@xortex/xcode 3.0.0

package/utils/authFileDescriptor.ts

@@ -0,0 +1,196 @@
+import { mkdirSync, writeFileSync } from 'fs'
+import {
+  getApiKeyFromFd,
+  getOauthTokenFromFd,
+  setApiKeyFromFd,
+  setOauthTokenFromFd,
+} from '../bootstrap/state.js'
+import { logForDebugging } from './debug.js'
+import { isEnvTruthy } from './envUtils.js'
+import { errorMessage, isENOENT } from './errors.js'
+import { getFsImplementation } from './fsOperations.js'
+
+/**
+ * Well-known token file locations in CCR. The Go environment-manager creates
+ * /home/claude/.claude/remote/ and will (eventually) write these files too.
+ * Until then, this module writes them on successful FD read so subprocesses
+ * spawned inside the CCR container can find the token without inheriting
+ * the FD — which they can't: pipe FDs don't cross tmux/shell boundaries.
+ */
+const CCR_TOKEN_DIR = '/home/claude/.claude/remote'
+export const CCR_OAUTH_TOKEN_PATH = `${CCR_TOKEN_DIR}/.oauth_token`
+export const CCR_API_KEY_PATH = `${CCR_TOKEN_DIR}/.api_key`
+export const CCR_SESSION_INGRESS_TOKEN_PATH = `${CCR_TOKEN_DIR}/.session_ingress_token`
+
+/**
+ * Best-effort write of the token to a well-known location for subprocess
+ * access. CCR-gated: outside CCR there's no /home/claude/ and no reason to
+ * put a token on disk that the FD was meant to keep off disk.
+ */
+export function maybePersistTokenForSubprocesses(
+  path: string,
+  token: string,
+  tokenName: string,
+): void {
+  if (!isEnvTruthy(process.env.CLAUDE_CODE_REMOTE)) {
+    return
+  }
+  try {
+    // eslint-disable-next-line custom-rules/no-sync-fs -- one-shot startup write in CCR, caller is sync
+    mkdirSync(CCR_TOKEN_DIR, { recursive: true, mode: 0o700 })
+    // eslint-disable-next-line custom-rules/no-sync-fs -- one-shot startup write in CCR, caller is sync
+    writeFileSync(path, token, { encoding: 'utf8', mode: 0o600 })
+    logForDebugging(`Persisted ${tokenName} to ${path} for subprocess access`)
+  } catch (error) {
+    logForDebugging(
+      `Failed to persist ${tokenName} to disk (non-fatal): ${errorMessage(error)}`,
+      { level: 'error' },
+    )
+  }
+}
+
+/**
+ * Fallback read from a well-known file. The path only exists in CCR (env-manager
+ * creates the directory), so file-not-found is the expected outcome everywhere
+ * else — treated as "no fallback", not an error.
+ */
+export function readTokenFromWellKnownFile(
+  path: string,
+  tokenName: string,
+): string | null {
+  try {
+    const fsOps = getFsImplementation()
+    // eslint-disable-next-line custom-rules/no-sync-fs -- fallback read for CCR subprocess path, one-shot at startup, caller is sync
+    const token = fsOps.readFileSync(path, { encoding: 'utf8' }).trim()
+    if (!token) {
+      return null
+    }
+    logForDebugging(`Read ${tokenName} from well-known file ${path}`)
+    return token
+  } catch (error) {
+    // ENOENT is the expected outcome outside CCR — stay silent. Anything
+    // else (EACCES from perm misconfig, etc.) is worth surfacing in the
+    // debug log so subprocess auth failures aren't mysterious.
+    if (!isENOENT(error)) {
+      logForDebugging(
+        `Failed to read ${tokenName} from ${path}: ${errorMessage(error)}`,
+        { level: 'debug' },
+      )
+    }
+    return null
+  }
+}
+
+/**
+ * Shared FD-or-well-known-file credential reader.
+ *
+ * Priority order:
+ *  1. File descriptor (legacy path) — env var points at a pipe FD passed by
+ *     the Go env-manager via cmd.ExtraFiles. Pipe is drained on first read
+ *     and doesn't cross exec/tmux boundaries.
+ *  2. Well-known file — written by this function on successful FD read (and
+ *     eventually by the env-manager directly). Covers subprocesses that can't
+ *     inherit the FD.
+ *
+ * Returns null if neither source has a credential. Cached in global state.
+ */
+function getCredentialFromFd({
+  envVar,
+  wellKnownPath,
+  label,
+  getCached,
+  setCached,
+}: {
+  envVar: string
+  wellKnownPath: string
+  label: string
+  getCached: () => string | null | undefined
+  setCached: (value: string | null) => void
+}): string | null {
+  const cached = getCached()
+  if (cached !== undefined) {
+    return cached
+  }
+
+  const fdEnv = process.env[envVar]
+  if (!fdEnv) {
+    // No FD env var — either we're not in CCR, or we're a subprocess whose
+    // parent stripped the (useless) FD env var. Try the well-known file.
+    const fromFile = readTokenFromWellKnownFile(wellKnownPath, label)
+    setCached(fromFile)
+    return fromFile
+  }
+
+  const fd = parseInt(fdEnv, 10)
+  if (Number.isNaN(fd)) {
+    logForDebugging(
+      `${envVar} must be a valid file descriptor number, got: ${fdEnv}`,
+      { level: 'error' },
+    )
+    setCached(null)
+    return null
+  }
+
+  try {
+    // Use /dev/fd on macOS/BSD, /proc/self/fd on Linux
+    const fsOps = getFsImplementation()
+    const fdPath =
+      process.platform === 'darwin' || process.platform === 'freebsd'
+        ? `/dev/fd/${fd}`
+        : `/proc/self/fd/${fd}`
+
+    // eslint-disable-next-line custom-rules/no-sync-fs -- legacy FD path, read once at startup, caller is sync
+    const token = fsOps.readFileSync(fdPath, { encoding: 'utf8' }).trim()
+    if (!token) {
+      logForDebugging(`File descriptor contained empty ${label}`, {
+        level: 'error',
+      })
+      setCached(null)
+      return null
+    }
+    logForDebugging(`Successfully read ${label} from file descriptor ${fd}`)
+    setCached(token)
+    maybePersistTokenForSubprocesses(wellKnownPath, token, label)
+    return token
+  } catch (error) {
+    logForDebugging(
+      `Failed to read ${label} from file descriptor ${fd}: ${errorMessage(error)}`,
+      { level: 'error' },
+    )
+    // FD env var was set but read failed — typically a subprocess that
+    // inherited the env var but not the FD (ENXIO). Try the well-known file.
+    const fromFile = readTokenFromWellKnownFile(wellKnownPath, label)
+    setCached(fromFile)
+    return fromFile
+  }
+}
+
+/**
+ * Get the CCR-injected OAuth token. See getCredentialFromFd for FD-vs-disk
+ * rationale. Env var: CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR.
+ * Well-known file: /home/claude/.claude/remote/.oauth_token.
+ */
+export function getOAuthTokenFromFileDescriptor(): string | null {
+  return getCredentialFromFd({
+    envVar: 'CLAUDE_CODE_OAUTH_TOKEN_FILE_DESCRIPTOR',
+    wellKnownPath: CCR_OAUTH_TOKEN_PATH,
+    label: 'OAuth token',
+    getCached: getOauthTokenFromFd,
+    setCached: setOauthTokenFromFd,
+  })
+}
+
+/**
+ * Get the CCR-injected API key. See getCredentialFromFd for FD-vs-disk
+ * rationale. Env var: CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR.
+ * Well-known file: /home/claude/.claude/remote/.api_key.
+ */
+export function getApiKeyFromFileDescriptor(): string | null {
+  return getCredentialFromFd({
+    envVar: 'CLAUDE_CODE_API_KEY_FILE_DESCRIPTOR',
+    wellKnownPath: CCR_API_KEY_PATH,
+    label: 'API key',
+    getCached: getApiKeyFromFd,
+    setCached: setApiKeyFromFd,
+  })
+}

package/utils/authPortable.ts

@@ -0,0 +1,19 @@
+import { execa } from 'execa'
+import { getMacOsKeychainStorageServiceName } from 'src/utils/secureStorage/macOsKeychainHelpers.js'
+
+export async function maybeRemoveApiKeyFromMacOSKeychainThrows(): Promise<void> {
+  if (process.platform === 'darwin') {
+    const storageServiceName = getMacOsKeychainStorageServiceName()
+    const result = await execa(
+      `security delete-generic-password -a $USER -s "${storageServiceName}"`,
+      { shell: true, reject: false },
+    )
+    if (result.exitCode !== 0) {
+      throw new Error('Failed to delete keychain entry')
+    }
+  }
+}
+
+export function normalizeApiKeyForConfig(apiKey: string): string {
+  return apiKey.slice(-20)
+}

package/utils/autoModeDenials.ts

@@ -0,0 +1,26 @@
+/**
+ * Tracks commands recently denied by the auto mode classifier.
+ * Populated from useCanUseTool.ts, read from RecentDenialsTab.tsx in /permissions.
+ */
+
+import { feature } from 'bun:bundle'
+
+export type AutoModeDenial = {
+  toolName: string
+  /** Human-readable description of the denied command (e.g. bash command string) */
+  display: string
+  reason: string
+  timestamp: number
+}
+
+let DENIALS: readonly AutoModeDenial[] = []
+const MAX_DENIALS = 20
+
+export function recordAutoModeDenial(denial: AutoModeDenial): void {
+  if (!feature('TRANSCRIPT_CLASSIFIER')) return
+  DENIALS = [denial, ...DENIALS.slice(0, MAX_DENIALS - 1)]
+}
+
+export function getAutoModeDenials(): readonly AutoModeDenial[] {
+  return DENIALS
+}

package/utils/autoRunIssue.tsx

@@ -0,0 +1,122 @@
+import { c as _c } from "react/compiler-runtime";
+import * as React from 'react';
+import { useEffect, useRef } from 'react';
+import { KeyboardShortcutHint } from '../components/design-system/KeyboardShortcutHint.js';
+import { Box, Text } from '../ink.js';
+import { useKeybinding } from '../keybindings/useKeybinding.js';
+type Props = {
+  onRun: () => void;
+  onCancel: () => void;
+  reason: string;
+};
+
+/**
+ * Component that shows a notification about running /issue command
+ * with the ability to cancel via ESC key
+ */
+export function AutoRunIssueNotification(t0) {
+  const $ = _c(8);
+  const {
+    onRun,
+    onCancel,
+    reason
+  } = t0;
+  const hasRunRef = useRef(false);
+  let t1;
+  if ($[0] === Symbol.for("react.memo_cache_sentinel")) {
+    t1 = {
+      context: "Confirmation"
+    };
+    $[0] = t1;
+  } else {
+    t1 = $[0];
+  }
+  useKeybinding("confirm:no", onCancel, t1);
+  let t2;
+  let t3;
+  if ($[1] !== onRun) {
+    t2 = () => {
+      if (!hasRunRef.current) {
+        hasRunRef.current = true;
+        onRun();
+      }
+    };
+    t3 = [onRun];
+    $[1] = onRun;
+    $[2] = t2;
+    $[3] = t3;
+  } else {
+    t2 = $[2];
+    t3 = $[3];
+  }
+  useEffect(t2, t3);
+  let t4;
+  if ($[4] === Symbol.for("react.memo_cache_sentinel")) {
+    t4 = <Box><Text bold={true}>Running feedback capture...</Text></Box>;
+    $[4] = t4;
+  } else {
+    t4 = $[4];
+  }
+  let t5;
+  if ($[5] === Symbol.for("react.memo_cache_sentinel")) {
+    t5 = <Box><Text dimColor={true}>Press <KeyboardShortcutHint shortcut="Esc" action="cancel" /> anytime</Text></Box>;
+    $[5] = t5;
+  } else {
+    t5 = $[5];
+  }
+  let t6;
+  if ($[6] !== reason) {
+    t6 = <Box flexDirection="column" marginTop={1}>{t4}{t5}<Box><Text dimColor={true}>Reason: {reason}</Text></Box></Box>;
+    $[6] = reason;
+    $[7] = t6;
+  } else {
+    t6 = $[7];
+  }
+  return t6;
+}
+export type AutoRunIssueReason = 'feedback_survey_bad' | 'feedback_survey_good';
+
+/**
+ * Determines if /issue should auto-run for Ant users
+ */
+export function shouldAutoRunIssue(reason: AutoRunIssueReason): boolean {
+  // Only for Ant users
+  if ("external" !== 'ant') {
+    return false;
+  }
+  switch (reason) {
+    case 'feedback_survey_bad':
+      return false;
+    case 'feedback_survey_good':
+      return false;
+    default:
+      return false;
+  }
+}
+
+/**
+ * Returns the appropriate command to auto-run based on the reason
+ * ANT-ONLY: good-claude command only exists in ant builds
+ */
+export function getAutoRunCommand(reason: AutoRunIssueReason): string {
+  // Only ant builds have the /good-claude command
+  if ("external" === 'ant' && reason === 'feedback_survey_good') {
+    return '/good-claude';
+  }
+  return '/issue';
+}
+
+/**
+ * Gets a human-readable description of why /issue is being auto-run
+ */
+export function getAutoRunIssueReasonText(reason: AutoRunIssueReason): string {
+  switch (reason) {
+    case 'feedback_survey_bad':
+      return 'You responded "Bad" to the feedback survey';
+    case 'feedback_survey_good':
+      return 'You responded "Good" to the feedback survey';
+    default:
+      return 'Unknown reason';
+  }
+}
+//# sourceMappingURL=data:application/json;charset=utf-8;base64,eyJ2ZXJzaW9uIjozLCJuYW1lcyI6WyJSZWFjdCIsInVzZUVmZmVjdCIsInVzZVJlZiIsIktleWJvYXJkU2hvcnRjdXRIaW50IiwiQm94IiwiVGV4dCIsInVzZUtleWJpbmRpbmciLCJQcm9wcyIsIm9uUnVuIiwib25DYW5jZWwiLCJyZWFzb24iLCJBdXRvUnVuSXNzdWVOb3RpZmljYXRpb24iLCJ0MCIsIiQiLCJfYyIsImhhc1J1blJlZiIsInQxIiwiU3ltYm9sIiwiZm9yIiwiY29udGV4dCIsInQyIiwidDMiLCJjdXJyZW50IiwidDQiLCJ0NSIsInQ2IiwiQXV0b1J1bklzc3VlUmVhc29uIiwic2hvdWxkQXV0b1J1bklzc3VlIiwiZ2V0QXV0b1J1bkNvbW1hbmQiLCJnZXRBdXRvUnVuSXNzdWVSZWFzb25UZXh0Il0sInNvdXJjZXMiOlsiYXV0b1J1bklzc3VlLnRzeCJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQgKiBhcyBSZWFjdCBmcm9tICdyZWFjdCdcbmltcG9ydCB7IHVzZUVmZmVjdCwgdXNlUmVmIH0gZnJvbSAncmVhY3QnXG5pbXBvcnQgeyBLZXlib2FyZFNob3J0Y3V0SGludCB9IGZyb20gJy4uL2NvbXBvbmVudHMvZGVzaWduLXN5c3RlbS9LZXlib2FyZFNob3J0Y3V0SGludC5qcydcbmltcG9ydCB7IEJveCwgVGV4dCB9IGZyb20gJy4uL2luay5qcydcbmltcG9ydCB7IHVzZUtleWJpbmRpbmcgfSBmcm9tICcuLi9rZXliaW5kaW5ncy91c2VLZXliaW5kaW5nLmpzJ1xuXG50eXBlIFByb3BzID0ge1xuICBvblJ1bjogKCkgPT4gdm9pZFxuICBvbkNhbmNlbDogKCkgPT4gdm9pZFxuICByZWFzb246IHN0cmluZ1xufVxuXG4vKipcbiAqIENvbXBvbmVudCB0aGF0IHNob3dzIGEgbm90aWZpY2F0aW9uIGFib3V0IHJ1bm5pbmcgL2lzc3VlIGNvbW1hbmRcbiAqIHdpdGggdGhlIGFiaWxpdHkgdG8gY2FuY2VsIHZpYSBFU0Mga2V5XG4gKi9cbmV4cG9ydCBmdW5jdGlvbiBBdXRvUnVuSXNzdWVOb3RpZmljYXRpb24oe1xuICBvblJ1bixcbiAgb25DYW5jZWwsXG4gIHJlYXNvbixcbn06IFByb3BzKTogUmVhY3QuUmVhY3ROb2RlIHtcbiAgY29uc3QgaGFzUnVuUmVmID0gdXNlUmVmKGZhbHNlKVxuXG4gIC8vIEhhbmRsZSBFU0Mga2V5IHRvIGNhbmNlbFxuICB1c2VLZXliaW5kaW5nKCdjb25maXJtOm5vJywgb25DYW5jZWwsIHsgY29udGV4dDogJ0NvbmZpcm1hdGlvbicgfSlcblxuICAvLyBSdW4gL2lzc3VlIGltbWVkaWF0ZWx5IG9uIG1vdW50XG4gIHVzZUVmZmVjdCgoKSA9PiB7XG4gICAgaWYgKCFoYXNSdW5SZWYuY3VycmVudCkge1xuICAgICAgaGFzUnVuUmVmLmN1cnJlbnQgPSB0cnVlXG4gICAgICBvblJ1bigpXG4gICAgfVxuICB9LCBbb25SdW5dKVxuXG4gIHJldHVybiAoXG4gICAgPEJveCBmbGV4RGlyZWN0aW9uPVwiY29sdW1uXCIgbWFyZ2luVG9wPXsxfT5cbiAgICAgIDxCb3g+XG4gICAgICAgIDxUZXh0IGJvbGQ+UnVubmluZyBmZWVkYmFjayBjYXB0dXJlLi4uPC9UZXh0PlxuICAgICAgPC9Cb3g+XG4gICAgICA8Qm94PlxuICAgICAgICA8VGV4dCBkaW1Db2xvcj5cbiAgICAgICAgICBQcmVzcyA8S2V5Ym9hcmRTaG9ydGN1dEhpbnQgc2hvcnRjdXQ9XCJFc2NcIiBhY3Rpb249XCJjYW5jZWxcIiAvPiBhbnl0aW1lXG4gICAgICAgIDwvVGV4dD5cbiAgICAgIDwvQm94PlxuICAgICAgPEJveD5cbiAgICAgICAgPFRleHQgZGltQ29sb3I+UmVhc29uOiB7cmVhc29ufTwvVGV4dD5cbiAgICAgIDwvQm94PlxuICAgIDwvQm94PlxuICApXG59XG5cbmV4cG9ydCB0eXBlIEF1dG9SdW5Jc3N1ZVJlYXNvbiA9ICdmZWVkYmFja19zdXJ2ZXlfYmFkJyB8ICdmZWVkYmFja19zdXJ2ZXlfZ29vZCdcblxuLyoqXG4gKiBEZXRlcm1pbmVzIGlmIC9pc3N1ZSBzaG91bGQgYXV0by1ydW4gZm9yIEFudCB1c2Vyc1xuICovXG5leHBvcnQgZnVuY3Rpb24gc2hvdWxkQXV0b1J1bklzc3VlKHJlYXNvbjogQXV0b1J1bklzc3VlUmVhc29uKTogYm9vbGVhbiB7XG4gIC8vIE9ubHkgZm9yIEFudCB1c2Vyc1xuICBpZiAoXCJleHRlcm5hbFwiICE9PSAnYW50Jykge1xuICAgIHJldHVybiBmYWxzZVxuICB9XG5cbiAgc3dpdGNoIChyZWFzb24pIHtcbiAgICBjYXNlICdmZWVkYmFja19zdXJ2ZXlfYmFkJzpcbiAgICAgIHJldHVybiBmYWxzZVxuICAgIGNhc2UgJ2ZlZWRiYWNrX3N1cnZleV9nb29kJzpcbiAgICAgIHJldHVybiBmYWxzZVxuICAgIGRlZmF1bHQ6XG4gICAgICByZXR1cm4gZmFsc2VcbiAgfVxufVxuXG4vKipcbiAqIFJldHVybnMgdGhlIGFwcHJvcHJpYXRlIGNvbW1hbmQgdG8gYXV0by1ydW4gYmFzZWQgb24gdGhlIHJlYXNvblxuICogQU5ULU9OTFk6IGdvb2QtY2xhdWRlIGNvbW1hbmQgb25seSBleGlzdHMgaW4gYW50IGJ1aWxkc1xuICovXG5leHBvcnQgZnVuY3Rpb24gZ2V0QXV0b1J1bkNvbW1hbmQocmVhc29uOiBBdXRvUnVuSXNzdWVSZWFzb24pOiBzdHJpbmcge1xuICAvLyBPbmx5IGFudCBidWlsZHMgaGF2ZSB0aGUgL2dvb2QtY2xhdWRlIGNvbW1hbmRcbiAgaWYgKFwiZXh0ZXJuYWxcIiA9PT0gJ2FudCcgJiYgcmVhc29uID09PSAnZmVlZGJhY2tfc3VydmV5X2dvb2QnKSB7XG4gICAgcmV0dXJuICcvZ29vZC1jbGF1ZGUnXG4gIH1cbiAgcmV0dXJuICcvaXNzdWUnXG59XG5cbi8qKlxuICogR2V0cyBhIGh1bWFuLXJlYWRhYmxlIGRlc2NyaXB0aW9uIG9mIHdoeSAvaXNzdWUgaXMgYmVpbmcgYXV0by1ydW5cbiAqL1xuZXhwb3J0IGZ1bmN0aW9uIGdldEF1dG9SdW5Jc3N1ZVJlYXNvblRleHQocmVhc29uOiBBdXRvUnVuSXNzdWVSZWFzb24pOiBzdHJpbmcge1xuICBzd2l0Y2ggKHJlYXNvbikge1xuICAgIGNhc2UgJ2ZlZWRiYWNrX3N1cnZleV9iYWQnOlxuICAgICAgcmV0dXJuICdZb3UgcmVzcG9uZGVkIFwiQmFkXCIgdG8gdGhlIGZlZWRiYWNrIHN1cnZleSdcbiAgICBjYXNlICdmZWVkYmFja19zdXJ2ZXlfZ29vZCc6XG4gICAgICByZXR1cm4gJ1lvdSByZXNwb25kZWQgXCJHb29kXCIgdG8gdGhlIGZlZWRiYWNrIHN1cnZleSdcbiAgICBkZWZhdWx0OlxuICAgICAgcmV0dXJuICdVbmtub3duIHJlYXNvbidcbiAgfVxufVxuIl0sIm1hcHBpbmdzIjoiO0FBQUEsT0FBTyxLQUFLQSxLQUFLLE1BQU0sT0FBTztBQUM5QixTQUFTQyxTQUFTLEVBQUVDLE1BQU0sUUFBUSxPQUFPO0FBQ3pDLFNBQVNDLG9CQUFvQixRQUFRLHFEQUFxRDtBQUMxRixTQUFTQyxHQUFHLEVBQUVDLElBQUksUUFBUSxXQUFXO0FBQ3JDLFNBQVNDLGFBQWEsUUFBUSxpQ0FBaUM7QUFFL0QsS0FBS0MsS0FBSyxHQUFHO0VBQ1hDLEtBQUssRUFBRSxHQUFHLEdBQUcsSUFBSTtFQUNqQkMsUUFBUSxFQUFFLEdBQUcsR0FBRyxJQUFJO0VBQ3BCQyxNQUFNLEVBQUUsTUFBTTtBQUNoQixDQUFDOztBQUVEO0FBQ0E7QUFDQTtBQUNBO0FBQ0EsT0FBTyxTQUFBQyx5QkFBQUMsRUFBQTtFQUFBLE1BQUFDLENBQUEsR0FBQUMsRUFBQTtFQUFrQztJQUFBTixLQUFBO0lBQUFDLFFBQUE7SUFBQUM7RUFBQSxJQUFBRSxFQUlqQztFQUNOLE1BQUFHLFNBQUEsR0FBa0JiLE1BQU0sQ0FBQyxLQUFLLENBQUM7RUFBQSxJQUFBYyxFQUFBO0VBQUEsSUFBQUgsQ0FBQSxRQUFBSSxNQUFBLENBQUFDLEdBQUE7SUFHT0YsRUFBQTtNQUFBRyxPQUFBLEVBQVc7SUFBZSxDQUFDO0lBQUFOLENBQUEsTUFBQUcsRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQUgsQ0FBQTtFQUFBO0VBQWpFUCxhQUFhLENBQUMsWUFBWSxFQUFFRyxRQUFRLEVBQUVPLEVBQTJCLENBQUM7RUFBQSxJQUFBSSxFQUFBO0VBQUEsSUFBQUMsRUFBQTtFQUFBLElBQUFSLENBQUEsUUFBQUwsS0FBQTtJQUd4RFksRUFBQSxHQUFBQSxDQUFBO01BQ1IsSUFBSSxDQUFDTCxTQUFTLENBQUFPLE9BQVE7UUFDcEJQLFNBQVMsQ0FBQU8sT0FBQSxHQUFXLElBQUg7UUFDakJkLEtBQUssQ0FBQyxDQUFDO01BQUE7SUFDUixDQUNGO0lBQUVhLEVBQUEsSUFBQ2IsS0FBSyxDQUFDO0lBQUFLLENBQUEsTUFBQUwsS0FBQTtJQUFBSyxDQUFBLE1BQUFPLEVBQUE7SUFBQVAsQ0FBQSxNQUFBUSxFQUFBO0VBQUE7SUFBQUQsRUFBQSxHQUFBUCxDQUFBO0lBQUFRLEVBQUEsR0FBQVIsQ0FBQTtFQUFBO0VBTFZaLFNBQVMsQ0FBQ21CLEVBS1QsRUFBRUMsRUFBTyxDQUFDO0VBQUEsSUFBQUUsRUFBQTtFQUFBLElBQUFWLENBQUEsUUFBQUksTUFBQSxDQUFBQyxHQUFBO0lBSVBLLEVBQUEsSUFBQyxHQUFHLENBQ0YsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFKLEtBQUcsQ0FBQyxDQUFDLDJCQUEyQixFQUFyQyxJQUFJLENBQ1AsRUFGQyxHQUFHLENBRUU7SUFBQVYsQ0FBQSxNQUFBVSxFQUFBO0VBQUE7SUFBQUEsRUFBQSxHQUFBVixDQUFBO0VBQUE7RUFBQSxJQUFBVyxFQUFBO0VBQUEsSUFBQVgsQ0FBQSxRQUFBSSxNQUFBLENBQUFDLEdBQUE7SUFDTk0sRUFBQSxJQUFDLEdBQUcsQ0FDRixDQUFDLElBQUksQ0FBQyxRQUFRLENBQVIsS0FBTyxDQUFDLENBQUMsTUFDUCxDQUFDLG9CQUFvQixDQUFVLFFBQUssQ0FBTCxLQUFLLENBQVEsTUFBUSxDQUFSLFFBQVEsR0FBRyxRQUMvRCxFQUZDLElBQUksQ0FHUCxFQUpDLEdBQUcsQ0FJRTtJQUFBWCxDQUFBLE1BQUFXLEVBQUE7RUFBQTtJQUFBQSxFQUFBLEdBQUFYLENBQUE7RUFBQTtFQUFBLElBQUFZLEVBQUE7RUFBQSxJQUFBWixDQUFBLFFBQUFILE1BQUE7SUFSUmUsRUFBQSxJQUFDLEdBQUcsQ0FBZSxhQUFRLENBQVIsUUFBUSxDQUFZLFNBQUMsQ0FBRCxHQUFDLENBQ3RDLENBQUFGLEVBRUssQ0FDTCxDQUFBQyxFQUlLLENBQ0wsQ0FBQyxHQUFHLENBQ0YsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFSLEtBQU8sQ0FBQyxDQUFDLFFBQVNkLE9BQUssQ0FBRSxFQUE5QixJQUFJLENBQ1AsRUFGQyxHQUFHLENBR04sRUFaQyxHQUFHLENBWUU7SUFBQUcsQ0FBQSxNQUFBSCxNQUFBO0lBQUFHLENBQUEsTUFBQVksRUFBQTtFQUFBO0lBQUFBLEVBQUEsR0FBQVosQ0FBQTtFQUFBO0VBQUEsT0FaTlksRUFZTTtBQUFBO0FBSVYsT0FBTyxLQUFLQyxrQkFBa0IsR0FBRyxxQkFBcUIsR0FBRyxzQkFBc0I7O0FBRS9FO0FBQ0E7QUFDQTtBQUNBLE9BQU8sU0FBU0Msa0JBQWtCQSxDQUFDakIsTUFBTSxFQUFFZ0Isa0JBQWtCLENBQUMsRUFBRSxPQUFPLENBQUM7RUFDdEU7RUFDQSxJQUFJLFVBQVUsS0FBSyxLQUFLLEVBQUU7SUFDeEIsT0FBTyxLQUFLO0VBQ2Q7RUFFQSxRQUFRaEIsTUFBTTtJQUNaLEtBQUsscUJBQXFCO01BQ3hCLE9BQU8sS0FBSztJQUNkLEtBQUssc0JBQXNCO01BQ3pCLE9BQU8sS0FBSztJQUNkO01BQ0UsT0FBTyxLQUFLO0VBQ2hCO0FBQ0Y7O0FBRUE7QUFDQTtBQUNBO0FBQ0E7QUFDQSxPQUFPLFNBQVNrQixpQkFBaUJBLENBQUNsQixNQUFNLEVBQUVnQixrQkFBa0IsQ0FBQyxFQUFFLE1BQU0sQ0FBQztFQUNwRTtFQUNBLElBQUksVUFBVSxLQUFLLEtBQUssSUFBSWhCLE1BQU0sS0FBSyxzQkFBc0IsRUFBRTtJQUM3RCxPQUFPLGNBQWM7RUFDdkI7RUFDQSxPQUFPLFFBQVE7QUFDakI7O0FBRUE7QUFDQTtBQUNBO0FBQ0EsT0FBTyxTQUFTbUIseUJBQXlCQSxDQUFDbkIsTUFBTSxFQUFFZ0Isa0JBQWtCLENBQUMsRUFBRSxNQUFNLENBQUM7RUFDNUUsUUFBUWhCLE1BQU07SUFDWixLQUFLLHFCQUFxQjtNQUN4QixPQUFPLDRDQUE0QztJQUNyRCxLQUFLLHNCQUFzQjtNQUN6QixPQUFPLDZDQUE2QztJQUN0RDtNQUNFLE9BQU8sZ0JBQWdCO0VBQzNCO0FBQ0YiLCJpZ25vcmVMaXN0IjpbXX0=