FBdUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0tBQzNELENBQUM7SUFDRixJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksSUFBSSxPQUFPLE1BQU0sQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUM5RCxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUM7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUN2RCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsWUFBdUMsQ0FBQztJQUNsRSxJQUFJLENBQUMsVUFBVSxDQUFDLG9CQUFvQixJQUFJLE9BQU8sVUFBVSxDQUFDLG9CQUFvQixLQUFLLFFBQVE7V0FDdEYsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsb0JBQW9CLENBQUM7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUNuRSxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQztTQUNwRSxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQXNCLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNFLE1BQU0sZUFBZSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUNuRCxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQzdCLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztZQUM1RCxDQUFDLENBQUUsTUFBa0MsQ0FBQyxHQUFHO1lBQ3pDLENBQUMsQ0FBQyxTQUFTLENBQ2QsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBc0IsRUFBRSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FBQztRQUMzRSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsS0FBSyxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUNsQyxJQUFJLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN0QixNQUFNLENBQUMsSUFBSSxDQUFDLGlDQUFpQyxHQUFHLG1DQUFtQyxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUE0SUYsTUFBTSx1QkFBdUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUV0RSxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxlQUF3QixFQUNkLEVBQUU7SUFDWixJQUFJLGVBQWUsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDN0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLElBQUksZUFBZSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUNwRSxPQUFPLENBQUMsaUNBQWlDLENBQUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sSUFBSSxHQUFhLEVBQUUsQ0FBQztJQUMxQixlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQ25ELElBQUksQ0FBQyxjQUFjLElBQUksT0FBTyxjQUFjLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztZQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RELE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsY0FBeUMsQ0FBQztRQUM5RCxNQUFNLFdBQVcsR0FBRyxXQUFXLENBQUMsTUFBTSxLQUFLLElBQUk7WUFDN0MsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztZQUMvRSxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUNuRSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLG9EQUFvRCxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxNQUFNLEtBQUssSUFBSTtZQUMxQyxDQUFDLENBQUMsc0JBQXNCO1lBQ3hCLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQztRQUM5QixJQUFJLE9BQU8sV0FBVyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU0sS0FBSyxJQUFJO2dCQUNyQyxDQUFDLENBQUMsV0FBVyxRQUFRLHNDQUFzQztnQkFDM0QsQ0FBQyxDQUFDLFdBQVcsUUFBUSw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDN0IsQ0FBQztRQUNELElBQUksT0FBTyxXQUFXLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxXQUFXLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSwrQkFBK0IsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE9BQU8sV0FBVyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSw0QkFBNEIsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDaEMsSUFBSSxPQUFPLElBQUksV0FBVztnQkFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSxvQ0FBb0MsQ0FBQyxDQUFDO1lBQ2pHLElBQUksQ0FBQyxDQUFDLFVBQVUsSUFBSSxXQUFXLENBQUMsRUFBRSxDQUFDO2dCQUNqQyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSx3Q0FBd0MsQ0FBQyxDQUFDO1lBQzNFLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQztxQkFDeEQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxXQUFXLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDNUQsQ0FBQztZQUNELElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHdCQUF3QixDQUFDO29CQUN0QyxJQUFJLEVBQUUsV0FBVztvQkFDakIsR0FBSSxXQUFXLENBQUMsUUFBb0M7aUJBQ3JELENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFdBQVcsUUFBUSxjQUFjLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUNyRSxDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssS0FBSyxFQUFFLENBQUM7Z0JBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLGdDQUFnQyxDQUFDLENBQUM7WUFDbkUsQ0FBQztZQUNELElBQUksVUFBVSxJQUFJLFdBQVc7Z0JBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEsdUNBQXVDLENBQUMsQ0FBQztZQUN2RyxJQUFJLFVBQVUsSUFBSSxXQUFXO2dCQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLHVDQUF1QyxDQUFDLENBQUM7WUFDdkcsSUFBSSxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLHlDQUF5QyxDQUFDLENBQUM7WUFDNUUsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUNILElBQUksSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxNQUFNO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO0lBQ25GLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsVUFBbUIsRUFDbkIsU0FBaUMsRUFDakMseUJBQXlELEVBQ3RDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQy9FLE9BQU8sQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxVQUFxQyxDQUFDO0lBQ3RELE1BQU0sZUFBZSxHQUFHLFNBQVMsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRO1FBQ2hFLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTztRQUNuQixDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsTUFBTSxNQUFNLEdBQUcsdUNBQXVDLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDeEUsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUNqQyxZQUFZO1FBQ1osT0FBTztRQUNQLFNBQVM7UUFDVCxXQUFXO1FBQ1gsYUFBYTtRQUNiLFFBQVE7UUFDUixNQUFNO1FBQ04sZ0JBQWdCO1FBQ2hCLG9CQUFvQjtRQUNwQixtQkFBbUI7UUFDbkIsY0FBYztLQUNmLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVE7V0FDckMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxDQUFVLEVBQUUsQ0FBQztRQUM5RSxJQUFJLE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFFLE9BQU8sQ0FBQyxLQUFLLENBQVksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxLQUFLLG9CQUFvQixDQUFDLENBQUM7UUFDcEQsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLGlCQUFpQixHQUFHLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQztJQUNwRCxJQUFJLENBQUMsaUJBQWlCLElBQUksT0FBTyxpQkFBaUIsS0FBSyxRQUFRO1dBQzFELEtBQUssQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUM7V0FDaEMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUNoRSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQ3hFLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3JGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQWEsRUFBRSxDQUFDO0lBQy9CLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUFtQyxDQUFDO0lBQy9ELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLElBQUksZUFBZSxDQUFDLE1BQU0sSUFBSSxHQUFHO1FBQ2xGLENBQUMsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUErQyxFQUFFLENBQUMsQ0FDaEYsdUNBQXVDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQ2pFLENBQUM7UUFDSixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxZQUFZO1NBQzVDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBcUQsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDO1NBQ2pHLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNoRCxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxDQUFDLFlBQVk7U0FDNUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFxRCxFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUM7U0FDakcsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUMxRCxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsUUFBUSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ25FLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztRQUNsRCxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLFFBQVEsNkJBQTZCLENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsSUFBSSxPQUFPLEtBQUssQ0FBQyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLFFBQVEseUJBQXlCLENBQUMsQ0FBQztZQUN2RSxTQUFTO1FBQ1gsQ0FBQztRQUNELFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzFCLFdBQVcsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNsQyxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RELE1BQU0sZUFBZSxHQUFHLFdBQVc7ZUFDOUIsT0FBTyxPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVE7ZUFDdEMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUM7ZUFDaEQsT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7ZUFDakMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7ZUFDN0IsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVE7ZUFDbkMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7ZUFDL0IsT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVE7ZUFDckMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN2QyxNQUFNLGVBQWUsR0FBRyxlQUFlO1lBQ3JDLENBQUMsQ0FBQywwQ0FBMEMsQ0FBQztnQkFDekMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFvQjtnQkFDeEMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFlO2dCQUM5QixVQUFVLEVBQUUsT0FBTyxDQUFDLE9BQWlCO2dCQUNyQyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQW1CO2dCQUN0QyxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7Z0JBQ2QsUUFBUSxFQUFFLFdBQVcsQ0FBQyxRQUFRO2dCQUM5QixVQUFVLEVBQUUsV0FBVyxDQUFDLFFBQVE7YUFDakMsQ0FBQztZQUNKLENBQUMsQ0FBQyxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sb0NBQW9DLENBQ3hELEtBQUssQ0FBQyxVQUFVLEVBQ2hCLHlCQUF5QixFQUN6QixlQUFlLENBQ2hCLENBQUM7YUFDQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLHdCQUF3QixRQUFRLEtBQUssUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxpQkFBaUIsSUFBSSxFQUFFLENBQTRCLENBQUMsRUFBRSxDQUFDO1FBQ3BGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO1lBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx1QkFBdUIsR0FBRywwQkFBMEIsQ0FBQyxDQUFDO1FBQ3BHLElBQUksV0FBVyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUM7WUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLDRCQUE0QixDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUN2QyxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLEdBQUcsMEJBQTBCLENBQUMsQ0FBQztZQUNsRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUErQixDQUFDO1FBQ3pELElBQUksVUFBVSxFQUFFLElBQUksS0FBSyxXQUFXO2VBQy9CLENBQUMsQ0FBQyxXQUFXLENBQUMsUUFBUTttQkFDcEIsV0FBVyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEtBQUssVUFBVSxDQUFDLFFBQVE7bUJBQ3JELFdBQVcsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLEdBQUcsNkNBQTZDLENBQUMsQ0FBQztRQUN2RixDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxXQUFXLElBQUksa0JBQWtCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUN0RCxJQUFJLFdBQVcsQ0FBQyxRQUFRO2VBQ25CLFdBQVcsQ0FBQyxLQUFLLEtBQUssU0FBUztlQUMvQixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxpQkFBaUIsSUFBSSxFQUFFLENBQVcsRUFBRSxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxXQUFXLENBQUMsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxXQUFXLElBQUksa0JBQWtCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUN0RCxJQUFJLFdBQVcsQ0FBQyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUSxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxXQUFXLENBQUMsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoidHlwZXMuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9hcHBzdG9yZS90eXBlcy50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEVBQ0wsMENBQTBDLEVBQzFDLHNCQUFzQixFQUN0Qix3QkFBd0IsRUFDeEIsb0NBQW9DLEdBS3JDLE1BQU0sbUJBQW1CLENBQUM7QUFDM0IsT0FBTyxFQUNMLGdDQUFnQyxHQUVqQyxNQUFNLHNCQUFzQixDQUFDO0FBNkM5QixNQUFNLENBQUMsTUFBTSx5QkFBeUIsR0FBRztJQUN2QyxRQUFRLEVBQUUsa0JBQWtCO0lBQzVCLFVBQVUsRUFBRSxvQkFBb0I7SUFDaEMsYUFBYSxFQUFFLHdCQUF3QjtJQUN2QyxpQkFBaUIsRUFBRSw2QkFBNkI7Q0FDeEMsQ0FBQztBQThLWCxNQUFNLHlCQUF5QixHQUFHLGdDQUFnQyxDQUFDO0FBQ25FLE1BQU0sc0JBQXNCLEdBQUcsMEJBQTBCLENBQUM7QUFFMUQsTUFBTSxDQUFDLE1BQU0sc0NBQXNDLEdBQUcsQ0FDcEQsYUFBc0IsRUFDWixFQUFFO0lBQ1osSUFBSSxhQUFhLEtBQUssU0FBUztRQUFFLE9BQU8sRUFBRSxDQUFDO0lBQzNDLElBQUksQ0FBQyxhQUFhLElBQUksT0FBTyxhQUFhLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsYUFBYSxDQUFDLEVBQUUsQ0FBQztRQUN4RixPQUFPLENBQUMsZ0NBQWdDLENBQUMsQ0FBQztJQUM1QyxDQUFDO0lBQ0QsTUFBTSxVQUFVLEdBQUcsYUFBd0MsQ0FBQztJQUM1RCxNQUFNLE1BQU0sR0FBYSxFQUFFLENBQUM7SUFDNUIsSUFBSSxPQUFPLFVBQVUsQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUMxQyxDQUFDLFVBQVUsQ0FBQyxZQUFZLENBQUMsVUFBVSxDQUFDLEdBQUcsQ0FBQztXQUN4QyxVQUFVLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7V0FDeEMsVUFBVSxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsWUFBWSxDQUFDO1dBQ3hDLE1BQU0sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFlBQVksQ0FBQztXQUNwQyxJQUFJLEdBQUcsQ0FBQyxVQUFVLENBQUMsWUFBWSxFQUFFLHFCQUFxQixDQUFDLENBQUMsUUFBUSxLQUFLLFVBQVUsQ0FBQyxZQUFZLEVBQUUsQ0FBQztRQUNsRyxNQUFNLENBQUMsSUFBSSxDQUFDLDBGQUEwRixDQUFDLENBQUM7SUFDMUcsQ0FBQztJQUNELE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxnQ0FBZ0MsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDO1NBQzlELEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsZ0JBQWdCLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUVsRCxNQUFNLFdBQVcsR0FBRyxVQUFVLENBQUMsb0JBQW9CLENBQUM7SUFDcEQsSUFBSSxDQUFDLFdBQVcsSUFBSSxPQUFPLFdBQVcsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1FBQ2xGLE1BQU0sQ0FBQyxJQUFJLENBQUMscURBQXFELENBQUMsQ0FBQztJQUNyRSxDQUFDO1NBQU0sQ0FBQztRQUNOLE1BQU0sSUFBSSxHQUFHLENBQUMsV0FBVyxFQUFFLFVBQVUsRUFBRSxjQUFjLEVBQUUsYUFBYSxFQUFFLFVBQVUsQ0FBVSxDQUFDO1FBQzNGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFFLFdBQXVDLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztRQUN0RixJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsRUFBRSxFQUFFO1lBQ2hDLElBQUksT0FBTyxNQUFNLENBQUMsUUFBUSxDQUFDLEtBQUssUUFBUTttQkFDbkMsQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBVyxDQUFDLEVBQUUsQ0FBQztnQkFDOUQsTUFBTSxDQUFDLElBQUksQ0FBQyxxQ0FBcUMsTUFBTSxrQ0FBa0MsQ0FBQyxDQUFDO1lBQzdGLENBQUM7UUFDSCxDQUFDLENBQUMsQ0FBQztRQUNILElBQUksSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUMzQyxNQUFNLENBQUMsSUFBSSxDQUFDLDhDQUE4QyxDQUFDLENBQUM7UUFDOUQsQ0FBQztJQUNILENBQUM7SUFDRCxJQUFJLFVBQVUsQ0FBQywwQkFBMEIsS0FBSyxxQkFBcUI7V0FDOUQsVUFBVSxDQUFDLDBCQUEwQixLQUFLLG9CQUFvQixFQUFFLENBQUM7UUFDcEUsTUFBTSxDQUFDLElBQUksQ0FBQyx3REFBd0QsQ0FBQyxDQUFDO0lBQ3hFLENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUFFRixNQUFNLENBQUMsTUFBTSxtQ0FBbUMsR0FBRyxDQUNqRCxTQUFrQixFQUNSLEVBQUU7SUFDWixJQUFJLENBQUMsU0FBUyxJQUFJLE9BQU8sU0FBUyxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7UUFDNUUsT0FBTyxDQUFDLG1DQUFtQyxDQUFDLENBQUM7SUFDL0MsQ0FBQztJQUNELE1BQU0sTUFBTSxHQUFHLFNBQW9DLENBQUM7SUFDcEQsTUFBTSxNQUFNLEdBQUc7UUFDYixHQUFHLHNDQUFzQyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUM7UUFDOUQsR0FBRyx1Q0FBdUMsQ0FBQyxNQUFNLENBQUMsT0FBTyxDQUFDO0tBQzNELENBQUM7SUFDRixJQUFJLENBQUMsTUFBTSxDQUFDLFlBQVksSUFBSSxPQUFPLE1BQU0sQ0FBQyxZQUFZLEtBQUssUUFBUTtXQUM5RCxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxZQUFZLENBQUM7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUN2RCxNQUFNLFVBQVUsR0FBRyxNQUFNLENBQUMsWUFBdUMsQ0FBQztJQUNsRSxJQUFJLENBQUMsVUFBVSxDQUFDLG9CQUFvQixJQUFJLE9BQU8sVUFBVSxDQUFDLG9CQUFvQixLQUFLLFFBQVE7V0FDdEYsS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsb0JBQW9CLENBQUM7UUFBRSxPQUFPLE1BQU0sQ0FBQztJQUNuRSxNQUFNLFFBQVEsR0FBRyxJQUFJLEdBQUcsQ0FBQyxNQUFNLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxvQkFBb0IsQ0FBQztTQUNwRSxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQXNCLEVBQUUsQ0FBQyxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQUMsQ0FBQyxDQUFDO0lBQzNFLE1BQU0sZUFBZSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztRQUNuRCxDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQzdCLE1BQU0sSUFBSSxPQUFPLE1BQU0sS0FBSyxRQUFRLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQztZQUM1RCxDQUFDLENBQUUsTUFBa0MsQ0FBQyxHQUFHO1lBQ3pDLENBQUMsQ0FBQyxTQUFTLENBQ2QsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBc0IsRUFBRSxDQUFDLE9BQU8sUUFBUSxLQUFLLFFBQVEsQ0FBQztRQUMzRSxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsS0FBSyxNQUFNLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztRQUNsQyxJQUFJLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN0QixNQUFNLENBQUMsSUFBSSxDQUFDLGlDQUFpQyxHQUFHLG1DQUFtQyxDQUFDLENBQUM7UUFDdkYsQ0FBQztJQUNILENBQUM7SUFDRCxPQUFPLE1BQU0sQ0FBQztBQUNoQixDQUFDLENBQUM7QUEwSUYsTUFBTSx1QkFBdUIsR0FBRyxxQ0FBcUMsQ0FBQztBQUV0RSxNQUFNLENBQUMsTUFBTSx1Q0FBdUMsR0FBRyxDQUNyRCxlQUF3QixFQUNkLEVBQUU7SUFDWixJQUFJLGVBQWUsS0FBSyxTQUFTO1FBQUUsT0FBTyxFQUFFLENBQUM7SUFDN0MsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLElBQUksZUFBZSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUNwRSxPQUFPLENBQUMsaUNBQWlDLENBQUMsQ0FBQztJQUM3QyxDQUFDO0lBQ0QsTUFBTSxNQUFNLEdBQWEsRUFBRSxDQUFDO0lBQzVCLE1BQU0sSUFBSSxHQUFhLEVBQUUsQ0FBQztJQUMxQixlQUFlLENBQUMsT0FBTyxDQUFDLENBQUMsY0FBYyxFQUFFLFFBQVEsRUFBRSxFQUFFO1FBQ25ELElBQUksQ0FBQyxjQUFjLElBQUksT0FBTyxjQUFjLEtBQUssUUFBUSxJQUFJLEtBQUssQ0FBQyxPQUFPLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQztZQUMzRixNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ3RELE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsY0FBeUMsQ0FBQztRQUM5RCxNQUFNLFdBQVcsR0FBRyxXQUFXLENBQUMsTUFBTSxLQUFLLElBQUk7WUFDN0MsQ0FBQyxDQUFDLElBQUksR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLGFBQWEsRUFBRSxVQUFVLEVBQUUsUUFBUSxFQUFFLFVBQVUsRUFBRSxVQUFVLENBQUMsQ0FBQztZQUMvRSxDQUFDLENBQUMsSUFBSSxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsYUFBYSxFQUFFLFVBQVUsRUFBRSxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUMsQ0FBQztRQUNuRSxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLG9EQUFvRCxDQUFDLENBQUM7UUFDdkYsQ0FBQztRQUNELE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxNQUFNLEtBQUssSUFBSTtZQUMxQyxDQUFDLENBQUMsc0JBQXNCO1lBQ3hCLENBQUMsQ0FBQyx5QkFBeUIsQ0FBQztRQUM5QixJQUFJLE9BQU8sV0FBVyxDQUFDLEdBQUcsS0FBSyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzNFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU0sS0FBSyxJQUFJO2dCQUNyQyxDQUFDLENBQUMsV0FBVyxRQUFRLHNDQUFzQztnQkFDM0QsQ0FBQyxDQUFDLFdBQVcsUUFBUSw4Q0FBOEMsQ0FBQyxDQUFDO1FBQ3pFLENBQUM7YUFBTSxDQUFDO1lBQ04sSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDN0IsQ0FBQztRQUNELElBQUksT0FBTyxXQUFXLENBQUMsV0FBVyxLQUFLLFFBQVEsSUFBSSxXQUFXLENBQUMsV0FBVyxDQUFDLE1BQU0sR0FBRyxJQUFJLEVBQUUsQ0FBQztZQUN6RixNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSwrQkFBK0IsQ0FBQyxDQUFDO1FBQ2xFLENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxRQUFRLEtBQUssU0FBUyxJQUFJLE9BQU8sV0FBVyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNwRixNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSw0QkFBNEIsQ0FBQyxDQUFDO1FBQy9ELENBQUM7UUFDRCxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssSUFBSSxFQUFFLENBQUM7WUFDaEMsSUFBSSxPQUFPLElBQUksV0FBVztnQkFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSxvQ0FBb0MsQ0FBQyxDQUFDO1lBQ2pHLElBQUksQ0FBQyxDQUFDLFVBQVUsSUFBSSxXQUFXLENBQUMsRUFBRSxDQUFDO2dCQUNqQyxNQUFNLENBQUMsSUFBSSxDQUFDLFdBQVcsUUFBUSx3Q0FBd0MsQ0FBQyxDQUFDO1lBQzNFLENBQUM7aUJBQU0sQ0FBQztnQkFDTixNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsc0JBQXNCLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQztxQkFDeEQsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxXQUFXLFFBQVEsS0FBSyxRQUFRLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDNUQsQ0FBQztZQUNELElBQUksV0FBVyxDQUFDLFFBQVEsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDdkMsTUFBTSxDQUFDLElBQUksQ0FBQyxHQUFHLHdCQUF3QixDQUFDO29CQUN0QyxJQUFJLEVBQUUsV0FBVztvQkFDakIsR0FBSSxXQUFXLENBQUMsUUFBb0M7aUJBQ3JELENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLFdBQVcsUUFBUSxjQUFjLFFBQVEsRUFBRSxDQUFDLENBQUMsQ0FBQztZQUNyRSxDQUFDO1FBQ0gsQ0FBQzthQUFNLENBQUM7WUFDTixJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLFdBQVcsQ0FBQyxNQUFNLEtBQUssS0FBSyxFQUFFLENBQUM7Z0JBQ3JFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLGdDQUFnQyxDQUFDLENBQUM7WUFDbkUsQ0FBQztZQUNELElBQUksVUFBVSxJQUFJLFdBQVc7Z0JBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLFFBQVEsdUNBQXVDLENBQUMsQ0FBQztZQUN2RyxJQUFJLFVBQVUsSUFBSSxXQUFXO2dCQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLHVDQUF1QyxDQUFDLENBQUM7WUFDdkcsSUFBSSxXQUFXLENBQUMsS0FBSyxLQUFLLFNBQVMsSUFBSSxPQUFPLFdBQVcsQ0FBQyxLQUFLLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxRQUFRLHlDQUF5QyxDQUFDLENBQUM7WUFDNUUsQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDLENBQUMsQ0FBQztJQUNILElBQUksSUFBSSxHQUFHLENBQUMsSUFBSSxDQUFDLENBQUMsSUFBSSxLQUFLLElBQUksQ0FBQyxNQUFNO1FBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO0lBQ25GLE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQztBQUVGLE1BQU0sQ0FBQyxNQUFNLDhCQUE4QixHQUFHLEtBQUssRUFDakQsVUFBbUIsRUFDbkIsU0FBaUMsRUFDakMseUJBQXlELEVBQ3RDLEVBQUU7SUFDckIsSUFBSSxDQUFDLFVBQVUsSUFBSSxPQUFPLFVBQVUsS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsRUFBRSxDQUFDO1FBQy9FLE9BQU8sQ0FBQyxtQ0FBbUMsQ0FBQyxDQUFDO0lBQy9DLENBQUM7SUFDRCxNQUFNLE9BQU8sR0FBRyxVQUFxQyxDQUFDO0lBQ3RELE1BQU0sZUFBZSxHQUFHLFNBQVMsSUFBSSxPQUFPLFNBQVMsS0FBSyxRQUFRO1FBQ2hFLENBQUMsQ0FBQyxTQUFTLENBQUMsT0FBTztRQUNuQixDQUFDLENBQUMsU0FBUyxDQUFDO0lBQ2QsTUFBTSxNQUFNLEdBQUcsdUNBQXVDLENBQUMsZUFBZSxDQUFDLENBQUM7SUFDeEUsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsQ0FBQztRQUNqQyxZQUFZO1FBQ1osT0FBTztRQUNQLFNBQVM7UUFDVCxXQUFXO1FBQ1gsYUFBYTtRQUNiLFFBQVE7UUFDUixNQUFNO1FBQ04sZ0JBQWdCO1FBQ2hCLG9CQUFvQjtRQUNwQixtQkFBbUI7UUFDbkIsY0FBYztLQUNmLENBQUMsQ0FBQztJQUNILElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQUMsa0JBQWtCLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUMzRSxNQUFNLENBQUMsSUFBSSxDQUFDLG9EQUFvRCxDQUFDLENBQUM7SUFDcEUsQ0FBQztJQUNELElBQUksT0FBTyxPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVE7V0FDckMsQ0FBQyx1QkFBdUIsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7UUFDdkQsTUFBTSxDQUFDLElBQUksQ0FBQyxzQ0FBc0MsQ0FBQyxDQUFDO0lBQ3RELENBQUM7SUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsT0FBTyxFQUFFLFNBQVMsRUFBRSxXQUFXLEVBQUUsYUFBYSxDQUFVLEVBQUUsQ0FBQztRQUM5RSxJQUFJLE9BQU8sT0FBTyxDQUFDLEtBQUssQ0FBQyxLQUFLLFFBQVEsSUFBSSxDQUFFLE9BQU8sQ0FBQyxLQUFLLENBQVksQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsV0FBVyxLQUFLLG9CQUFvQixDQUFDLENBQUM7UUFDcEQsQ0FBQztJQUNILENBQUM7SUFDRCxNQUFNLGlCQUFpQixHQUFHLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQztJQUNwRCxJQUFJLENBQUMsaUJBQWlCLElBQUksT0FBTyxpQkFBaUIsS0FBSyxRQUFRO1dBQzFELEtBQUssQ0FBQyxPQUFPLENBQUMsaUJBQWlCLENBQUM7V0FDaEMsTUFBTSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUNoRSxDQUFDLHlCQUF5QixDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxPQUFPLFFBQVEsS0FBSyxRQUFRLENBQ3hFLENBQUMsRUFBRSxDQUFDO1FBQ0wsTUFBTSxDQUFDLElBQUksQ0FBQywwREFBMEQsQ0FBQyxDQUFDO0lBQzFFLENBQUM7SUFDRCxNQUFNLFlBQVksR0FBRyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ3JGLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxZQUFZLENBQUMsSUFBSSxZQUFZLENBQUMsTUFBTSxHQUFHLEdBQUcsRUFBRSxDQUFDO1FBQ3RFLE1BQU0sQ0FBQyxJQUFJLENBQUMsOENBQThDLENBQUMsQ0FBQztJQUM5RCxDQUFDO0lBQ0QsTUFBTSxTQUFTLEdBQWEsRUFBRSxDQUFDO0lBQy9CLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxFQUFtQyxDQUFDO0lBQy9ELE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDLElBQUksZUFBZSxDQUFDLE1BQU0sSUFBSSxHQUFHO1FBQ2xGLENBQUMsQ0FBQyxlQUFlLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUErQyxFQUFFLENBQUMsQ0FDaEYsdUNBQXVDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDLE1BQU0sS0FBSyxDQUFDLENBQ2pFLENBQUM7UUFDSixDQUFDLENBQUMsRUFBRSxDQUFDO0lBQ1AsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLEdBQUcsQ0FBQyxZQUFZO1NBQzVDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBcUQsRUFBRSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEtBQUssSUFBSSxDQUFDO1NBQ2pHLEdBQUcsQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsR0FBRyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUNoRCxNQUFNLGtCQUFrQixHQUFHLElBQUksR0FBRyxDQUFDLFlBQVk7U0FDNUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFxRCxFQUFFLENBQUMsUUFBUSxDQUFDLE1BQU0sS0FBSyxJQUFJLENBQUM7U0FDakcsR0FBRyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxHQUFHLEVBQUUsUUFBUSxDQUFDLENBQUMsQ0FBQyxDQUFDO0lBQ2hELEtBQUssTUFBTSxDQUFDLFFBQVEsRUFBRSxRQUFRLENBQUMsSUFBSSxZQUFZLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztRQUMxRCxJQUFJLENBQUMsUUFBUSxJQUFJLE9BQU8sUUFBUSxLQUFLLFFBQVEsSUFBSSxLQUFLLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxFQUFFLENBQUM7WUFDekUsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsUUFBUSxxQkFBcUIsQ0FBQyxDQUFDO1lBQ25FLFNBQVM7UUFDWCxDQUFDO1FBQ0QsTUFBTSxLQUFLLEdBQUcsUUFBbUMsQ0FBQztRQUNsRCxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxLQUFLLEVBQUUsWUFBWSxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ3hGLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLFFBQVEsNkJBQTZCLENBQUMsQ0FBQztRQUM3RSxDQUFDO1FBQ0QsSUFBSSxPQUFPLEtBQUssQ0FBQyxHQUFHLEtBQUssUUFBUSxJQUFJLENBQUMsc0JBQXNCLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1lBQzdFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLFFBQVEseUJBQXlCLENBQUMsQ0FBQztZQUN2RSxTQUFTO1FBQ1gsQ0FBQztRQUNELFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQzFCLFdBQVcsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsQ0FBQztRQUNsQyxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RELE1BQU0sZUFBZSxHQUFHLFdBQVc7ZUFDOUIsT0FBTyxPQUFPLENBQUMsVUFBVSxLQUFLLFFBQVE7ZUFDdEMsdUJBQXVCLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUM7ZUFDaEQsT0FBTyxPQUFPLENBQUMsS0FBSyxLQUFLLFFBQVE7ZUFDakMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUM7ZUFDN0IsT0FBTyxPQUFPLENBQUMsT0FBTyxLQUFLLFFBQVE7ZUFDbkMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxPQUFPLENBQUMsSUFBSSxFQUFFLENBQUM7ZUFDL0IsT0FBTyxPQUFPLENBQUMsU0FBUyxLQUFLLFFBQVE7ZUFDckMsT0FBTyxDQUFDLE9BQU8sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUN2QyxNQUFNLGVBQWUsR0FBRyxlQUFlO1lBQ3JDLENBQUMsQ0FBQywwQ0FBMEMsQ0FBQztnQkFDekMsVUFBVSxFQUFFLE9BQU8sQ0FBQyxVQUFvQjtnQkFDeEMsS0FBSyxFQUFFLE9BQU8sQ0FBQyxLQUFlO2dCQUM5QixVQUFVLEVBQUUsT0FBTyxDQUFDLE9BQWlCO2dCQUNyQyxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQW1CO2dCQUN0QyxHQUFHLEVBQUUsS0FBSyxDQUFDLEdBQUc7Z0JBQ2QsUUFBUSxFQUFFLFdBQVcsQ0FBQyxRQUFRO2dCQUM5QixVQUFVLEVBQUUsV0FBVyxDQUFDLFFBQVE7YUFDakMsQ0FBQztZQUNKLENBQUMsQ0FBQyxJQUFJLFVBQVUsRUFBRSxDQUFDO1FBQ3JCLE1BQU0sQ0FBQyxJQUFJLENBQUMsR0FBRyxDQUFDLE1BQU0sb0NBQW9DLENBQ3hELEtBQUssQ0FBQyxVQUFVLEVBQ2hCLHlCQUF5QixFQUN6QixlQUFlLENBQ2hCLENBQUM7YUFDQyxHQUFHLENBQUMsQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLHdCQUF3QixRQUFRLEtBQUssUUFBUSxFQUFFLENBQUMsQ0FBQyxDQUFDO0lBQ3pFLENBQUM7SUFDRCxJQUFJLElBQUksR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDLElBQUksS0FBSyxTQUFTLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDakQsTUFBTSxDQUFDLElBQUksQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO0lBQzFELENBQUM7SUFDRCxLQUFLLE1BQU0sR0FBRyxJQUFJLE1BQU0sQ0FBQyxJQUFJLENBQUMsQ0FBQyxpQkFBaUIsSUFBSSxFQUFFLENBQTRCLENBQUMsRUFBRSxDQUFDO1FBQ3BGLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDO1lBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx1QkFBdUIsR0FBRywwQkFBMEIsQ0FBQyxDQUFDO1FBQ3BHLElBQUksV0FBVyxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUM7WUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLGdCQUFnQixHQUFHLDRCQUE0QixDQUFDLENBQUM7SUFDekYsQ0FBQztJQUNELEtBQUssTUFBTSxDQUFDLEdBQUcsRUFBRSxLQUFLLENBQUMsSUFBSSxXQUFXLEVBQUUsQ0FBQztRQUN2QyxNQUFNLFdBQVcsR0FBRyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDaEQsSUFBSSxDQUFDLFdBQVcsRUFBRSxDQUFDO1lBQ2pCLE1BQU0sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLEdBQUcsMEJBQTBCLENBQUMsQ0FBQztZQUNsRSxTQUFTO1FBQ1gsQ0FBQztRQUNELE1BQU0sVUFBVSxHQUFHLEtBQUssQ0FBQyxVQUErQixDQUFDO1FBQ3pELElBQUksVUFBVSxFQUFFLElBQUksS0FBSyxXQUFXO2VBQy9CLENBQUMsQ0FBQyxXQUFXLENBQUMsUUFBUTttQkFDcEIsV0FBVyxDQUFDLFFBQVEsQ0FBQyxRQUFRLEtBQUssVUFBVSxDQUFDLFFBQVE7bUJBQ3JELFdBQVcsQ0FBQyxRQUFRLENBQUMsS0FBSyxLQUFLLFVBQVUsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3hELE1BQU0sQ0FBQyxJQUFJLENBQUMsdUJBQXVCLEdBQUcsNkNBQTZDLENBQUMsQ0FBQztRQUN2RixDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxXQUFXLElBQUksa0JBQWtCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUN0RCxJQUFJLFdBQVcsQ0FBQyxRQUFRO2VBQ25CLFdBQVcsQ0FBQyxLQUFLLEtBQUssU0FBUztlQUMvQixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxpQkFBaUIsSUFBSSxFQUFFLENBQVcsRUFBRSxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxRSxNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxXQUFXLENBQUMsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELEtBQUssTUFBTSxXQUFXLElBQUksa0JBQWtCLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztRQUN0RCxJQUFJLFdBQVcsQ0FBQyxRQUFRLElBQUksQ0FBQyxXQUFXLENBQUMsUUFBUSxJQUFJLENBQUMsV0FBVyxDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUN2RixNQUFNLENBQUMsSUFBSSxDQUFDLGdDQUFnQyxXQUFXLENBQUMsR0FBRyxjQUFjLENBQUMsQ0FBQztRQUM3RSxDQUFDO0lBQ0gsQ0FBQztJQUNELE9BQU8sTUFBTSxDQUFDO0FBQ2hCLENBQUMsQ0FBQyJ9