@super-protocol/pki-attestation-engine 0.0.0-nvidia-local-verifier

package/dist/attestationType.d.ts

@@ -0,0 +1,4 @@
+import { ChallengeType } from '@super-protocol/pki-common';
+export type DetectAttestationType = ChallengeType.TDX | ChallengeType.TDXGOOGLE | ChallengeType.TDXAZURE | ChallengeType.SEVSNP | ChallengeType.SEVSNPAZURE | ChallengeType.Untrusted;
+export declare const isGoogleCloudVm: () => Promise<boolean>;
+export declare const detectAttestationType: () => Promise<DetectAttestationType>;

package/dist/attestationType.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAttestationType = exports.isGoogleCloudVm = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const fs_1 = require("fs");
+const azure_1 = require("./azure");
+const GCP_METADATA_URL = 'http://169.254.169.254/computeMetadata/v1/instance/id';
+const GCP_METADATA_TIMEOUT_MS = 500;
+const isGoogleCloudVm = async () => {
+    try {
+        const response = await fetch(GCP_METADATA_URL, {
+            headers: {
+                'Metadata-Flavor': 'Google',
+            },
+            signal: AbortSignal.timeout(GCP_METADATA_TIMEOUT_MS),
+        });
+        if (!response.ok) {
+            return false;
+        }
+        const instanceId = await response.text();
+        return instanceId.trim().length > 0;
+    }
+    catch {
+        return false;
+    }
+};
+exports.isGoogleCloudVm = isGoogleCloudVm;
+const detectAttestationType = async () => {
+    try {
+        // Must run before the device checks: on Azure the Hyper-V
+        // isolation type takes precedence over /dev/sev-guest.
+        const azureType = (0, azure_1.detectAzureAttestationType)();
+        if (azureType) {
+            return azureType;
+        }
+        const tdxPath = '/dev/tdx_guest';
+        const sevPath = '/dev/sev-guest';
+        if ((0, fs_1.existsSync)(tdxPath)) {
+            const stats = (0, fs_1.statSync)(tdxPath);
+            if (stats.isCharacterDevice()) {
+                return (await (0, exports.isGoogleCloudVm)())
+                    ? pki_common_1.ChallengeType.TDXGOOGLE
+                    : pki_common_1.ChallengeType.TDX;
+            }
+        }
+        if ((0, fs_1.existsSync)(sevPath)) {
+            const stats = (0, fs_1.statSync)(sevPath);
+            if (stats.isCharacterDevice()) {
+                return (await (0, exports.isGoogleCloudVm)())
+                    ? pki_common_1.ChallengeType.Untrusted
+                    : pki_common_1.ChallengeType.SEVSNP;
+            }
+        }
+    }
+    catch {
+        // If we can't check devices, fall back to untrusted
+    }
+    return pki_common_1.ChallengeType.Untrusted;
+};
+exports.detectAttestationType = detectAttestationType;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXR0ZXN0YXRpb25UeXBlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vc3JjL2F0dGVzdGF0aW9uVHlwZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiOzs7QUFBQSwyREFBMkQ7QUFDM0QsMkJBQTBDO0FBQzFDLG1DQUFxRDtBQVVyRCxNQUFNLGdCQUFnQixHQUNsQix1REFBdUQsQ0FBQztBQUM1RCxNQUFNLHVCQUF1QixHQUFHLEdBQUcsQ0FBQztBQUU3QixNQUFNLGVBQWUsR0FBRyxLQUFLLElBQXNCLEVBQUU7SUFDeEQsSUFBSSxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsTUFBTSxLQUFLLENBQUMsZ0JBQWdCLEVBQUU7WUFDM0MsT0FBTyxFQUFFO2dCQUNMLGlCQUFpQixFQUFFLFFBQVE7YUFDOUI7WUFDRCxNQUFNLEVBQUUsV0FBVyxDQUFDLE9BQU8sQ0FBQyx1QkFBdUIsQ0FBQztTQUN2RCxDQUFDLENBQUM7UUFFSCxJQUFJLENBQUMsUUFBUSxDQUFDLEVBQUUsRUFBRSxDQUFDO1lBQ2YsT0FBTyxLQUFLLENBQUM7UUFDakIsQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFHLE1BQU0sUUFBUSxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ3pDLE9BQU8sVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLE1BQU0sR0FBRyxDQUFDLENBQUM7SUFDeEMsQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDLENBQUM7QUFsQlcsUUFBQSxlQUFlLG1CQWtCMUI7QUFFSyxNQUFNLHFCQUFxQixHQUM5QixLQUFLLElBQW9DLEVBQUU7SUFDdkMsSUFBSSxDQUFDO1FBQ0QsMERBQTBEO1FBQzFELHVEQUF1RDtRQUN2RCxNQUFNLFNBQVMsR0FBRyxJQUFBLGtDQUEwQixHQUFFLENBQUM7UUFDL0MsSUFBSSxTQUFTLEVBQUUsQ0FBQztZQUNaLE9BQU8sU0FBUyxDQUFDO1FBQ3JCLENBQUM7UUFFRCxNQUFNLE9BQU8sR0FBRyxnQkFBZ0IsQ0FBQztRQUNqQyxNQUFNLE9BQU8sR0FBRyxnQkFBZ0IsQ0FBQztRQUVqQyxJQUFJLElBQUEsZUFBVSxFQUFDLE9BQU8sQ0FBQyxFQUFFLENBQUM7WUFDdEIsTUFBTSxLQUFLLEdBQUcsSUFBQSxhQUFRLEVBQUMsT0FBTyxDQUFDLENBQUM7WUFDaEMsSUFBSSxLQUFLLENBQUMsaUJBQWlCLEVBQUUsRUFBRSxDQUFDO2dCQUM1QixPQUFPLENBQUMsTUFBTSxJQUFBLHVCQUFlLEdBQUUsQ0FBQztvQkFDNUIsQ0FBQyxDQUFDLDBCQUFhLENBQUMsU0FBUztvQkFDekIsQ0FBQyxDQUFDLDBCQUFhLENBQUMsR0FBRyxDQUFDO1lBQzVCLENBQUM7UUFDTCxDQUFDO1FBRUQsSUFBSSxJQUFBLGVBQVUsRUFBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQ3RCLE1BQU0sS0FBSyxHQUFHLElBQUEsYUFBUSxFQUFDLE9BQU8sQ0FBQyxDQUFDO1lBQ2hDLElBQUksS0FBSyxDQUFDLGlCQUFpQixFQUFFLEVBQUUsQ0FBQztnQkFDNUIsT0FBTyxDQUFDLE1BQU0sSUFBQSx1QkFBZSxHQUFFLENBQUM7b0JBQzVCLENBQUMsQ0FBQywwQkFBYSxDQUFDLFNBQVM7b0JBQ3pCLENBQUMsQ0FBQywwQkFBYSxDQUFDLE1BQU0sQ0FBQztZQUMvQixDQUFDO1FBQ0wsQ0FBQztJQUNMLENBQUM7SUFBQyxNQUFNLENBQUM7UUFDTCxvREFBb0Q7SUFDeEQsQ0FBQztJQUVELE9BQU8sMEJBQWEsQ0FBQyxTQUFTLENBQUM7QUFDbkMsQ0FBQyxDQUFDO0FBbkNPLFFBQUEscUJBQXFCLHlCQW1DNUIifQ==

package/dist/azure.d.ts

@@ -0,0 +1,40 @@
+import { ChallengeType } from '@super-protocol/pki-common';
+export type AzureAttestationType = ChallengeType.TDXAZURE | ChallengeType.SEVSNPAZURE;
+export declare enum HvIsolationType {
+    None = 0,
+    VBS = 1,
+    SNP = 2,
+    TDX = 3
+}
+export type CpuidRegisters = [
+    eax: number,
+    ebx: number,
+    ecx: number,
+    edx: number
+];
+/**
+ * Returns the Hyper-V isolation type from the interface leaf (0x40000000)
+ * and the isolation config leaf (0x4000000C), or undefined when this is not
+ * a Hyper-V guest.
+ */
+export declare const parseHvIsolationType: (interfaceRegs: CpuidRegisters | undefined, isolationRegs: CpuidRegisters | undefined) => number | undefined;
+/**
+ * Azure confidential VMs run behind a paravisor, so the guest is given none
+ * of the usual TEE interfaces: no /dev/tdx_guest, no TSM provider, no
+ * tdx_guest CPUID flag, no TDEL ACPI table, and CPUID leaf 0x21 reads back as
+ * zeroes. The instance metadata service does not name the TEE either. What
+ * the hypervisor does report is its isolation type, which is exactly what the
+ * kernel itself uses to decide it is running under TDX or SEV-SNP.
+ */
+export declare const getHvIsolationType: () => number | undefined;
+export declare const parseIsAzureChassisAssetTag: (tag: string) => boolean;
+export declare const isAzureVm: () => boolean;
+/**
+ * Azure confidential VM and the TEE backing it, detected offline: no
+ * network, no timeouts.
+ *
+ * NOT verified on a live SEV-SNP guest: the isolation type is read exactly
+ * like the TDX one, but only the TDX value has been confirmed against real
+ * hardware so far.
+ */
+export declare const detectAzureAttestationType: () => AzureAttestationType | undefined;

package/dist/azure.js

@@ -0,0 +1,128 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAzureAttestationType = exports.isAzureVm = exports.parseIsAzureChassisAssetTag = exports.getHvIsolationType = exports.parseHvIsolationType = exports.HvIsolationType = void 0;
+const pki_common_1 = require("@super-protocol/pki-common");
+const fs_1 = require("fs");
+// Azure stamps every VM with this chassis asset tag, so the platform can be
+// identified offline, without the instance metadata service.
+const DMI_CHASSIS_ASSET_TAG = '/sys/class/dmi/id/chassis_asset_tag';
+const AZURE_CHASSIS_ASSET_TAG = '7783-7084-3265-9085-8269-3286-77';
+// Hyper-V reports the TEE backing an isolated guest through its own CPUID
+// leaves. This is what the kernel reads (hv_get_isolation_type()), and on
+// Azure it is the only precise source: see getHvIsolationType() below.
+const CPUID_DEVICE = '/dev/cpu/0/cpuid';
+const HV_CPUID_INTERFACE = 0x40000000;
+const HV_CPUID_ISOLATION_CONFIG = 0x4000000c;
+const HV_SIGNATURE = 'Microsoft Hv';
+const HV_ISOLATION_TYPE_MASK = 0xf;
+var HvIsolationType;
+(function (HvIsolationType) {
+    HvIsolationType[HvIsolationType["None"] = 0] = "None";
+    HvIsolationType[HvIsolationType["VBS"] = 1] = "VBS";
+    HvIsolationType[HvIsolationType["SNP"] = 2] = "SNP";
+    HvIsolationType[HvIsolationType["TDX"] = 3] = "TDX";
+})(HvIsolationType || (exports.HvIsolationType = HvIsolationType = {}));
+/** Read one CPUID leaf through /dev/cpu/0/cpuid (needs CONFIG_X86_CPUID). */
+const readCpuid = (leaf, subleaf = 0) => {
+    let fd;
+    try {
+        fd = (0, fs_1.openSync)(CPUID_DEVICE, 'r');
+        const buffer = Buffer.alloc(16);
+        const position = (BigInt(subleaf) << 32n) | BigInt(leaf);
+        if ((0, fs_1.readSync)(fd, buffer, 0, 16, position) !== 16) {
+            return undefined;
+        }
+        return [
+            buffer.readUInt32LE(0),
+            buffer.readUInt32LE(4),
+            buffer.readUInt32LE(8),
+            buffer.readUInt32LE(12),
+        ];
+    }
+    catch {
+        return undefined;
+    }
+    finally {
+        if (fd !== undefined) {
+            try {
+                (0, fs_1.closeSync)(fd);
+            }
+            catch {
+                // ignore
+            }
+        }
+    }
+};
+/**
+ * Returns the Hyper-V isolation type from the interface leaf (0x40000000)
+ * and the isolation config leaf (0x4000000C), or undefined when this is not
+ * a Hyper-V guest.
+ */
+const parseHvIsolationType = (interfaceRegs, isolationRegs) => {
+    if (!interfaceRegs) {
+        return undefined;
+    }
+    const [maxLeaf, ebx, ecx, edx] = interfaceRegs;
+    const signature = Buffer.alloc(12);
+    signature.writeUInt32LE(ebx, 0);
+    signature.writeUInt32LE(ecx, 4);
+    signature.writeUInt32LE(edx, 8);
+    if (signature.toString('latin1') !== HV_SIGNATURE) {
+        return undefined;
+    }
+    if (maxLeaf < HV_CPUID_ISOLATION_CONFIG || !isolationRegs) {
+        return undefined;
+    }
+    return isolationRegs[1] & HV_ISOLATION_TYPE_MASK;
+};
+exports.parseHvIsolationType = parseHvIsolationType;
+/**
+ * Azure confidential VMs run behind a paravisor, so the guest is given none
+ * of the usual TEE interfaces: no /dev/tdx_guest, no TSM provider, no
+ * tdx_guest CPUID flag, no TDEL ACPI table, and CPUID leaf 0x21 reads back as
+ * zeroes. The instance metadata service does not name the TEE either. What
+ * the hypervisor does report is its isolation type, which is exactly what the
+ * kernel itself uses to decide it is running under TDX or SEV-SNP.
+ */
+const getHvIsolationType = () => {
+    const interfaceRegs = readCpuid(HV_CPUID_INTERFACE);
+    if (!interfaceRegs) {
+        return undefined;
+    }
+    return (0, exports.parseHvIsolationType)(interfaceRegs, readCpuid(HV_CPUID_ISOLATION_CONFIG));
+};
+exports.getHvIsolationType = getHvIsolationType;
+const parseIsAzureChassisAssetTag = (tag) => tag.replace(/\0/g, '').trim() === AZURE_CHASSIS_ASSET_TAG;
+exports.parseIsAzureChassisAssetTag = parseIsAzureChassisAssetTag;
+const isAzureVm = () => {
+    try {
+        return (0, exports.parseIsAzureChassisAssetTag)((0, fs_1.readFileSync)(DMI_CHASSIS_ASSET_TAG, 'latin1'));
+    }
+    catch {
+        return false;
+    }
+};
+exports.isAzureVm = isAzureVm;
+/**
+ * Azure confidential VM and the TEE backing it, detected offline: no
+ * network, no timeouts.
+ *
+ * NOT verified on a live SEV-SNP guest: the isolation type is read exactly
+ * like the TDX one, but only the TDX value has been confirmed against real
+ * hardware so far.
+ */
+const detectAzureAttestationType = () => {
+    if (!(0, exports.isAzureVm)()) {
+        return undefined;
+    }
+    switch ((0, exports.getHvIsolationType)()) {
+        case HvIsolationType.TDX:
+            return pki_common_1.ChallengeType.TDXAZURE;
+        case HvIsolationType.SNP:
+            return pki_common_1.ChallengeType.SEVSNPAZURE;
+        default:
+            return undefined;
+    }
+};
+exports.detectAzureAttestationType = detectAzureAttestationType;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYXp1cmUuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvYXp1cmUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsMkRBQTJEO0FBQzNELDJCQUFpRTtBQU1qRSw0RUFBNEU7QUFDNUUsNkRBQTZEO0FBQzdELE1BQU0scUJBQXFCLEdBQUcscUNBQXFDLENBQUM7QUFDcEUsTUFBTSx1QkFBdUIsR0FBRyxrQ0FBa0MsQ0FBQztBQUVuRSwwRUFBMEU7QUFDMUUsMEVBQTBFO0FBQzFFLHVFQUF1RTtBQUN2RSxNQUFNLFlBQVksR0FBRyxrQkFBa0IsQ0FBQztBQUN4QyxNQUFNLGtCQUFrQixHQUFHLFVBQVUsQ0FBQztBQUN0QyxNQUFNLHlCQUF5QixHQUFHLFVBQVUsQ0FBQztBQUM3QyxNQUFNLFlBQVksR0FBRyxjQUFjLENBQUM7QUFDcEMsTUFBTSxzQkFBc0IsR0FBRyxHQUFHLENBQUM7QUFFbkMsSUFBWSxlQUtYO0FBTEQsV0FBWSxlQUFlO0lBQ3ZCLHFEQUFRLENBQUE7SUFDUixtREFBTyxDQUFBO0lBQ1AsbURBQU8sQ0FBQTtJQUNQLG1EQUFPLENBQUE7QUFDWCxDQUFDLEVBTFcsZUFBZSwrQkFBZixlQUFlLFFBSzFCO0FBU0QsNkVBQTZFO0FBQzdFLE1BQU0sU0FBUyxHQUFHLENBQUMsSUFBWSxFQUFFLE9BQU8sR0FBRyxDQUFDLEVBQThCLEVBQUU7SUFDeEUsSUFBSSxFQUFzQixDQUFDO0lBQzNCLElBQUksQ0FBQztRQUNELEVBQUUsR0FBRyxJQUFBLGFBQVEsRUFBQyxZQUFZLEVBQUUsR0FBRyxDQUFDLENBQUM7UUFDakMsTUFBTSxNQUFNLEdBQUcsTUFBTSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztRQUNoQyxNQUFNLFFBQVEsR0FBRyxDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxHQUFHLENBQUMsR0FBRyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDekQsSUFBSSxJQUFBLGFBQVEsRUFBQyxFQUFFLEVBQUUsTUFBTSxFQUFFLENBQUMsRUFBRSxFQUFFLEVBQUUsUUFBUSxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUM7WUFDL0MsT0FBTyxTQUFTLENBQUM7UUFDckIsQ0FBQztRQUNELE9BQU87WUFDSCxNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztZQUN0QixNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztZQUN0QixNQUFNLENBQUMsWUFBWSxDQUFDLENBQUMsQ0FBQztZQUN0QixNQUFNLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztTQUMxQixDQUFDO0lBQ04sQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7WUFBUyxDQUFDO1FBQ1AsSUFBSSxFQUFFLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDbkIsSUFBSSxDQUFDO2dCQUNELElBQUEsY0FBUyxFQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ2xCLENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ0wsU0FBUztZQUNiLENBQUM7UUFDTCxDQUFDO0lBQ0wsQ0FBQztBQUNMLENBQUMsQ0FBQztBQUVGOzs7O0dBSUc7QUFDSSxNQUFNLG9CQUFvQixHQUFHLENBQ2hDLGFBQXlDLEVBQ3pDLGFBQXlDLEVBQ3ZCLEVBQUU7SUFDcEIsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ2pCLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxNQUFNLENBQUMsT0FBTyxFQUFFLEdBQUcsRUFBRSxHQUFHLEVBQUUsR0FBRyxDQUFDLEdBQUcsYUFBYSxDQUFDO0lBQy9DLE1BQU0sU0FBUyxHQUFHLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7SUFDbkMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDaEMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDaEMsU0FBUyxDQUFDLGFBQWEsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxDQUFDLENBQUM7SUFDaEMsSUFBSSxTQUFTLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxLQUFLLFlBQVksRUFBRSxDQUFDO1FBQ2hELE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxJQUFJLE9BQU8sR0FBRyx5QkFBeUIsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3hELE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxPQUFPLGFBQWEsQ0FBQyxDQUFDLENBQUMsR0FBRyxzQkFBc0IsQ0FBQztBQUNyRCxDQUFDLENBQUM7QUFuQlcsUUFBQSxvQkFBb0Isd0JBbUIvQjtBQUVGOzs7Ozs7O0dBT0c7QUFDSSxNQUFNLGtCQUFrQixHQUFHLEdBQXVCLEVBQUU7SUFDdkQsTUFBTSxhQUFhLEdBQUcsU0FBUyxDQUFDLGtCQUFrQixDQUFDLENBQUM7SUFDcEQsSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ2pCLE9BQU8sU0FBUyxDQUFDO0lBQ3JCLENBQUM7SUFDRCxPQUFPLElBQUEsNEJBQW9CLEVBQ3ZCLGFBQWEsRUFDYixTQUFTLENBQUMseUJBQXlCLENBQUMsQ0FDdkMsQ0FBQztBQUNOLENBQUMsQ0FBQztBQVRXLFFBQUEsa0JBQWtCLHNCQVM3QjtBQUVLLE1BQU0sMkJBQTJCLEdBQUcsQ0FBQyxHQUFXLEVBQVcsRUFBRSxDQUNoRSxHQUFHLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyx1QkFBdUIsQ0FBQztBQURqRCxRQUFBLDJCQUEyQiwrQkFDc0I7QUFFdkQsTUFBTSxTQUFTLEdBQUcsR0FBWSxFQUFFO0lBQ25DLElBQUksQ0FBQztRQUNELE9BQU8sSUFBQSxtQ0FBMkIsRUFDOUIsSUFBQSxpQkFBWSxFQUFDLHFCQUFxQixFQUFFLFFBQVEsQ0FBQyxDQUNoRCxDQUFDO0lBQ04sQ0FBQztJQUFDLE1BQU0sQ0FBQztRQUNMLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7QUFDTCxDQUFDLENBQUM7QUFSVyxRQUFBLFNBQVMsYUFRcEI7QUFFRjs7Ozs7OztHQU9HO0FBQ0ksTUFBTSwwQkFBMEIsR0FBRyxHQUUxQixFQUFFO0lBQ2QsSUFBSSxDQUFDLElBQUEsaUJBQVMsR0FBRSxFQUFFLENBQUM7UUFDZixPQUFPLFNBQVMsQ0FBQztJQUNyQixDQUFDO0lBRUQsUUFBUSxJQUFBLDBCQUFrQixHQUFFLEVBQUUsQ0FBQztRQUMzQixLQUFLLGVBQWUsQ0FBQyxHQUFHO1lBQ3BCLE9BQU8sMEJBQWEsQ0FBQyxRQUFRLENBQUM7UUFDbEMsS0FBSyxlQUFlLENBQUMsR0FBRztZQUNwQixPQUFPLDBCQUFhLENBQUMsV0FBVyxDQUFDO1FBQ3JDO1lBQ0ksT0FBTyxTQUFTLENBQUM7SUFDekIsQ0FBQztBQUNMLENBQUMsQ0FBQztBQWZXLFFBQUEsMEJBQTBCLDhCQWVyQyJ9

package/dist/certificateGenerator.d.ts

@@ -0,0 +1,34 @@
+import { CustomExtension } from '@super-protocol/sdk-js';
+import { PkiCertParams, CertificateType, CertificateChallengeInfo, Challenge, NetworkType, PKISslCertificate } from '@super-protocol/pki-common';
+export declare const generateRootCertificate: (params: {
+    domains: string[];
+    privateKeyPem: string;
+    publicKeyPem: string;
+    challenge: Challenge;
+    certParams: PkiCertParams;
+    networkType?: NetworkType;
+}) => Promise<string>;
+type GenerateCertificateParams = {
+    certType: CertificateType;
+    domains: string[];
+    caBundle: string;
+    signingCertPem: string;
+    signingPrivateKeyPem: string;
+    certParams: PkiCertParams;
+    publicKeyPem: string;
+    ocspSigning: boolean;
+    validated?: boolean;
+    commonName?: string;
+    challengeInfo?: CertificateChallengeInfo;
+    clientExtensionAttrs?: CustomExtension[];
+    vmCertificatePem?: string;
+};
+export declare const generateSubrootCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
+export declare const generateEndEntityCertificate: (params: GenerateCertificateParams) => Promise<PKISslCertificate>;
+export declare const getParamsFromCSR: (csrPem: string) => Promise<{
+    commonName: string | undefined;
+    publicKeyPem: string;
+    clientDomains: string[];
+    clientExtensionAttrs: CustomExtension[];
+}>;
+export {};

package/dist/certificateGenerator.js

@@ -0,0 +1,347 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getParamsFromCSR = exports.generateEndEntityCertificate = exports.generateSubrootCertificate = exports.generateRootCertificate = void 0;
+const sdk_js_1 = require("@super-protocol/sdk-js");
+const sp_nvtrust_wrapper_1 = require("@super-protocol/sp-nvtrust-wrapper");
+const net_1 = require("net");
+const pki_common_1 = require("@super-protocol/pki-common");
+const MIN_CERT_LIFETIME_DAYS = 1;
+const MAX_CERT_LIFETIME_DAYS = 18250;
+const DNS_LABEL_REGEX = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i;
+const isValidDomainName = (value) => {
+    const trimmedValue = value.trim();
+    if (!trimmedValue || trimmedValue.length > 253) {
+        return false;
+    }
+    const isWildcard = trimmedValue.startsWith('*.');
+    const hostname = isWildcard ? trimmedValue.slice(2) : trimmedValue;
+    if (!isWildcard && hostname.toLowerCase() === 'localhost') {
+        return true;
+    }
+    if (!hostname || hostname.endsWith('.') || !hostname.includes('.')) {
+        return false;
+    }
+    const labels = hostname.split('.');
+    if (labels.some((label) => !DNS_LABEL_REGEX.test(label))) {
+        return false;
+    }
+    return !isWildcard || labels.length > 1;
+};
+const isValidDomainOrIp = (value) => {
+    const trimmedValue = value.trim();
+    return (0, net_1.isIP)(trimmedValue) !== 0 || isValidDomainName(trimmedValue);
+};
+const filterValidDomainOrIpList = (values) => values
+    .map((value) => value.trim())
+    .filter((value) => value && isValidDomainOrIp(value));
+const addDaysUtc = (base, days) => {
+    const next = new Date(base);
+    next.setUTCDate(next.getUTCDate() + days);
+    return next;
+};
+const resolveNotAfter = (certParams) => {
+    const { lifetimeDays } = certParams;
+    if (!Number.isInteger(lifetimeDays) ||
+        lifetimeDays < MIN_CERT_LIFETIME_DAYS ||
+        lifetimeDays > MAX_CERT_LIFETIME_DAYS) {
+        throw new Error(`certParams.lifetimeDays must be an integer between ${MIN_CERT_LIFETIME_DAYS} and ${MAX_CERT_LIFETIME_DAYS}`);
+    }
+    return addDaysUtc(new Date(), lifetimeDays);
+};
+const buildPrincipal = (certParams) => ({
+    commonName: certParams.commonName,
+    country: certParams.countryName,
+    stateName: certParams.stateName,
+    localityName: certParams.localityName,
+    organization: certParams.organizationName,
+    organizationalUnit: certParams.organizationUnitName,
+});
+const getAttestationPayloadBase64FromChallenge = (challenge) => {
+    switch (challenge.type) {
+        case pki_common_1.ChallengeType.TDX:
+        case pki_common_1.ChallengeType.TDXGOOGLE:
+        case pki_common_1.ChallengeType.TDXAZURE:
+        case pki_common_1.ChallengeType.SEVSNP:
+        case pki_common_1.ChallengeType.SEVSNPAZURE:
+            return challenge.evidenceBase64;
+        default:
+            return;
+    }
+};
+const generateRootCertificate = async (params) => {
+    const principal = buildPrincipal(params.certParams);
+    const notAfter = resolveNotAfter(params.certParams);
+    const customExtensions = [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE,
+            value: Buffer.from(params.challenge.type, 'ascii'),
+        },
+    ];
+    if (params.networkType) {
+        customExtensions.push({
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_NETWORK_TYPE,
+            value: Buffer.from(params.networkType, 'ascii'),
+        });
+    }
+    const attestationPayloadBase64 = getAttestationPayloadBase64FromChallenge(params.challenge);
+    if (attestationPayloadBase64) {
+        customExtensions.push({
+            oid: pki_common_1.OID_TEE_EVIDENCE,
+            value: Buffer.from(attestationPayloadBase64, 'base64'),
+        });
+    }
+    const generateCertParams = {
+        privateKey: params.privateKeyPem,
+        publicKey: params.publicKeyPem,
+        subject: principal,
+        issuer: principal,
+        notAfter,
+        dnsNames: params.domains,
+        ca: true,
+        customExtensions,
+    };
+    return sdk_js_1.CertificateGenerator.generateCert(generateCertParams);
+};
+exports.generateRootCertificate = generateRootCertificate;
+const SYSTEM_MANAGED_EXTENSION_OIDS = [
+    pki_common_1.OID_TEE_EVIDENCE,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_ID,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED,
+    pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+    pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU_INTERCONNECT,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_SUBTYPE,
+    pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID,
+];
+const filterClientExtensions = (extensions = []) => extensions.filter((ext) => !SYSTEM_MANAGED_EXTENSION_OIDS.some((oid) => ext.oid.startsWith(oid)));
+const buildNvidiaExtensions = (challengeInfo) => {
+    const { challenge, nvidiaVerification } = challengeInfo;
+    const hasNvidia = (0, pki_common_1.hasChallengeNvidiaToken)(challenge) ||
+        ('nvidiaEvidence' in challenge &&
+            Boolean(challenge.nvidiaEvidence));
+    if (!hasNvidia) {
+        return [];
+    }
+    if (!nvidiaVerification) {
+        throw new Error('NVIDIA certificate extension requires the authority verifier result');
+    }
+    const extracted = sp_nvtrust_wrapper_1.NvtrustWrapper.extractGPUInfoFromToken({
+        jwt: nvidiaVerification.gpuToken,
+    });
+    const gpusInfo = {
+        ...extracted,
+        attestationMode: nvidiaVerification.attestationMode,
+    };
+    const extensions = [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+            value: Buffer.from(sp_nvtrust_wrapper_1.NvtrustGPUList.encode(gpusInfo).finish()),
+        },
+    ];
+    const { gpuInterconnectStatus, nvswitchToken } = nvidiaVerification;
+    if (gpusInfo.gpus.length === 1) {
+        if (gpuInterconnectStatus !== undefined ||
+            nvswitchToken !== undefined) {
+            throw new Error('NVIDIA GPU interconnect data must be omitted for a single GPU');
+        }
+        return extensions;
+    }
+    if (gpusInfo.gpus.length === 0) {
+        throw new Error('NVIDIA GPU token does not contain any GPU claims');
+    }
+    if (gpuInterconnectStatus === undefined) {
+        throw new Error('NVIDIA GPU interconnect status is required for multiple GPUs');
+    }
+    const isVerifiedNVSwitchInterconnect = gpuInterconnectStatus ===
+        sp_nvtrust_wrapper_1.NvidiaGpuInterconnectStatus.NVIDIA_GPU_INTERCONNECT_NVLINK_SWITCH_ATTESTATION_VERIFIED;
+    if (!isVerifiedNVSwitchInterconnect && nvswitchToken !== undefined) {
+        throw new Error('NVIDIA NVSwitch token is only allowed for a verified NVLink switch interconnect');
+    }
+    if (isVerifiedNVSwitchInterconnect && !nvswitchToken) {
+        throw new Error('Verified NVIDIA NVLink switch interconnect requires a non-empty NVSwitch token');
+    }
+    // ChallengeValidatorNvidia verifies this token before certificate issuance.
+    const switches = nvswitchToken
+        ? sp_nvtrust_wrapper_1.NvtrustWrapper.extractNVSwitchInfoFromToken({ jwt: nvswitchToken })
+        : [];
+    const interconnectInfo = sp_nvtrust_wrapper_1.NvtrustWrapper.createNvidiaGpuInterconnectInfo(gpuInterconnectStatus, switches);
+    extensions.push({
+        oid: pki_common_1.OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU_INTERCONNECT,
+        value: Buffer.from(sp_nvtrust_wrapper_1.NvidiaGpuInterconnectInfo.encode(interconnectInfo).finish()),
+    });
+    return extensions;
+};
+const buildCertificateChallengeExtensions = (challenge) => {
+    if (challenge.type !== pki_common_1.ChallengeType.Certificate) {
+        return [];
+    }
+    const challengeSubtype = sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE);
+    const certificateId = sdk_js_1.CertificatesHelper.getExtensionValue(challenge.orderCertificate, sdk_js_1.constants.OID_CUSTOM_EXTENSION_USER_DATA);
+    if (!challengeSubtype || !certificateId) {
+        throw new Error(`Challenge certificate is missing required extensions: ${pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE} or ${sdk_js_1.constants.OID_CUSTOM_EXTENSION_USER_DATA}`);
+    }
+    return [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_SUBTYPE,
+            value: challengeSubtype,
+        },
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_CERTIFICATE_ID,
+            value: certificateId,
+        },
+    ];
+};
+const buildValidatedExtension = (validated) => {
+    if (!validated) {
+        return [];
+    }
+    return [
+        {
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_VALIDATED,
+            value: Buffer.alloc(0),
+        },
+    ];
+};
+// TODO: Investigate behavior
+// const buildVmGpuExtension = (
+//     vmCertificatePem: string | undefined,
+//     existingExtensions: CustomExtension[],
+// ): CustomExtension[] => {
+//     if (!vmCertificatePem) {
+//         return [];
+//     }
+//
+//     const gpuInfo = CertificatesHelper.getExtensionValue(
+//         vmCertificatePem,
+//         OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+//     );
+//
+//     if (
+//         gpuInfo &&
+//         !existingExtensions.some(
+//             (ext) => ext.oid === OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+//         )
+//     ) {
+//         return [
+//             {
+//                 oid: OID_CUSTOM_EXTENSION_NVIDIA_INFO_GPU,
+//                 value: gpuInfo,
+//             },
+//         ];
+//     }
+//
+//     return [];
+// };
+const buildCommonExtensions = (params) => {
+    const extensions = [];
+    if (params.challengeInfo) {
+        const { challenge, idHex, commonIdHex } = params.challengeInfo;
+        extensions.push({
+            oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_TYPE,
+            value: Buffer.from(challenge.type, 'ascii'),
+        });
+        if (challenge.type !== pki_common_1.ChallengeType.Token) {
+            extensions.push({
+                oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_ID,
+                value: Buffer.from(idHex, 'hex'),
+            });
+            if (commonIdHex) {
+                extensions.push({
+                    oid: pki_common_1.OID_CUSTOM_EXTENSION_CHALLENGE_COMMON_ID,
+                    value: Buffer.from(commonIdHex, 'hex'),
+                });
+            }
+            if (params.certType === pki_common_1.CertificateType.Basic) {
+                const attestationPayloadBase64 = getAttestationPayloadBase64FromChallenge(challenge);
+                if (attestationPayloadBase64) {
+                    extensions.push({
+                        oid: pki_common_1.OID_TEE_EVIDENCE,
+                        value: Buffer.from(attestationPayloadBase64, 'base64'),
+                    });
+                }
+            }
+            extensions.push(...buildNvidiaExtensions(params.challengeInfo));
+            extensions.push(...buildCertificateChallengeExtensions(challenge));
+        }
+    }
+    const filteredClientExtensions = filterClientExtensions(params.clientExtensionAttrs);
+    return [...filteredClientExtensions, ...extensions];
+};
+const generateCertificate = async (params) => {
+    const signingCertPems = (0, pki_common_1.sortCertsFromLeafToRootWrapper)(params.signingCertPem, (pem) => sdk_js_1.CertificatesHelper.sortCertsFromLeafToRoot(pem).map((c) => sdk_js_1.CertificatesHelper.derToPem(c.cert.toSchema().toBER(false))));
+    if (!signingCertPems.length) {
+        throw new Error('No valid signing certificates found in the provided signingCertPem');
+    }
+    const signingLeafPem = signingCertPems[0];
+    const signingCert = await sdk_js_1.CertificateGenerator.checkAndParseCert(signingLeafPem);
+    const customExtensions = buildCommonExtensions({
+        certType: params.certType,
+        challengeInfo: params.challengeInfo,
+        clientExtensionAttrs: params.clientExtensionAttrs,
+    });
+    customExtensions.push(...buildValidatedExtension(params.validated));
+    // TODO: Investigate behavior
+    // customExtensions.push(
+    //     ...buildVmGpuExtension(params.vmCertificatePem, customExtensions),
+    // );
+    const domains = params.certType === pki_common_1.CertificateType.Basic
+        ? filterValidDomainOrIpList(params.domains)
+        : [];
+    const subject = {
+        commonName: params.commonName || params.domains[0] || '',
+        country: params.certParams.countryName,
+        stateName: params.certParams.stateName,
+        localityName: params.certParams.localityName,
+        organization: params.certParams.organizationName,
+        organizationalUnit: params.certParams.organizationUnitName,
+    };
+    const notAfter = resolveNotAfter(params.certParams);
+    const generateCertParams = {
+        privateKey: params.signingPrivateKeyPem,
+        publicKey: params.publicKeyPem,
+        subject,
+        dnsNames: domains,
+        ca: params.ca,
+        ocspSigning: params.ocspSigning,
+        issuer: signingCert.subject,
+        notAfter,
+        customExtensions,
+    };
+    if (params.certParams.ocspUrl) {
+        generateCertParams.ocspExtension = {
+            ocspUrl: params.certParams.ocspUrl,
+        };
+    }
+    const certPem = await sdk_js_1.CertificateGenerator.generateCert(generateCertParams);
+    const rootCertsPem = params.caBundle === params.signingCertPem
+        ? params.signingCertPem
+        : params.signingCertPem + '\n' + params.caBundle;
+    return {
+        certPem,
+        domains,
+        rootCertsPem,
+    };
+};
+const generateSubrootCertificate = async (params) => generateCertificate({
+    ...params,
+    ca: true,
+});
+exports.generateSubrootCertificate = generateSubrootCertificate;
+const generateEndEntityCertificate = async (params) => generateCertificate({
+    ...params,
+    ca: false,
+});
+exports.generateEndEntityCertificate = generateEndEntityCertificate;
+const getParamsFromCSR = async (csrPem) => {
+    const parsedCsr = await sdk_js_1.CertificateGenerator.checkAndParseCsr(csrPem);
+    const commonName = parsedCsr.subject.match(/CN=([^,]+)/)?.[1]?.trim();
+    return {
+        commonName,
+        publicKeyPem: await sdk_js_1.CryptoKeysTransformer.cryptoKeyToSpkiPem(parsedCsr.publicKey),
+        clientDomains: parsedCsr.dnsNames || [],
+        clientExtensionAttrs: parsedCsr.extensions || [],
+    };
+};
+exports.getParamsFromCSR = getParamsFromCSR;
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGVHZW5lcmF0b3IuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi9zcmMvY2VydGlmaWNhdGVHZW5lcmF0b3IudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6Ijs7O0FBQUEsbURBUWdDO0FBQ2hDLDJFQUs0QztBQUM1Qyw2QkFBMkI7QUFDM0IsMkRBb0JvQztBQUVwQyxNQUFNLHNCQUFzQixHQUFHLENBQUMsQ0FBQztBQUNqQyxNQUFNLHNCQUFzQixHQUFHLEtBQUssQ0FBQztBQUNyQyxNQUFNLGVBQWUsR0FBRyx5Q0FBeUMsQ0FBQztBQUVsRSxNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLElBQUksQ0FBQyxZQUFZLElBQUksWUFBWSxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUM3QyxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsTUFBTSxVQUFVLEdBQUcsWUFBWSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQztJQUNqRCxNQUFNLFFBQVEsR0FBRyxVQUFVLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQztJQUVuRSxJQUFJLENBQUMsVUFBVSxJQUFJLFFBQVEsQ0FBQyxXQUFXLEVBQUUsS0FBSyxXQUFXLEVBQUUsQ0FBQztRQUN4RCxPQUFPLElBQUksQ0FBQztJQUNoQixDQUFDO0lBRUQsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDO1FBQ2pFLE9BQU8sS0FBSyxDQUFDO0lBQ2pCLENBQUM7SUFFRCxNQUFNLE1BQU0sR0FBRyxRQUFRLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ25DLElBQUksTUFBTSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN2RCxPQUFPLEtBQUssQ0FBQztJQUNqQixDQUFDO0lBRUQsT0FBTyxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQztBQUM1QyxDQUFDLENBQUM7QUFFRixNQUFNLGlCQUFpQixHQUFHLENBQUMsS0FBYSxFQUFXLEVBQUU7SUFDakQsTUFBTSxZQUFZLEdBQUcsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQ2xDLE9BQU8sSUFBQSxVQUFJLEVBQUMsWUFBWSxDQUFDLEtBQUssQ0FBQyxJQUFJLGlCQUFpQixDQUFDLFlBQVksQ0FBQyxDQUFDO0FBQ3ZFLENBQUMsQ0FBQztBQUVGLE1BQU0seUJBQXlCLEdBQUcsQ0FBQyxNQUFnQixFQUFZLEVBQUUsQ0FDN0QsTUFBTTtLQUNELEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLElBQUksRUFBRSxDQUFDO0tBQzVCLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxJQUFJLGlCQUFpQixDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7QUFFOUQsTUFBTSxVQUFVLEdBQUcsQ0FBQyxJQUFVLEVBQUUsSUFBWSxFQUFRLEVBQUU7SUFDbEQsTUFBTSxJQUFJLEdBQUcsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7SUFDNUIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsVUFBVSxFQUFFLEdBQUcsSUFBSSxDQUFDLENBQUM7SUFDMUMsT0FBTyxJQUFJLENBQUM7QUFDaEIsQ0FBQyxDQUFDO0FBRUYsTUFBTSxlQUFlLEdBQUcsQ0FBQyxVQUF5QixFQUFRLEVBQUU7SUFDeEQsTUFBTSxFQUFFLFlBQVksRUFBRSxHQUFHLFVBQVUsQ0FBQztJQUVwQyxJQUNJLENBQUMsTUFBTSxDQUFDLFNBQVMsQ0FBQyxZQUFZLENBQUM7UUFDL0IsWUFBWSxHQUFHLHNCQUFzQjtRQUNyQyxZQUFZLEdBQUcsc0JBQXNCLEVBQ3ZDLENBQUM7UUFDQyxNQUFNLElBQUksS0FBSyxDQUNYLHNEQUFzRCxzQkFBc0IsUUFBUSxzQkFBc0IsRUFBRSxDQUMvRyxDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU8sVUFBVSxDQUFDLElBQUksSUFBSSxFQUFFLEVBQUUsWUFBWSxDQUFDLENBQUM7QUFDaEQsQ0FBQyxDQUFDO0FBRUYsTUFBTSxjQUFjLEdBQUcsQ0FBQyxVQUF5QixFQUF3QixFQUFFLENBQUMsQ0FBQztJQUN6RSxVQUFVLEVBQUUsVUFBVSxDQUFDLFVBQVU7SUFDakMsT0FBTyxFQUFFLFVBQVUsQ0FBQyxXQUFXO0lBQy9CLFNBQVMsRUFBRSxVQUFVLENBQUMsU0FBUztJQUMvQixZQUFZLEVBQUUsVUFBVSxDQUFDLFlBQVk7SUFDckMsWUFBWSxFQUFFLFVBQVUsQ0FBQyxnQkFBZ0I7SUFDekMsa0JBQWtCLEVBQUUsVUFBVSxDQUFDLG9CQUFvQjtDQUN0RCxDQUFDLENBQUM7QUFFSCxNQUFNLHdDQUF3QyxHQUFHLENBQzdDLFNBQW9CLEVBQ0YsRUFBRTtJQUNwQixRQUFRLFNBQVMsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNyQixLQUFLLDBCQUFhLENBQUMsR0FBRyxDQUFDO1FBQ3ZCLEtBQUssMEJBQWEsQ0FBQyxTQUFTLENBQUM7UUFDN0IsS0FBSywwQkFBYSxDQUFDLFFBQVEsQ0FBQztRQUM1QixLQUFLLDBCQUFhLENBQUMsTUFBTSxDQUFDO1FBQzFCLEtBQUssMEJBQWEsQ0FBQyxXQUFXO1lBQzFCLE9BQU8sU0FBUyxDQUFDLGNBQWMsQ0FBQztRQUNwQztZQUNJLE9BQU87SUFDZixDQUFDO0FBQ0wsQ0FBQyxDQUFDO0FBRUssTUFBTSx1QkFBdUIsR0FBRyxLQUFLLEVBQUUsTUFPN0MsRUFBbUIsRUFBRTtJQUNsQixNQUFNLFNBQVMsR0FBRyxjQUFjLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQ3BELE1BQU0sUUFBUSxHQUFHLGVBQWUsQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLENBQUM7SUFFcEQsTUFBTSxnQkFBZ0IsR0FBc0I7UUFDeEM7WUFDSSxHQUFHLEVBQUUsZ0RBQW1DO1lBQ3hDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsSUFBSSxFQUFFLE9BQU8sQ0FBQztTQUNyRDtLQUNKLENBQUM7SUFFRixJQUFJLE1BQU0sQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUNyQixnQkFBZ0IsQ0FBQyxJQUFJLENBQUM7WUFDbEIsR0FBRyxFQUFFLDhDQUFpQztZQUN0QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLE9BQU8sQ0FBQztTQUNsRCxDQUFDLENBQUM7SUFDUCxDQUFDO0lBRUQsTUFBTSx3QkFBd0IsR0FBRyx3Q0FBd0MsQ0FDckUsTUFBTSxDQUFDLFNBQVMsQ0FDbkIsQ0FBQztJQUNGLElBQUksd0JBQXdCLEVBQUUsQ0FBQztRQUMzQixnQkFBZ0IsQ0FBQyxJQUFJLENBQUM7WUFDbEIsR0FBRyxFQUFFLDZCQUFnQjtZQUNyQixLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyx3QkFBd0IsRUFBRSxRQUFRLENBQUM7U0FDekQsQ0FBQyxDQUFDO0lBQ1AsQ0FBQztJQUVELE1BQU0sa0JBQWtCLEdBQXVCO1FBQzNDLFVBQVUsRUFBRSxNQUFNLENBQUMsYUFBYTtRQUNoQyxTQUFTLEVBQUUsTUFBTSxDQUFDLFlBQVk7UUFDOUIsT0FBTyxFQUFFLFNBQVM7UUFDbEIsTUFBTSxFQUFFLFNBQVM7UUFDakIsUUFBUTtRQUNSLFFBQVEsRUFBRSxNQUFNLENBQUMsT0FBTztRQUN4QixFQUFFLEVBQUUsSUFBSTtRQUNSLGdCQUFnQjtLQUNuQixDQUFDO0lBRUYsT0FBTyw2QkFBb0IsQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsQ0FBQztBQUNqRSxDQUFDLENBQUM7QUEvQ1csUUFBQSx1QkFBdUIsMkJBK0NsQztBQUVGLE1BQU0sNkJBQTZCLEdBQUc7SUFDbEMsNkJBQWdCO0lBQ2hCLGdEQUFtQztJQUNuQyw4Q0FBaUM7SUFDakMscURBQXdDO0lBQ3hDLHFEQUF3QztJQUN4QyxpREFBb0M7SUFDcEMsOERBQWlEO0lBQ2pELG1EQUFzQztJQUN0QywwREFBNkM7Q0FDaEQsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsQ0FDM0IsYUFBZ0MsRUFBRSxFQUNqQixFQUFFLENBQ25CLFVBQVUsQ0FBQyxNQUFNLENBQ2IsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUNKLENBQUMsNkJBQTZCLENBQUMsSUFBSSxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FDeEMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsR0FBRyxDQUFDLENBQzFCLENBQ1IsQ0FBQztBQUVOLE1BQU0scUJBQXFCLEdBQUcsQ0FDMUIsYUFBdUMsRUFDdEIsRUFBRTtJQUNuQixNQUFNLEVBQUUsU0FBUyxFQUFFLGtCQUFrQixFQUFFLEdBQUcsYUFBYSxDQUFDO0lBQ3hELE1BQU0sU0FBUyxHQUNYLElBQUEsb0NBQXVCLEVBQUMsU0FBUyxDQUFDO1FBQ2xDLENBQUMsZ0JBQWdCLElBQUksU0FBUztZQUMxQixPQUFPLENBQUMsU0FBUyxDQUFDLGNBQWMsQ0FBQyxDQUFDLENBQUM7SUFDM0MsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1FBQ2IsT0FBTyxFQUFFLENBQUM7SUFDZCxDQUFDO0lBQ0QsSUFBSSxDQUFDLGtCQUFrQixFQUFFLENBQUM7UUFDdEIsTUFBTSxJQUFJLEtBQUssQ0FDWCxxRUFBcUUsQ0FDeEUsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLFNBQVMsR0FBRyxtQ0FBYyxDQUFDLHVCQUF1QixDQUFDO1FBQ3JELEdBQUcsRUFBRSxrQkFBa0IsQ0FBQyxRQUFRO0tBQ25DLENBQUMsQ0FBQztJQUNILE1BQU0sUUFBUSxHQUFHO1FBQ2IsR0FBRyxTQUFTO1FBQ1osZUFBZSxFQUFFLGtCQUFrQixDQUFDLGVBQWU7S0FDcEMsQ0FBQztJQUVwQixNQUFNLFVBQVUsR0FBc0I7UUFDbEM7WUFDSSxHQUFHLEVBQUUsaURBQW9DO1lBQ3pDLEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUFDLG1DQUFjLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUFDO1NBQy9EO0tBQ0osQ0FBQztJQUVGLE1BQU0sRUFBRSxxQkFBcUIsRUFBRSxhQUFhLEVBQUUsR0FBRyxrQkFBa0IsQ0FBQztJQUNwRSxJQUFJLFFBQVEsQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1FBQzdCLElBQ0kscUJBQXFCLEtBQUssU0FBUztZQUNuQyxhQUFhLEtBQUssU0FBUyxFQUM3QixDQUFDO1lBQ0MsTUFBTSxJQUFJLEtBQUssQ0FDWCwrREFBK0QsQ0FDbEUsQ0FBQztRQUNOLENBQUM7UUFDRCxPQUFPLFVBQVUsQ0FBQztJQUN0QixDQUFDO0lBRUQsSUFBSSxRQUFRLENBQUMsSUFBSSxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztRQUM3QixNQUFNLElBQUksS0FBSyxDQUFDLGtEQUFrRCxDQUFDLENBQUM7SUFDeEUsQ0FBQztJQUNELElBQUkscUJBQXFCLEtBQUssU0FBUyxFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLEtBQUssQ0FDWCw4REFBOEQsQ0FDakUsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLDhCQUE4QixHQUNoQyxxQkFBcUI7UUFDckIsZ0RBQTJCLENBQUMsMERBQTBELENBQUM7SUFDM0YsSUFBSSxDQUFDLDhCQUE4QixJQUFJLGFBQWEsS0FBSyxTQUFTLEVBQUUsQ0FBQztRQUNqRSxNQUFNLElBQUksS0FBSyxDQUNYLGlGQUFpRixDQUNwRixDQUFDO0lBQ04sQ0FBQztJQUNELElBQUksOEJBQThCLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztRQUNuRCxNQUFNLElBQUksS0FBSyxDQUNYLGdGQUFnRixDQUNuRixDQUFDO0lBQ04sQ0FBQztJQUVELDRFQUE0RTtJQUM1RSxNQUFNLFFBQVEsR0FBRyxhQUFhO1FBQzFCLENBQUMsQ0FBQyxtQ0FBYyxDQUFDLDRCQUE0QixDQUFDLEVBQUUsR0FBRyxFQUFFLGFBQWEsRUFBRSxDQUFDO1FBQ3JFLENBQUMsQ0FBQyxFQUFFLENBQUM7SUFDVCxNQUFNLGdCQUFnQixHQUFHLG1DQUFjLENBQUMsK0JBQStCLENBQ25FLHFCQUFvRCxFQUNwRCxRQUFRLENBQ1gsQ0FBQztJQUNGLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFDWixHQUFHLEVBQUUsOERBQWlEO1FBQ3RELEtBQUssRUFBRSxNQUFNLENBQUMsSUFBSSxDQUNkLDhDQUF5QixDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDLE1BQU0sRUFBRSxDQUM5RDtLQUNKLENBQUMsQ0FBQztJQUVILE9BQU8sVUFBVSxDQUFDO0FBQ3RCLENBQUMsQ0FBQztBQUVGLE1BQU0sbUNBQW1DLEdBQUcsQ0FDeEMsU0FBb0IsRUFDSCxFQUFFO0lBQ25CLElBQUksU0FBUyxDQUFDLElBQUksS0FBSywwQkFBYSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQy9DLE9BQU8sRUFBRSxDQUFDO0lBQ2QsQ0FBQztJQUVELE1BQU0sZ0JBQWdCLEdBQUcsMkJBQWtCLENBQUMsaUJBQWlCLENBQ3pELFNBQVMsQ0FBQyxnQkFBZ0IsRUFDMUIsZ0RBQW1DLENBQ3RDLENBQUM7SUFDRixNQUFNLGFBQWEsR0FBRywyQkFBa0IsQ0FBQyxpQkFBaUIsQ0FDdEQsU0FBUyxDQUFDLGdCQUFnQixFQUMxQixrQkFBUyxDQUFDLDhCQUE4QixDQUMzQyxDQUFDO0lBRUYsSUFBSSxDQUFDLGdCQUFnQixJQUFJLENBQUMsYUFBYSxFQUFFLENBQUM7UUFDdEMsTUFBTSxJQUFJLEtBQUssQ0FDWCx5REFBeUQsZ0RBQW1DLE9BQU8sa0JBQVMsQ0FBQyw4QkFBOEIsRUFBRSxDQUNoSixDQUFDO0lBQ04sQ0FBQztJQUVELE9BQU87UUFDSDtZQUNJLEdBQUcsRUFBRSxtREFBc0M7WUFDM0MsS0FBSyxFQUFFLGdCQUFnQjtTQUMxQjtRQUNEO1lBQ0ksR0FBRyxFQUFFLDBEQUE2QztZQUNsRCxLQUFLLEVBQUUsYUFBYTtTQUN2QjtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRixNQUFNLHVCQUF1QixHQUFHLENBQUMsU0FBbUIsRUFBcUIsRUFBRTtJQUN2RSxJQUFJLENBQUMsU0FBUyxFQUFFLENBQUM7UUFDYixPQUFPLEVBQUUsQ0FBQztJQUNkLENBQUM7SUFFRCxPQUFPO1FBQ0g7WUFDSSxHQUFHLEVBQUUscURBQXdDO1lBQzdDLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQztTQUN6QjtLQUNKLENBQUM7QUFDTixDQUFDLENBQUM7QUFFRiw2QkFBNkI7QUFDN0IsZ0NBQWdDO0FBQ2hDLDRDQUE0QztBQUM1Qyw2Q0FBNkM7QUFDN0MsNEJBQTRCO0FBQzVCLCtCQUErQjtBQUMvQixxQkFBcUI7QUFDckIsUUFBUTtBQUNSLEVBQUU7QUFDRiw0REFBNEQ7QUFDNUQsNEJBQTRCO0FBQzVCLGdEQUFnRDtBQUNoRCxTQUFTO0FBQ1QsRUFBRTtBQUNGLFdBQVc7QUFDWCxxQkFBcUI7QUFDckIsb0NBQW9DO0FBQ3BDLHlFQUF5RTtBQUN6RSxZQUFZO0FBQ1osVUFBVTtBQUNWLG1CQUFtQjtBQUNuQixnQkFBZ0I7QUFDaEIsNkRBQTZEO0FBQzdELGtDQUFrQztBQUNsQyxpQkFBaUI7QUFDakIsYUFBYTtBQUNiLFFBQVE7QUFDUixFQUFFO0FBQ0YsaUJBQWlCO0FBQ2pCLEtBQUs7QUFFTCxNQUFNLHFCQUFxQixHQUFHLENBQUMsTUFJOUIsRUFBcUIsRUFBRTtJQUNwQixNQUFNLFVBQVUsR0FBc0IsRUFBRSxDQUFDO0lBRXpDLElBQUksTUFBTSxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQ3ZCLE1BQU0sRUFBRSxTQUFTLEVBQUUsS0FBSyxFQUFFLFdBQVcsRUFBRSxHQUFHLE1BQU0sQ0FBQyxhQUFhLENBQUM7UUFFL0QsVUFBVSxDQUFDLElBQUksQ0FBQztZQUNaLEdBQUcsRUFBRSxnREFBbUM7WUFDeEMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksRUFBRSxPQUFPLENBQUM7U0FDOUMsQ0FBQyxDQUFDO1FBRUgsSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLDBCQUFhLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDekMsVUFBVSxDQUFDLElBQUksQ0FBQztnQkFDWixHQUFHLEVBQUUsOENBQWlDO2dCQUN0QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxLQUFLLEVBQUUsS0FBSyxDQUFDO2FBQ25DLENBQUMsQ0FBQztZQUVILElBQUksV0FBVyxFQUFFLENBQUM7Z0JBQ2QsVUFBVSxDQUFDLElBQUksQ0FBQztvQkFDWixHQUFHLEVBQUUscURBQXdDO29CQUM3QyxLQUFLLEVBQUUsTUFBTSxDQUFDLElBQUksQ0FBQyxXQUFXLEVBQUUsS0FBSyxDQUFDO2lCQUN6QyxDQUFDLENBQUM7WUFDUCxDQUFDO1lBRUQsSUFBSSxNQUFNLENBQUMsUUFBUSxLQUFLLDRCQUFlLENBQUMsS0FBSyxFQUFFLENBQUM7Z0JBQzVDLE1BQU0sd0JBQXdCLEdBQzFCLHdDQUF3QyxDQUFDLFNBQVMsQ0FBQyxDQUFDO2dCQUN4RCxJQUFJLHdCQUF3QixFQUFFLENBQUM7b0JBQzNCLFVBQVUsQ0FBQyxJQUFJLENBQUM7d0JBQ1osR0FBRyxFQUFFLDZCQUFnQjt3QkFDckIsS0FBSyxFQUFFLE1BQU0sQ0FBQyxJQUFJLENBQUMsd0JBQXdCLEVBQUUsUUFBUSxDQUFDO3FCQUN6RCxDQUFDLENBQUM7Z0JBQ1AsQ0FBQztZQUNMLENBQUM7WUFFRCxVQUFVLENBQUMsSUFBSSxDQUFDLEdBQUcscUJBQXFCLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUM7WUFDaEUsVUFBVSxDQUFDLElBQUksQ0FBQyxHQUFHLG1DQUFtQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUM7UUFDdkUsQ0FBQztJQUNMLENBQUM7SUFFRCxNQUFNLHdCQUF3QixHQUFHLHNCQUFzQixDQUNuRCxNQUFNLENBQUMsb0JBQW9CLENBQzlCLENBQUM7SUFFRixPQUFPLENBQUMsR0FBRyx3QkFBd0IsRUFBRSxHQUFHLFVBQVUsQ0FBQyxDQUFDO0FBQ3hELENBQUMsQ0FBQztBQWtCRixNQUFNLG1CQUFtQixHQUFHLEtBQUssRUFDN0IsTUFBbUQsRUFDekIsRUFBRTtJQUM1QixNQUFNLGVBQWUsR0FBRyxJQUFBLDJDQUE4QixFQUNsRCxNQUFNLENBQUMsY0FBYyxFQUNyQixDQUFDLEdBQUcsRUFBRSxFQUFFLENBQ0osMkJBQWtCLENBQUMsdUJBQXVCLENBQUMsR0FBRyxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLEVBQUUsQ0FDdEQsMkJBQWtCLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQzlELENBQ1IsQ0FBQztJQUVGLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLENBQUM7UUFDMUIsTUFBTSxJQUFJLEtBQUssQ0FDWCxvRUFBb0UsQ0FDdkUsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLGNBQWMsR0FBRyxlQUFlLENBQUMsQ0FBQyxDQUFDLENBQUM7SUFDMUMsTUFBTSxXQUFXLEdBQ2IsTUFBTSw2QkFBb0IsQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsQ0FBQztJQUVqRSxNQUFNLGdCQUFnQixHQUFHLHFCQUFxQixDQUFDO1FBQzNDLFFBQVEsRUFBRSxNQUFNLENBQUMsUUFBUTtRQUN6QixhQUFhLEVBQUUsTUFBTSxDQUFDLGFBQWE7UUFDbkMsb0JBQW9CLEVBQUUsTUFBTSxDQUFDLG9CQUFvQjtLQUNwRCxDQUFDLENBQUM7SUFFSCxnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsR0FBRyx1QkFBdUIsQ0FBQyxNQUFNLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQztJQUNwRSw2QkFBNkI7SUFDN0IseUJBQXlCO0lBQ3pCLHlFQUF5RTtJQUN6RSxLQUFLO0lBRUwsTUFBTSxPQUFPLEdBQ1QsTUFBTSxDQUFDLFFBQVEsS0FBSyw0QkFBZSxDQUFDLEtBQUs7UUFDckMsQ0FBQyxDQUFDLHlCQUF5QixDQUFDLE1BQU0sQ0FBQyxPQUFPLENBQUM7UUFDM0MsQ0FBQyxDQUFDLEVBQUUsQ0FBQztJQUViLE1BQU0sT0FBTyxHQUF5QjtRQUNsQyxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLEVBQUU7UUFDeEQsT0FBTyxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsV0FBVztRQUN0QyxTQUFTLEVBQUUsTUFBTSxDQUFDLFVBQVUsQ0FBQyxTQUFTO1FBQ3RDLFlBQVksRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLFlBQVk7UUFDNUMsWUFBWSxFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsZ0JBQWdCO1FBQ2hELGtCQUFrQixFQUFFLE1BQU0sQ0FBQyxVQUFVLENBQUMsb0JBQW9CO0tBQzdELENBQUM7SUFFRixNQUFNLFFBQVEsR0FBRyxlQUFlLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBRXBELE1BQU0sa0JBQWtCLEdBQXVCO1FBQzNDLFVBQVUsRUFBRSxNQUFNLENBQUMsb0JBQW9CO1FBQ3ZDLFNBQVMsRUFBRSxNQUFNLENBQUMsWUFBWTtRQUM5QixPQUFPO1FBQ1AsUUFBUSxFQUFFLE9BQU87UUFDakIsRUFBRSxFQUFFLE1BQU0sQ0FBQyxFQUFFO1FBQ2IsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXO1FBQy9CLE1BQU0sRUFBRSxXQUFXLENBQUMsT0FBTztRQUMzQixRQUFRO1FBQ1IsZ0JBQWdCO0tBQ25CLENBQUM7SUFFRixJQUFJLE1BQU0sQ0FBQyxVQUFVLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDNUIsa0JBQWtCLENBQUMsYUFBYSxHQUFHO1lBQy9CLE9BQU8sRUFBRSxNQUFNLENBQUMsVUFBVSxDQUFDLE9BQU87U0FDckMsQ0FBQztJQUNOLENBQUM7SUFFRCxNQUFNLE9BQU8sR0FBRyxNQUFNLDZCQUFvQixDQUFDLFlBQVksQ0FBQyxrQkFBa0IsQ0FBQyxDQUFDO0lBRTVFLE1BQU0sWUFBWSxHQUNkLE1BQU0sQ0FBQyxRQUFRLEtBQUssTUFBTSxDQUFDLGNBQWM7UUFDckMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxjQUFjO1FBQ3ZCLENBQUMsQ0FBQyxNQUFNLENBQUMsY0FBYyxHQUFHLElBQUksR0FBRyxNQUFNLENBQUMsUUFBUSxDQUFDO0lBRXpELE9BQU87UUFDSCxPQUFPO1FBQ1AsT0FBTztRQUNQLFlBQVk7S0FDZixDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBRUssTUFBTSwwQkFBMEIsR0FBRyxLQUFLLEVBQzNDLE1BQWlDLEVBQ1AsRUFBRSxDQUM1QixtQkFBbUIsQ0FBQztJQUNoQixHQUFHLE1BQU07SUFDVCxFQUFFLEVBQUUsSUFBSTtDQUNYLENBQUMsQ0FBQztBQU5NLFFBQUEsMEJBQTBCLDhCQU1oQztBQUVBLE1BQU0sNEJBQTRCLEdBQUcsS0FBSyxFQUM3QyxNQUFpQyxFQUNQLEVBQUUsQ0FDNUIsbUJBQW1CLENBQUM7SUFDaEIsR0FBRyxNQUFNO0lBQ1QsRUFBRSxFQUFFLEtBQUs7Q0FDWixDQUFDLENBQUM7QUFOTSxRQUFBLDRCQUE0QixnQ0FNbEM7QUFFQSxNQUFNLGdCQUFnQixHQUFHLEtBQUssRUFBRSxNQUFjLEVBQUUsRUFBRTtJQUNyRCxNQUFNLFNBQVMsR0FBRyxNQUFNLDZCQUFvQixDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxDQUFDO0lBRXRFLE1BQU0sVUFBVSxHQUFHLFNBQVMsQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFlBQVksQ0FBQyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLENBQUM7SUFDdEUsT0FBTztRQUNILFVBQVU7UUFDVixZQUFZLEVBQUUsTUFBTSw4QkFBcUIsQ0FBQyxrQkFBa0IsQ0FDeEQsU0FBUyxDQUFDLFNBQVMsQ0FDdEI7UUFDRCxhQUFhLEVBQUUsU0FBUyxDQUFDLFFBQVEsSUFBSSxFQUFFO1FBQ3ZDLG9CQUFvQixFQUFFLFNBQVMsQ0FBQyxVQUFVLElBQUksRUFBRTtLQUNuRCxDQUFDO0FBQ04sQ0FBQyxDQUFDO0FBWlcsUUFBQSxnQkFBZ0Isb0JBWTNCIn0=