kavrix 0.2.2 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,4499 @@
1
+ /*! Kavrix is MIT licensed. Bundled third-party notices:
2
+
3
+ commander@15.0.0 (MIT)
4
+ (The MIT License)
5
+
6
+ Copyright (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
7
+
8
+ Permission is hereby granted, free of charge, to any person obtaining
9
+ a copy of this software and associated documentation files (the
10
+ 'Software'), to deal in the Software without restriction, including
11
+ without limitation the rights to use, copy, modify, merge, publish,
12
+ distribute, sublicense, and/or sell copies of the Software, and to
13
+ permit persons to whom the Software is furnished to do so, subject to
14
+ the following conditions:
15
+
16
+ The above copyright notice and this permission notice shall be
17
+ included in all copies or substantial portions of the Software.
18
+
19
+ THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
20
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
21
+ MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
22
+ IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
23
+ CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
24
+ TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
25
+ SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
26
+
27
+ zod@4.4.3 (MIT)
28
+ MIT License
29
+
30
+ Copyright (c) 2025 Colin McDonnell
31
+
32
+ Permission is hereby granted, free of charge, to any person obtaining a copy
33
+ of this software and associated documentation files (the "Software"), to deal
34
+ in the Software without restriction, including without limitation the rights
35
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
36
+ copies of the Software, and to permit persons to whom the Software is
37
+ furnished to do so, subject to the following conditions:
38
+
39
+ The above copyright notice and this permission notice shall be included in all
40
+ copies or substantial portions of the Software.
41
+
42
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
43
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
44
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
45
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
46
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
47
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
48
+ SOFTWARE.
49
+
50
+ yaml@2.8.3 (ISC)
51
+ Copyright Eemeli Aro <eemeli@gmail.com>
52
+
53
+ Permission to use, copy, modify, and/or distribute this software for any purpose
54
+ with or without fee is hereby granted, provided that the above copyright notice
55
+ and this permission notice appear in all copies.
56
+
57
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
58
+ REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
59
+ FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
60
+ INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
61
+ OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
62
+ TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
63
+ THIS SOFTWARE.
64
+
65
+ mongodb@7.5.0 (Apache-2.0)
66
+ Apache License
67
+ Version 2.0, January 2004
68
+ http://www.apache.org/licenses/
69
+
70
+ TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
71
+
72
+ 1. Definitions.
73
+
74
+ "License" shall mean the terms and conditions for use, reproduction,
75
+ and distribution as defined by Sections 1 through 9 of this document.
76
+
77
+ "Licensor" shall mean the copyright owner or entity authorized by
78
+ the copyright owner that is granting the License.
79
+
80
+ "Legal Entity" shall mean the union of the acting entity and all
81
+ other entities that control, are controlled by, or are under common
82
+ control with that entity. For the purposes of this definition,
83
+ "control" means (i) the power, direct or indirect, to cause the
84
+ direction or management of such entity, whether by contract or
85
+ otherwise, or (ii) ownership of fifty percent (50%) or more of the
86
+ outstanding shares, or (iii) beneficial ownership of such entity.
87
+
88
+ "You" (or "Your") shall mean an individual or Legal Entity
89
+ exercising permissions granted by this License.
90
+
91
+ "Source" form shall mean the preferred form for making modifications,
92
+ including but not limited to software source code, documentation
93
+ source, and configuration files.
94
+
95
+ "Object" form shall mean any form resulting from mechanical
96
+ transformation or translation of a Source form, including but
97
+ not limited to compiled object code, generated documentation,
98
+ and conversions to other media types.
99
+
100
+ "Work" shall mean the work of authorship, whether in Source or
101
+ Object form, made available under the License, as indicated by a
102
+ copyright notice that is included in or attached to the work
103
+ (an example is provided in the Appendix below).
104
+
105
+ "Derivative Works" shall mean any work, whether in Source or Object
106
+ form, that is based on (or derived from) the Work and for which the
107
+ editorial revisions, annotations, elaborations, or other modifications
108
+ represent, as a whole, an original work of authorship. For the purposes
109
+ of this License, Derivative Works shall not include works that remain
110
+ separable from, or merely link (or bind by name) to the interfaces of,
111
+ the Work and Derivative Works thereof.
112
+
113
+ "Contribution" shall mean any work of authorship, including
114
+ the original version of the Work and any modifications or additions
115
+ to that Work or Derivative Works thereof, that is intentionally
116
+ submitted to Licensor for inclusion in the Work by the copyright owner
117
+ or by an individual or Legal Entity authorized to submit on behalf of
118
+ the copyright owner. For the purposes of this definition, "submitted"
119
+ means any form of electronic, verbal, or written communication sent
120
+ to the Licensor or its representatives, including but not limited to
121
+ communication on electronic mailing lists, source code control systems,
122
+ and issue tracking systems that are managed by, or on behalf of, the
123
+ Licensor for the purpose of discussing and improving the Work, but
124
+ excluding communication that is conspicuously marked or otherwise
125
+ designated in writing by the copyright owner as "Not a Contribution."
126
+
127
+ "Contributor" shall mean Licensor and any individual or Legal Entity
128
+ on behalf of whom a Contribution has been received by Licensor and
129
+ subsequently incorporated within the Work.
130
+
131
+ 2. Grant of Copyright License. Subject to the terms and conditions of
132
+ this License, each Contributor hereby grants to You a perpetual,
133
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
134
+ copyright license to reproduce, prepare Derivative Works of,
135
+ publicly display, publicly perform, sublicense, and distribute the
136
+ Work and such Derivative Works in Source or Object form.
137
+
138
+ 3. Grant of Patent License. Subject to the terms and conditions of
139
+ this License, each Contributor hereby grants to You a perpetual,
140
+ worldwide, non-exclusive, no-charge, royalty-free, irrevocable
141
+ (except as stated in this section) patent license to make, have made,
142
+ use, offer to sell, sell, import, and otherwise transfer the Work,
143
+ where such license applies only to those patent claims licensable
144
+ by such Contributor that are necessarily infringed by their
145
+ Contribution(s) alone or by combination of their Contribution(s)
146
+ with the Work to which such Contribution(s) was submitted. If You
147
+ institute patent litigation against any entity (including a
148
+ cross-claim or counterclaim in a lawsuit) alleging that the Work
149
+ or a Contribution incorporated within the Work constitutes direct
150
+ or contributory patent infringement, then any patent licenses
151
+ granted to You under this License for that Work shall terminate
152
+ as of the date such litigation is filed.
153
+
154
+ 4. Redistribution. You may reproduce and distribute copies of the
155
+ Work or Derivative Works thereof in any medium, with or without
156
+ modifications, and in Source or Object form, provided that You
157
+ meet the following conditions:
158
+
159
+ (a) You must give any other recipients of the Work or
160
+ Derivative Works a copy of this License; and
161
+
162
+ (b) You must cause any modified files to carry prominent notices
163
+ stating that You changed the files; and
164
+
165
+ (c) You must retain, in the Source form of any Derivative Works
166
+ that You distribute, all copyright, patent, trademark, and
167
+ attribution notices from the Source form of the Work,
168
+ excluding those notices that do not pertain to any part of
169
+ the Derivative Works; and
170
+
171
+ (d) If the Work includes a "NOTICE" text file as part of its
172
+ distribution, then any Derivative Works that You distribute must
173
+ include a readable copy of the attribution notices contained
174
+ within such NOTICE file, excluding those notices that do not
175
+ pertain to any part of the Derivative Works, in at least one
176
+ of the following places: within a NOTICE text file distributed
177
+ as part of the Derivative Works; within the Source form or
178
+ documentation, if provided along with the Derivative Works; or,
179
+ within a display generated by the Derivative Works, if and
180
+ wherever such third-party notices normally appear. The contents
181
+ of the NOTICE file are for informational purposes only and
182
+ do not modify the License. You may add Your own attribution
183
+ notices within Derivative Works that You distribute, alongside
184
+ or as an addendum to the NOTICE text from the Work, provided
185
+ that such additional attribution notices cannot be construed
186
+ as modifying the License.
187
+
188
+ You may add Your own copyright statement to Your modifications and
189
+ may provide additional or different license terms and conditions
190
+ for use, reproduction, or distribution of Your modifications, or
191
+ for any such Derivative Works as a whole, provided Your use,
192
+ reproduction, and distribution of the Work otherwise complies with
193
+ the conditions stated in this License.
194
+
195
+ 5. Submission of Contributions. Unless You explicitly state otherwise,
196
+ any Contribution intentionally submitted for inclusion in the Work
197
+ by You to the Licensor shall be under the terms and conditions of
198
+ this License, without any additional terms or conditions.
199
+ Notwithstanding the above, nothing herein shall supersede or modify
200
+ the terms of any separate license agreement you may have executed
201
+ with Licensor regarding such Contributions.
202
+
203
+ 6. Trademarks. This License does not grant permission to use the trade
204
+ names, trademarks, service marks, or product names of the Licensor,
205
+ except as required for reasonable and customary use in describing the
206
+ origin of the Work and reproducing the content of the NOTICE file.
207
+
208
+ 7. Disclaimer of Warranty. Unless required by applicable law or
209
+ agreed to in writing, Licensor provides the Work (and each
210
+ Contributor provides its Contributions) on an "AS IS" BASIS,
211
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
212
+ implied, including, without limitation, any warranties or conditions
213
+ of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
214
+ PARTICULAR PURPOSE. You are solely responsible for determining the
215
+ appropriateness of using or redistributing the Work and assume any
216
+ risks associated with Your exercise of permissions under this License.
217
+
218
+ 8. Limitation of Liability. In no event and under no legal theory,
219
+ whether in tort (including negligence), contract, or otherwise,
220
+ unless required by applicable law (such as deliberate and grossly
221
+ negligent acts) or agreed to in writing, shall any Contributor be
222
+ liable to You for damages, including any direct, indirect, special,
223
+ incidental, or consequential damages of any character arising as a
224
+ result of this License or out of the use or inability to use the
225
+ Work (including but not limited to damages for loss of goodwill,
226
+ work stoppage, computer failure or malfunction, or any and all
227
+ other commercial damages or losses), even if such Contributor
228
+ has been advised of the possibility of such damages.
229
+
230
+ 9. Accepting Warranty or Additional Liability. While redistributing
231
+ the Work or Derivative Works thereof, You may choose to offer,
232
+ and charge a fee for, acceptance of support, warranty, indemnity,
233
+ or other liability obligations and/or rights consistent with this
234
+ License. However, in accepting such obligations, You may act only
235
+ on Your own behalf and on Your sole responsibility, not on behalf
236
+ of any other Contributor, and only if You agree to indemnify,
237
+ defend, and hold each Contributor harmless for any liability
238
+ incurred by, or claims asserted against, such Contributor by reason
239
+ of your accepting any such warranty or additional liability.
240
+
241
+ END OF TERMS AND CONDITIONS
242
+
243
+ APPENDIX: How to apply the Apache License to your work.
244
+
245
+ To apply the Apache License to your work, attach the following
246
+ boilerplate notice, with the fields enclosed by brackets "{}"
247
+ replaced with your own identifying information. (Don't include
248
+ the brackets!) The text should be enclosed in the appropriate
249
+ comment syntax for the file format. We also recommend that a
250
+ file or class name and description of purpose be included on the
251
+ same "printed page" as the copyright notice for easier
252
+ identification within third-party archives.
253
+
254
+ Copyright {yyyy} {name of copyright owner}
255
+
256
+ Licensed under the Apache License, Version 2.0 (the "License");
257
+ you may not use this file except in compliance with the License.
258
+ You may obtain a copy of the License at
259
+
260
+ http://www.apache.org/licenses/LICENSE-2.0
261
+
262
+ Unless required by applicable law or agreed to in writing, software
263
+ distributed under the License is distributed on an "AS IS" BASIS,
264
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
265
+ See the License for the specific language governing permissions and
266
+ limitations under the License.
267
+
268
+ libsodium-wrappers@0.8.4 (ISC)
269
+ Copyright (c) 2015-2026
270
+ Ahmad Ben Mrad <batikhsouri at gmail dot org>
271
+ Frank Denis <j at pureftpd dot org>
272
+ Ryan Lester <ryan at cyph dot com>
273
+
274
+ Permission to use, copy, modify, and/or distribute this software for any
275
+ purpose with or without fee is hereby granted, provided that the above
276
+ copyright notice and this permission notice appear in all copies.
277
+
278
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
279
+ WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
280
+ MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
281
+ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
282
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
283
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
284
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
285
+
286
+ libsodium@0.8.4 (ISC)
287
+ Copyright (c) 2015-2026
288
+ Ahmad Ben Mrad <batikhsouri at gmail dot org>
289
+ Frank Denis <j at pureftpd dot org>
290
+ Ryan Lester <ryan at cyph dot com>
291
+
292
+ Permission to use, copy, modify, and/or distribute this software for any
293
+ purpose with or without fee is hereby granted, provided that the above
294
+ copyright notice and this permission notice appear in all copies.
295
+
296
+ THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
297
+ WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
298
+ MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
299
+ ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
300
+ WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
301
+ ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
302
+ OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
303
+
304
+ ink@7.1.1 (MIT)
305
+ MIT License
306
+
307
+ Copyright (c) Vadym Demedes <vadimdemedes@hey.com> (https://github.com/vadimdemedes)
308
+ Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
309
+
310
+ Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
311
+
312
+ The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
313
+
314
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
315
+
316
+ react@19.2.8 (MIT)
317
+ MIT License
318
+
319
+ Copyright (c) Meta Platforms, Inc. and affiliates.
320
+
321
+ Permission is hereby granted, free of charge, to any person obtaining a copy
322
+ of this software and associated documentation files (the "Software"), to deal
323
+ in the Software without restriction, including without limitation the rights
324
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
325
+ copies of the Software, and to permit persons to whom the Software is
326
+ furnished to do so, subject to the following conditions:
327
+
328
+ The above copyright notice and this permission notice shall be included in all
329
+ copies or substantial portions of the Software.
330
+
331
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
332
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
333
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
334
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
335
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
336
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
337
+ SOFTWARE.
338
+
339
+ smol-toml@1.3.1 (BSD-3-Clause)
340
+ Copyright (c) Squirrel Chat et al., All rights reserved.
341
+
342
+ Redistribution and use in source and binary forms, with or without
343
+ modification, are permitted provided that the following conditions are met:
344
+
345
+ 1. Redistributions of source code must retain the above copyright notice, this
346
+ list of conditions and the following disclaimer.
347
+ 2. Redistributions in binary form must reproduce the above copyright notice,
348
+ this list of conditions and the following disclaimer in the
349
+ documentation and/or other materials provided with the distribution.
350
+ 3. Neither the name of the copyright holder nor the names of its contributors
351
+ may be used to endorse or promote products derived from this software without
352
+ specific prior written permission.
353
+
354
+ THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
355
+ ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
356
+ WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
357
+ DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
358
+ FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
359
+ DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
360
+ SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
361
+ CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
362
+ OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
363
+ OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
364
+ */
365
+ import { createRequire as __kavrixCreateRequire } from 'node:module';
366
+ const __kavrixNodeRequire = __kavrixCreateRequire(import.meta.url);
367
+ const __kavrixNodeBuiltin = (name) => __kavrixNodeRequire(`node:${name}`);
368
+ import {
369
+ external_exports
370
+ } from "./chunk-D4JYLAAS.js";
371
+
372
+ // ../../packages/schemas/dist/identifiers.js
373
+ var MIN_OPAQUE_ID_CHARS = 1;
374
+ var MAX_OPAQUE_ID_CHARS = 128;
375
+ var OPAQUE_ID_PATTERN_SOURCE = "^[A-Za-z0-9][A-Za-z0-9._~-]*$";
376
+ var opaqueIdPattern = new RegExp(OPAQUE_ID_PATTERN_SOURCE);
377
+ var opaqueId = external_exports.string().min(MIN_OPAQUE_ID_CHARS).max(MAX_OPAQUE_ID_CHARS).regex(opaqueIdPattern, "Must be an opaque identifier");
378
+ var vaultIdSchema = opaqueId.brand();
379
+ var databaseIdSchema = opaqueId.brand();
380
+ var profileIdSchema = opaqueId.brand();
381
+ var keySlotIdSchema = opaqueId.brand();
382
+ var groupIdSchema = opaqueId.brand();
383
+ var itemIdSchema = opaqueId.brand();
384
+ var fieldIdSchema = opaqueId.brand();
385
+ var noteIdSchema = opaqueId.brand();
386
+ var templateIdSchema = opaqueId.brand();
387
+ var templateMigrationIdSchema = opaqueId.brand();
388
+ var deviceIdSchema = opaqueId.brand();
389
+ var changeIdSchema = opaqueId.brand();
390
+ var auditEventIdSchema = opaqueId.brand();
391
+ var attachmentIdSchema = opaqueId.brand();
392
+ var historyIdSchema = opaqueId.brand();
393
+ var inviteIdSchema = opaqueId.brand();
394
+ var policyIdSchema = opaqueId.brand();
395
+ var grantIdSchema = opaqueId.brand();
396
+
397
+ // ../../packages/schemas/dist/primitives.js
398
+ var MAX_TEXT_BYTES = 1048576;
399
+ var MAX_CIPHERTEXT_CHARS = 22369632;
400
+ var MAX_SEMANTIC_VERSION = 4294967295;
401
+ var MAX_SEMANTIC_REVISION = Number.MAX_SAFE_INTEGER;
402
+ var textEncoder = new TextEncoder();
403
+ function utf8ByteLength(value) {
404
+ return textEncoder.encode(value).byteLength;
405
+ }
406
+ var maxTextBytesSchema = external_exports.string().superRefine((value, context) => {
407
+ if (value.length > MAX_TEXT_BYTES || utf8ByteLength(value) > MAX_TEXT_BYTES) {
408
+ context.addIssue({
409
+ code: "too_big",
410
+ origin: "string",
411
+ maximum: MAX_TEXT_BYTES,
412
+ inclusive: true,
413
+ message: `Too big: expected string to have <=${String(MAX_TEXT_BYTES)} bytes`
414
+ });
415
+ }
416
+ });
417
+ var CURRENT_SCHEMA_VERSION = 1;
418
+ var SUPPORTED_SCHEMA_VERSIONS = Object.freeze([
419
+ CURRENT_SCHEMA_VERSION
420
+ ]);
421
+ var CURRENT_CRYPTOGRAPHIC_VERSION = 1;
422
+ var SUPPORTED_CRYPTOGRAPHIC_VERSIONS = Object.freeze([
423
+ CURRENT_CRYPTOGRAPHIC_VERSION
424
+ ]);
425
+ var CURRENT_TOKEN_VERSION = 1;
426
+ var SUPPORTED_TOKEN_VERSIONS = Object.freeze([CURRENT_TOKEN_VERSION]);
427
+ var CANONICAL_BASE64URL_PATTERN_SOURCE = "^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-][AQgw]|[A-Za-z0-9_-]{2}[AEIMQUYcgkosw048])?$";
428
+ var CANONICAL_TIMESTAMP_CHARS = 24;
429
+ var CANONICAL_TIMESTAMP_PATTERN_SOURCE = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$";
430
+ var SHA256_DIGEST_BASE64URL_CHARS = 43;
431
+ var canonicalBase64UrlPattern = new RegExp(CANONICAL_BASE64URL_PATTERN_SOURCE);
432
+ var canonicalTimestampPattern = new RegExp(CANONICAL_TIMESTAMP_PATTERN_SOURCE);
433
+ function hasCanonicalBase64UrlTerminalBits(value) {
434
+ if (value.length === 0)
435
+ return false;
436
+ const remainder = value.length % 4;
437
+ if (remainder === 1)
438
+ return false;
439
+ const tailLength = remainder === 0 ? Math.min(value.length, 4) : remainder;
440
+ return canonicalBase64UrlPattern.test(value.slice(-tailLength));
441
+ }
442
+ var timestampSchema = external_exports.iso.datetime({ offset: false, precision: 3 }).length(CANONICAL_TIMESTAMP_CHARS).regex(canonicalTimestampPattern);
443
+ var revisionSchema = external_exports.number().int().nonnegative().brand();
444
+ var positiveVersionSchema = external_exports.number().int().positive().max(MAX_SEMANTIC_VERSION).brand();
445
+ var semanticVersionSchema = external_exports.number().int().positive().max(MAX_SEMANTIC_VERSION);
446
+ var semanticRevisionSchema = external_exports.number().int().nonnegative().max(MAX_SEMANTIC_REVISION);
447
+ var schemaVersionSchema = semanticVersionSchema.brand();
448
+ var keyVersionSchema = semanticVersionSchema.brand();
449
+ var templateVersionSchema = semanticVersionSchema.brand();
450
+ var tokenVersionSchema = semanticVersionSchema.brand();
451
+ var cryptographicVersionSchema = semanticVersionSchema.brand();
452
+ var supportedSchemaVersionSchema = schemaVersionSchema.refine((value) => SUPPORTED_SCHEMA_VERSIONS.some((supported) => value === supported), { error: "Unsupported schema version" });
453
+ var supportedCryptographicVersionSchema = cryptographicVersionSchema.refine((value) => SUPPORTED_CRYPTOGRAPHIC_VERSIONS.some((supported) => value === supported), { error: "Unsupported cryptographic version" });
454
+ var supportedTokenVersionSchema = tokenVersionSchema.refine((value) => SUPPORTED_TOKEN_VERSIONS.some((supported) => value === supported), { error: "Unsupported token version" });
455
+ var recordRevisionSchema = semanticRevisionSchema.brand();
456
+ var vaultRevisionSchema = semanticRevisionSchema.brand();
457
+ var changeSequenceSchema = semanticRevisionSchema.brand();
458
+ var envelopeVersionSchema = external_exports.literal(1).brand();
459
+ var associatedDataVersionSchema = external_exports.literal(1).brand();
460
+ var keySlotVersionSchema = external_exports.literal(1).brand();
461
+ var sortOrderSchema = external_exports.number().int().nonnegative();
462
+ var nonEmptyTextSchema = external_exports.string().trim().min(1).max(256);
463
+ var encryptedTextSchema = maxTextBytesSchema;
464
+ var secretValueSchema = maxTextBytesSchema.brand();
465
+ var secretBytesSchema = external_exports.instanceof(Uint8Array).refine((value) => value.byteLength > 0 && value.byteLength <= MAX_TEXT_BYTES, {
466
+ error: "Secret byte length is outside the supported range"
467
+ }).brand();
468
+ var base64UrlSchema = external_exports.string().min(1).max(MAX_CIPHERTEXT_CHARS).regex(/^[A-Za-z0-9_-]+$/, "Must use unpadded base64url encoding").refine(hasCanonicalBase64UrlTerminalBits, {
469
+ error: "Must use canonical unpadded base64url encoding"
470
+ }).refine((value) => Buffer.from(value, "base64url").toString("base64url") === value, {
471
+ error: "Must use canonical unpadded base64url encoding"
472
+ });
473
+ var sha256DigestSchema = base64UrlSchema.length(SHA256_DIGEST_BASE64URL_CHARS).refine((value) => Buffer.from(value, "base64url").byteLength === 32, {
474
+ error: "SHA-256 digests must canonically encode exactly 32 bytes"
475
+ }).brand();
476
+ var slugSchema = external_exports.string().trim().min(1).max(128).regex(/^[\p{L}\p{N}](?:[\p{L}\p{N}._~-]|-(?!-))*$/u, "Invalid slug");
477
+
478
+ // ../../packages/schemas/dist/encrypted-records.js
479
+ var encryptedEntityTypeSchema = external_exports.enum([
480
+ "vault-preferences",
481
+ "group",
482
+ "item",
483
+ "attachment",
484
+ "attachment-chunk",
485
+ "audit-event",
486
+ "history",
487
+ "device-label",
488
+ "wrapped-root-key",
489
+ "wrapped-group-key",
490
+ "wrapped-item-key",
491
+ "wrapped-attachment-key"
492
+ ]);
493
+ var encryptedPayloadPurposeSchema = external_exports.enum([
494
+ "vault-preferences",
495
+ "group-payload",
496
+ "item-payload",
497
+ "attachment-metadata",
498
+ "attachment-chunk",
499
+ "audit-event",
500
+ "history-event",
501
+ "device-label",
502
+ "vrk-slot",
503
+ "group-key",
504
+ "item-key",
505
+ "attachment-key"
506
+ ]);
507
+ var AEAD_NONCE_BASE64URL_CHARS = 32;
508
+ var AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS = 22;
509
+ var associatedDataBaseSchema = external_exports.object({
510
+ version: associatedDataVersionSchema,
511
+ schemaVersion: schemaVersionSchema,
512
+ keyVersion: keyVersionSchema,
513
+ vaultId: vaultIdSchema,
514
+ revision: vaultRevisionSchema.optional(),
515
+ metadataDigest: sha256DigestSchema.optional()
516
+ }).strict();
517
+ var unboundAssociatedData = {
518
+ groupId: external_exports.undefined().optional(),
519
+ parentId: external_exports.undefined().optional()
520
+ };
521
+ var associatedDataSchema = external_exports.discriminatedUnion("entityType", [
522
+ associatedDataBaseSchema.extend({
523
+ entityType: external_exports.literal("vault-preferences"),
524
+ entityId: vaultIdSchema,
525
+ purpose: external_exports.literal("vault-preferences"),
526
+ ...unboundAssociatedData
527
+ }),
528
+ associatedDataBaseSchema.extend({
529
+ entityType: external_exports.literal("group"),
530
+ entityId: groupIdSchema,
531
+ purpose: external_exports.literal("group-payload"),
532
+ ...unboundAssociatedData
533
+ }),
534
+ associatedDataBaseSchema.extend({
535
+ entityType: external_exports.literal("item"),
536
+ entityId: itemIdSchema,
537
+ purpose: external_exports.literal("item-payload"),
538
+ groupId: groupIdSchema,
539
+ parentId: external_exports.undefined().optional()
540
+ }),
541
+ associatedDataBaseSchema.extend({
542
+ entityType: external_exports.literal("attachment"),
543
+ entityId: attachmentIdSchema,
544
+ purpose: external_exports.literal("attachment-metadata"),
545
+ groupId: groupIdSchema,
546
+ parentId: itemIdSchema
547
+ }),
548
+ associatedDataBaseSchema.extend({
549
+ entityType: external_exports.literal("attachment-chunk"),
550
+ entityId: attachmentIdSchema,
551
+ purpose: external_exports.literal("attachment-chunk"),
552
+ groupId: groupIdSchema,
553
+ parentId: itemIdSchema
554
+ }),
555
+ associatedDataBaseSchema.extend({
556
+ entityType: external_exports.literal("audit-event"),
557
+ entityId: auditEventIdSchema,
558
+ purpose: external_exports.literal("audit-event"),
559
+ ...unboundAssociatedData
560
+ }),
561
+ associatedDataBaseSchema.extend({
562
+ entityType: external_exports.literal("history"),
563
+ entityId: historyIdSchema,
564
+ purpose: external_exports.literal("history-event"),
565
+ groupId: groupIdSchema,
566
+ parentId: itemIdSchema
567
+ }),
568
+ associatedDataBaseSchema.extend({
569
+ entityType: external_exports.literal("device-label"),
570
+ entityId: deviceIdSchema,
571
+ purpose: external_exports.literal("device-label"),
572
+ ...unboundAssociatedData
573
+ }),
574
+ associatedDataBaseSchema.extend({
575
+ entityType: external_exports.literal("wrapped-root-key"),
576
+ entityId: keySlotIdSchema,
577
+ purpose: external_exports.literal("vrk-slot"),
578
+ ...unboundAssociatedData
579
+ }),
580
+ associatedDataBaseSchema.extend({
581
+ entityType: external_exports.literal("wrapped-group-key"),
582
+ entityId: groupIdSchema,
583
+ purpose: external_exports.literal("group-key"),
584
+ ...unboundAssociatedData
585
+ }),
586
+ associatedDataBaseSchema.extend({
587
+ entityType: external_exports.literal("wrapped-item-key"),
588
+ entityId: itemIdSchema,
589
+ purpose: external_exports.literal("item-key"),
590
+ groupId: groupIdSchema,
591
+ parentId: external_exports.undefined().optional()
592
+ }),
593
+ associatedDataBaseSchema.extend({
594
+ entityType: external_exports.literal("wrapped-attachment-key"),
595
+ entityId: attachmentIdSchema,
596
+ purpose: external_exports.literal("attachment-key"),
597
+ groupId: groupIdSchema,
598
+ parentId: itemIdSchema
599
+ })
600
+ ]);
601
+ var currentAssociatedDataSchema = associatedDataSchema.superRefine((associatedData, context) => {
602
+ if (!supportedSchemaVersionSchema.safeParse(associatedData.schemaVersion).success) {
603
+ context.addIssue({
604
+ code: "custom",
605
+ message: "Current envelopes require a supported schema version",
606
+ path: ["schemaVersion"]
607
+ });
608
+ }
609
+ });
610
+ var aeadEnvelopeSchema = external_exports.object({
611
+ version: envelopeVersionSchema,
612
+ algorithm: external_exports.literal("xchacha20-poly1305-ietf"),
613
+ nonce: base64UrlSchema,
614
+ ciphertext: base64UrlSchema,
615
+ authenticationTag: base64UrlSchema,
616
+ aad: currentAssociatedDataSchema,
617
+ keyVersion: keyVersionSchema
618
+ }).strict().superRefine((envelope, context) => {
619
+ if (envelope.nonce.length !== AEAD_NONCE_BASE64URL_CHARS) {
620
+ context.addIssue({
621
+ code: "custom",
622
+ message: "Nonce length does not match the authenticated-encryption algorithm",
623
+ path: ["nonce"]
624
+ });
625
+ }
626
+ if (envelope.authenticationTag.length !== AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS) {
627
+ context.addIssue({
628
+ code: "custom",
629
+ message: "Authentication tag must encode 16 bytes",
630
+ path: ["authenticationTag"]
631
+ });
632
+ }
633
+ if (envelope.keyVersion !== envelope.aad.keyVersion) {
634
+ context.addIssue({
635
+ code: "custom",
636
+ message: "Envelope key version must be authenticated in associated data",
637
+ path: ["keyVersion"]
638
+ });
639
+ }
640
+ });
641
+ var MAX_ENCRYPTED_DEVICE_LABEL_CIPHERTEXT_CHARS = 4096;
642
+ var encryptedDeviceLabelSchema = aeadEnvelopeSchema.superRefine((envelope, context) => {
643
+ if (envelope.ciphertext.length > MAX_ENCRYPTED_DEVICE_LABEL_CIPHERTEXT_CHARS) {
644
+ context.addIssue({
645
+ code: "custom",
646
+ message: "Encrypted device-label ciphertext exceeds the canonical bound",
647
+ path: ["ciphertext"]
648
+ });
649
+ }
650
+ if (envelope.aad.entityType !== "device-label") {
651
+ context.addIssue({
652
+ code: "custom",
653
+ message: "Encrypted device labels require device-label associated data",
654
+ path: ["aad"]
655
+ });
656
+ }
657
+ });
658
+ var MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES = 8 * 1024 * 1024;
659
+ var SECRETSTREAM_CHUNK_OVERHEAD_BYTES = 17;
660
+ var MAX_ATTACHMENT_CHUNKS = 1e6;
661
+ var MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES = 4 * 1024 * 1024 * 1024;
662
+ var MAX_ATTACHMENT_CHUNK_CIPHERTEXT_BYTES = MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES + SECRETSTREAM_CHUNK_OVERHEAD_BYTES;
663
+ var MAX_ATTACHMENT_STREAM_CIPHERTEXT_BYTES = MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES + MAX_ATTACHMENT_CHUNKS * SECRETSTREAM_CHUNK_OVERHEAD_BYTES;
664
+ var SECRETSTREAM_HEADER_BASE64URL_CHARS = 32;
665
+ var MIN_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS = Math.ceil(SECRETSTREAM_CHUNK_OVERHEAD_BYTES * 4 / 3);
666
+ var MAX_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS = Math.ceil(MAX_ATTACHMENT_CHUNK_CIPHERTEXT_BYTES * 4 / 3);
667
+ var secretStreamHeaderSchema = base64UrlSchema.length(SECRETSTREAM_HEADER_BASE64URL_CHARS).refine((value) => Buffer.from(value, "base64url").byteLength === 24, {
668
+ error: "Secretstream headers must canonically encode exactly 24 bytes"
669
+ });
670
+ var attachmentChunkCiphertextSchema = base64UrlSchema.min(MIN_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS).max(MAX_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS).refine((value) => {
671
+ const byteLength = Buffer.from(value, "base64url").byteLength;
672
+ return byteLength >= SECRETSTREAM_CHUNK_OVERHEAD_BYTES && byteLength <= MAX_ATTACHMENT_CHUNK_CIPHERTEXT_BYTES;
673
+ }, { error: "Attachment chunk ciphertext is outside the canonical byte bounds" }).brand();
674
+ var attachmentSecretStreamIdentitySchema = external_exports.object({
675
+ version: external_exports.literal(1),
676
+ algorithm: external_exports.literal("secretstream-xchacha20-poly1305"),
677
+ streamVersion: external_exports.literal(1),
678
+ schemaVersion: supportedSchemaVersionSchema,
679
+ keyVersion: keyVersionSchema,
680
+ vaultId: vaultIdSchema,
681
+ groupId: groupIdSchema,
682
+ itemId: itemIdSchema,
683
+ attachmentId: attachmentIdSchema
684
+ });
685
+ var attachmentSecretStreamHeaderRecordSchema = attachmentSecretStreamIdentitySchema.extend({
686
+ recordType: external_exports.literal("header"),
687
+ header: secretStreamHeaderSchema
688
+ }).strict();
689
+ var attachmentSecretStreamChunkRecordSchema = attachmentSecretStreamIdentitySchema.extend({
690
+ recordType: external_exports.literal("chunk"),
691
+ index: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS - 1),
692
+ ciphertext: attachmentChunkCiphertextSchema,
693
+ tag: external_exports.enum(["message", "final"])
694
+ }).strict();
695
+ var attachmentSecretStreamRecordSchema = external_exports.discriminatedUnion("recordType", [
696
+ attachmentSecretStreamHeaderRecordSchema,
697
+ attachmentSecretStreamChunkRecordSchema
698
+ ]);
699
+ var persistedAttachmentHeaderRecordSchema = external_exports.object({
700
+ entityType: external_exports.literal("attachment-header"),
701
+ record: attachmentSecretStreamHeaderRecordSchema,
702
+ recordRevision: recordRevisionSchema,
703
+ contentHash: sha256DigestSchema,
704
+ createdAt: timestampSchema,
705
+ updatedAt: timestampSchema
706
+ }).strict();
707
+ var persistedAttachmentChunkRecordSchema = external_exports.object({
708
+ entityType: external_exports.literal("attachment-chunk"),
709
+ record: attachmentSecretStreamChunkRecordSchema,
710
+ plaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES),
711
+ recordRevision: recordRevisionSchema,
712
+ ciphertextHash: sha256DigestSchema,
713
+ createdAt: timestampSchema,
714
+ updatedAt: timestampSchema
715
+ }).strict().superRefine((chunk, context) => {
716
+ const ciphertextBytes = Buffer.from(chunk.record.ciphertext, "base64url").byteLength;
717
+ if (ciphertextBytes !== chunk.plaintextBytes + SECRETSTREAM_CHUNK_OVERHEAD_BYTES) {
718
+ context.addIssue({
719
+ code: "custom",
720
+ message: "Chunk ciphertext length must equal plaintext plus stream overhead",
721
+ path: ["plaintextBytes"]
722
+ });
723
+ }
724
+ });
725
+ var attachmentSecretStreamManifestSchema = attachmentSecretStreamIdentitySchema.extend({
726
+ manifestVersion: external_exports.literal(1),
727
+ header: secretStreamHeaderSchema,
728
+ chunkCount: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
729
+ totalPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES),
730
+ plaintextSha256: sha256DigestSchema
731
+ }).strict();
732
+ var HKDF_SALT_BASE64URL_CHARS = 43;
733
+ var ARGON2ID_SALT_BASE64URL_CHARS = 22;
734
+ var KEY_DERIVATION_OUTPUT_BYTES = 32;
735
+ var MIN_ARGON2_MEMORY_KIB = 65536;
736
+ var MAX_ARGON2_MEMORY_KIB = 1048576;
737
+ var MIN_ARGON2_PASSES = 3;
738
+ var MAX_ARGON2_PASSES = 64;
739
+ var MIN_ARGON2_PARALLELISM = 4;
740
+ var MAX_ARGON2_PARALLELISM = 32;
741
+ var MAX_DEVICE_KEY_PROVIDER_CHARS = 128;
742
+ var hkdfSaltSchema = base64UrlSchema.length(HKDF_SALT_BASE64URL_CHARS);
743
+ var argon2idSaltSchema = base64UrlSchema.length(ARGON2ID_SALT_BASE64URL_CHARS);
744
+ var portableKeyDerivationSchema = external_exports.object({
745
+ algorithm: external_exports.literal("hkdf-sha256"),
746
+ version: external_exports.literal(1),
747
+ salt: hkdfSaltSchema,
748
+ context: external_exports.literal("credvault/v1/portable-key-wrap"),
749
+ outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES)
750
+ }).strict();
751
+ var passphraseDerivationSchema = external_exports.object({
752
+ algorithm: external_exports.literal("argon2id"),
753
+ version: external_exports.literal(1),
754
+ salt: argon2idSaltSchema,
755
+ memoryKiB: external_exports.number().int().min(MIN_ARGON2_MEMORY_KIB).max(MAX_ARGON2_MEMORY_KIB),
756
+ passes: external_exports.number().int().min(MIN_ARGON2_PASSES).max(MAX_ARGON2_PASSES),
757
+ parallelism: external_exports.number().int().min(MIN_ARGON2_PARALLELISM).max(MAX_ARGON2_PARALLELISM),
758
+ outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES)
759
+ }).strict();
760
+ var recoveryKeyDerivationSchema = external_exports.object({
761
+ algorithm: external_exports.literal("hkdf-sha256"),
762
+ version: external_exports.literal(1),
763
+ salt: hkdfSaltSchema,
764
+ context: external_exports.literal("credvault/v1/recovery-key-wrap"),
765
+ outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES)
766
+ }).strict();
767
+ var deviceKeyDerivationSchema = external_exports.object({
768
+ algorithm: external_exports.literal("hkdf-sha256"),
769
+ version: external_exports.literal(1),
770
+ salt: hkdfSaltSchema,
771
+ context: external_exports.literal("credvault/v1/device-key-wrap"),
772
+ outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES),
773
+ provider: external_exports.string().min(1).max(MAX_DEVICE_KEY_PROVIDER_CHARS)
774
+ }).strict();
775
+ var MIN_VAULT_KEY_SLOTS = 1;
776
+ var MAX_VAULT_KEY_SLOTS = 128;
777
+ var keySlotBaseSchema = external_exports.object({
778
+ slotVersion: keySlotVersionSchema,
779
+ id: keySlotIdSchema,
780
+ state: external_exports.enum(["pending", "active", "superseded", "revoked"]),
781
+ keyVersion: keyVersionSchema,
782
+ wrappedRootKey: aeadEnvelopeSchema,
783
+ createdAt: timestampSchema,
784
+ supersededAt: timestampSchema.optional(),
785
+ revokedAt: timestampSchema.optional()
786
+ });
787
+ var keySlotSchema = external_exports.discriminatedUnion("type", [
788
+ keySlotBaseSchema.extend({
789
+ type: external_exports.literal("portable-key"),
790
+ derivation: portableKeyDerivationSchema
791
+ }).strict(),
792
+ keySlotBaseSchema.extend({
793
+ type: external_exports.literal("passphrase"),
794
+ derivation: passphraseDerivationSchema
795
+ }).strict(),
796
+ keySlotBaseSchema.extend({
797
+ type: external_exports.literal("recovery-key"),
798
+ derivation: recoveryKeyDerivationSchema
799
+ }).strict(),
800
+ keySlotBaseSchema.extend({
801
+ type: external_exports.literal("device-key"),
802
+ derivation: deviceKeyDerivationSchema,
803
+ deviceId: deviceIdSchema
804
+ }).strict()
805
+ ]).superRefine((slot, context) => {
806
+ if (slot.wrappedRootKey.aad.entityType !== "wrapped-root-key") {
807
+ context.addIssue({
808
+ code: "custom",
809
+ message: "Key slot envelope must be bound as a wrapped root key",
810
+ path: ["wrappedRootKey", "aad", "entityType"]
811
+ });
812
+ }
813
+ if (slot.wrappedRootKey.aad.entityId !== slot.id) {
814
+ context.addIssue({
815
+ code: "custom",
816
+ message: "Key slot envelope is bound to a different slot",
817
+ path: ["wrappedRootKey", "aad", "entityId"]
818
+ });
819
+ }
820
+ if (slot.wrappedRootKey.keyVersion !== slot.keyVersion) {
821
+ context.addIssue({
822
+ code: "custom",
823
+ message: "Wrapped root-key version does not match its slot",
824
+ path: ["wrappedRootKey", "keyVersion"]
825
+ });
826
+ }
827
+ if (slot.state === "revoked" && slot.revokedAt === void 0) {
828
+ context.addIssue({
829
+ code: "custom",
830
+ message: "Revoked slots require a timestamp",
831
+ path: ["revokedAt"]
832
+ });
833
+ }
834
+ if (slot.state !== "revoked" && slot.revokedAt !== void 0) {
835
+ context.addIssue({
836
+ code: "custom",
837
+ message: "Only revoked slots may have a revoked timestamp",
838
+ path: ["revokedAt"]
839
+ });
840
+ }
841
+ if (slot.state === "superseded" && slot.supersededAt === void 0) {
842
+ context.addIssue({
843
+ code: "custom",
844
+ message: "Superseded slots require a timestamp",
845
+ path: ["supersededAt"]
846
+ });
847
+ }
848
+ if (slot.state !== "superseded" && slot.supersededAt !== void 0) {
849
+ context.addIssue({
850
+ code: "custom",
851
+ message: "Only superseded slots may have a superseded timestamp",
852
+ path: ["supersededAt"]
853
+ });
854
+ }
855
+ });
856
+ var vaultRecordSchema = external_exports.object({
857
+ id: vaultIdSchema,
858
+ schemaVersion: supportedSchemaVersionSchema,
859
+ cryptographicVersion: supportedCryptographicVersionSchema,
860
+ keySlots: external_exports.array(keySlotSchema).min(MIN_VAULT_KEY_SLOTS).max(MAX_VAULT_KEY_SLOTS),
861
+ currentKeyVersion: keyVersionSchema,
862
+ revision: vaultRevisionSchema,
863
+ encryptedPreferences: aeadEnvelopeSchema,
864
+ createdAt: timestampSchema,
865
+ updatedAt: timestampSchema
866
+ }).strict().superRefine((vault, context) => {
867
+ const ids = /* @__PURE__ */ new Set();
868
+ for (const [index, slot] of vault.keySlots.entries()) {
869
+ if (slot.wrappedRootKey.aad.vaultId !== vault.id) {
870
+ context.addIssue({
871
+ code: "custom",
872
+ message: "Key slot belongs to a different vault",
873
+ path: ["keySlots", index, "wrappedRootKey", "aad", "vaultId"]
874
+ });
875
+ }
876
+ if (slot.wrappedRootKey.aad.schemaVersion !== vault.schemaVersion) {
877
+ context.addIssue({
878
+ code: "custom",
879
+ message: "Key slot schema version does not match its vault",
880
+ path: ["keySlots", index, "wrappedRootKey", "aad", "schemaVersion"]
881
+ });
882
+ }
883
+ if (ids.has(slot.id)) {
884
+ context.addIssue({
885
+ code: "custom",
886
+ message: "Key slot IDs must be unique",
887
+ path: ["keySlots", index, "id"]
888
+ });
889
+ }
890
+ ids.add(slot.id);
891
+ }
892
+ if (!vault.keySlots.some((slot) => slot.state === "active")) {
893
+ context.addIssue({
894
+ code: "custom",
895
+ message: "Vault requires an active unlock slot",
896
+ path: ["keySlots"]
897
+ });
898
+ }
899
+ if (!vault.keySlots.some((slot) => slot.state === "active" && slot.keyVersion === vault.currentKeyVersion)) {
900
+ context.addIssue({
901
+ code: "custom",
902
+ message: "Current key version requires an active unlock slot",
903
+ path: ["currentKeyVersion"]
904
+ });
905
+ }
906
+ if (vault.encryptedPreferences.aad.vaultId !== vault.id || vault.encryptedPreferences.aad.entityType !== "vault-preferences" || vault.encryptedPreferences.aad.entityId !== vault.id || vault.encryptedPreferences.aad.schemaVersion !== vault.schemaVersion) {
907
+ context.addIssue({
908
+ code: "custom",
909
+ message: "Encrypted preferences have invalid associated data",
910
+ path: ["encryptedPreferences", "aad"]
911
+ });
912
+ }
913
+ });
914
+ var encryptedGroupRecordSchema = external_exports.object({
915
+ id: groupIdSchema,
916
+ vaultId: vaultIdSchema,
917
+ schemaVersion: supportedSchemaVersionSchema,
918
+ wrappedGroupKey: aeadEnvelopeSchema,
919
+ encryptedPayload: aeadEnvelopeSchema,
920
+ templateVersion: templateVersionSchema,
921
+ recordRevision: recordRevisionSchema,
922
+ createdAt: timestampSchema,
923
+ updatedAt: timestampSchema,
924
+ tombstonedAt: timestampSchema.optional()
925
+ }).strict().superRefine((record, context) => {
926
+ validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "group", record.id);
927
+ validateEnvelopeBinding(context, record.wrappedGroupKey, record.vaultId, record.schemaVersion, "wrapped-group-key", record.id);
928
+ });
929
+ var encryptedItemRecordSchema = external_exports.object({
930
+ id: itemIdSchema,
931
+ vaultId: vaultIdSchema,
932
+ groupId: groupIdSchema,
933
+ schemaVersion: supportedSchemaVersionSchema,
934
+ wrappedItemKey: aeadEnvelopeSchema,
935
+ encryptedPayload: aeadEnvelopeSchema,
936
+ recordRevision: recordRevisionSchema,
937
+ ciphertextHash: sha256DigestSchema,
938
+ createdAt: timestampSchema,
939
+ updatedAt: timestampSchema,
940
+ tombstonedAt: timestampSchema.optional()
941
+ }).strict().superRefine((record, context) => {
942
+ validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "item", record.id, record.groupId);
943
+ validateEnvelopeBinding(context, record.wrappedItemKey, record.vaultId, record.schemaVersion, "wrapped-item-key", record.id, record.groupId);
944
+ });
945
+ var encryptedAttachmentRecordSchema = external_exports.object({
946
+ id: attachmentIdSchema,
947
+ vaultId: vaultIdSchema,
948
+ groupId: groupIdSchema,
949
+ itemId: itemIdSchema,
950
+ schemaVersion: supportedSchemaVersionSchema,
951
+ wrappedAttachmentKey: aeadEnvelopeSchema,
952
+ encryptedManifest: aeadEnvelopeSchema,
953
+ chunkCount: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
954
+ recordRevision: recordRevisionSchema,
955
+ createdAt: timestampSchema,
956
+ updatedAt: timestampSchema,
957
+ tombstonedAt: timestampSchema.optional()
958
+ }).strict().superRefine((record, context) => {
959
+ validateEnvelopeBinding(context, record.encryptedManifest, record.vaultId, record.schemaVersion, "attachment", record.id, record.groupId, record.itemId);
960
+ validateEnvelopeBinding(context, record.wrappedAttachmentKey, record.vaultId, record.schemaVersion, "wrapped-attachment-key", record.id, record.groupId, record.itemId);
961
+ if (record.wrappedAttachmentKey.keyVersion !== record.encryptedManifest.keyVersion) {
962
+ context.addIssue({
963
+ code: "custom",
964
+ path: ["wrappedAttachmentKey", "keyVersion"],
965
+ message: "Attachment key envelopes must use one exact key version"
966
+ });
967
+ }
968
+ });
969
+ var encryptedAuditRecordSchema = external_exports.object({
970
+ id: auditEventIdSchema,
971
+ vaultId: vaultIdSchema,
972
+ schemaVersion: supportedSchemaVersionSchema,
973
+ encryptedPayload: aeadEnvelopeSchema,
974
+ recordRevision: recordRevisionSchema,
975
+ createdAt: timestampSchema
976
+ }).strict().superRefine((record, context) => {
977
+ validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "audit-event", record.id);
978
+ });
979
+ var encryptedHistoryRecordSchema = external_exports.object({
980
+ id: historyIdSchema,
981
+ vaultId: vaultIdSchema,
982
+ groupId: groupIdSchema,
983
+ itemId: itemIdSchema,
984
+ schemaVersion: supportedSchemaVersionSchema,
985
+ encryptedPayload: aeadEnvelopeSchema,
986
+ itemRecordRevision: recordRevisionSchema,
987
+ ciphertextHash: sha256DigestSchema,
988
+ createdAt: timestampSchema
989
+ }).strict().superRefine((record, context) => {
990
+ validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "history", record.id, record.groupId, record.itemId);
991
+ });
992
+ var encryptedRecordSchema = external_exports.union([
993
+ encryptedGroupRecordSchema,
994
+ encryptedItemRecordSchema,
995
+ encryptedAttachmentRecordSchema,
996
+ encryptedAuditRecordSchema,
997
+ encryptedHistoryRecordSchema
998
+ ]);
999
+ function validateEnvelopeBinding(context, envelope, vaultId, schemaVersion, entityType, entityId, groupId, parentId) {
1000
+ if (envelope.aad.vaultId !== vaultId || envelope.aad.schemaVersion !== schemaVersion || envelope.aad.entityType !== entityType || envelope.aad.entityId !== entityId || envelope.aad.groupId !== groupId || envelope.aad.parentId !== parentId) {
1001
+ context.addIssue({
1002
+ code: "custom",
1003
+ message: "Envelope associated data does not match its record",
1004
+ path: ["aad"]
1005
+ });
1006
+ }
1007
+ }
1008
+
1009
+ // ../../packages/schemas/dist/content-hash.js
1010
+ import { createHash, timingSafeEqual } from "node:crypto";
1011
+ var BACKUP_STAGED_ENTRIES_DOMAIN = Buffer.from("kavrix/backup-staged-entries/v1", "utf8");
1012
+ function canonicalJson(value) {
1013
+ if (value === null)
1014
+ return "null";
1015
+ if (typeof value === "string" || typeof value === "boolean") {
1016
+ return JSON.stringify(value);
1017
+ }
1018
+ if (typeof value === "number") {
1019
+ if (!Number.isFinite(value)) {
1020
+ throw new TypeError("Canonical JSON rejects non-finite numbers.");
1021
+ }
1022
+ return JSON.stringify(value);
1023
+ }
1024
+ if (Array.isArray(value)) {
1025
+ return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
1026
+ }
1027
+ if (typeof value !== "object") {
1028
+ throw new TypeError("Canonical JSON accepts only JSON values.");
1029
+ }
1030
+ const prototype = Object.getPrototypeOf(value);
1031
+ if (prototype !== Object.prototype && prototype !== null) {
1032
+ throw new TypeError("Canonical JSON rejects non-plain objects.");
1033
+ }
1034
+ const object = value;
1035
+ return `{${Object.keys(object).sort().filter((key) => object[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
1036
+ }
1037
+ function attachmentHeaderContentHash(header) {
1038
+ return sha256DigestSchema.parse(createHash("sha256").update(canonicalJson(header.record), "utf8").digest("base64url"));
1039
+ }
1040
+
1041
+ // ../../packages/schemas/dist/fields.js
1042
+ var fieldTypeSchema = external_exports.enum([
1043
+ "text",
1044
+ "secret",
1045
+ "username",
1046
+ "email",
1047
+ "url",
1048
+ "phone",
1049
+ "number",
1050
+ "boolean",
1051
+ "date",
1052
+ "datetime",
1053
+ "multiline",
1054
+ "secure-multiline",
1055
+ "api-key",
1056
+ "access-token",
1057
+ "refresh-token",
1058
+ "client-id",
1059
+ "client-secret",
1060
+ "connection-string",
1061
+ "host",
1062
+ "port",
1063
+ "database-name",
1064
+ "private-key",
1065
+ "public-key",
1066
+ "certificate",
1067
+ "totp-secret",
1068
+ "recovery-code-list",
1069
+ "json",
1070
+ "select",
1071
+ "multi-select",
1072
+ "tags",
1073
+ "environment-map",
1074
+ "command-snippet",
1075
+ "attachment",
1076
+ "item-reference",
1077
+ "custom"
1078
+ ]);
1079
+ var sensitiveFieldTypes = /* @__PURE__ */ new Set([
1080
+ "secret",
1081
+ "api-key",
1082
+ "access-token",
1083
+ "refresh-token",
1084
+ "client-secret",
1085
+ "connection-string",
1086
+ "private-key",
1087
+ "totp-secret",
1088
+ "recovery-code-list",
1089
+ "secure-multiline"
1090
+ ]);
1091
+ function isSensitiveFieldType(fieldType) {
1092
+ return sensitiveFieldTypes.has(fieldType);
1093
+ }
1094
+ var copyPolicySchema = external_exports.enum(["never", "allowed", "confirm"]);
1095
+ var revealPolicySchema = external_exports.enum(["never", "timed", "confirm"]);
1096
+ var reauthenticationPolicySchema = external_exports.enum(["never", "after-lock", "always"]);
1097
+ var exportPolicySchema = external_exports.enum(["never", "encrypted-only", "guarded"]);
1098
+ var namedValidationSchema = external_exports.enum([
1099
+ "ascii",
1100
+ "lowercase-ascii",
1101
+ "alphanumeric-ascii",
1102
+ "hostname",
1103
+ "ipv4",
1104
+ "base64url"
1105
+ ]);
1106
+ var validationRulesSchema = external_exports.object({
1107
+ minLength: external_exports.number().int().nonnegative().optional(),
1108
+ maxLength: external_exports.number().int().positive().max(1048576).optional(),
1109
+ namedValidation: namedValidationSchema.optional(),
1110
+ min: external_exports.number().optional(),
1111
+ max: external_exports.number().optional(),
1112
+ allowedSchemes: external_exports.array(external_exports.string().min(1).max(32)).max(16).optional()
1113
+ }).strict().superRefine((rules, context) => {
1114
+ if (rules.minLength !== void 0 && rules.maxLength !== void 0 && rules.minLength > rules.maxLength) {
1115
+ context.addIssue({
1116
+ code: "custom",
1117
+ message: "Minimum length cannot exceed maximum length",
1118
+ path: ["minLength"]
1119
+ });
1120
+ }
1121
+ if (rules.min !== void 0 && rules.max !== void 0 && rules.min > rules.max) {
1122
+ context.addIssue({
1123
+ code: "custom",
1124
+ message: "Minimum cannot exceed maximum",
1125
+ path: ["min"]
1126
+ });
1127
+ }
1128
+ });
1129
+ var selectOptionSchema = external_exports.object({
1130
+ value: external_exports.string().min(1).max(128),
1131
+ label: nonEmptyTextSchema
1132
+ }).strict();
1133
+ var opaqueFieldValueIdSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._~-]*$/, "Must be an opaque identifier");
1134
+ var fieldValueElementIdSchema = opaqueFieldValueIdSchema.brand();
1135
+ var nonEmptyFieldTextSchema = encryptedTextSchema.refine((value) => value.length > 0, { error: "Present text values cannot be empty" });
1136
+ var nonEmptySecretValueSchema = secretValueSchema.refine((value) => value.length > 0, { error: "Present secret values cannot be empty" });
1137
+ var fieldScalarValueSchema = external_exports.discriminatedUnion("kind", [
1138
+ external_exports.object({ kind: external_exports.literal("text"), value: nonEmptyFieldTextSchema }).strict(),
1139
+ external_exports.object({ kind: external_exports.literal("secret"), value: nonEmptySecretValueSchema }).strict(),
1140
+ external_exports.object({ kind: external_exports.literal("number"), value: external_exports.number() }).strict(),
1141
+ external_exports.object({ kind: external_exports.literal("boolean"), value: external_exports.boolean() }).strict(),
1142
+ external_exports.object({ kind: external_exports.literal("item-reference"), itemId: itemIdSchema }).strict(),
1143
+ external_exports.object({
1144
+ kind: external_exports.literal("attachment-reference"),
1145
+ attachmentId: attachmentIdSchema
1146
+ }).strict(),
1147
+ external_exports.object({
1148
+ kind: external_exports.literal("environment-entry"),
1149
+ key: external_exports.string().min(1).max(256),
1150
+ value: external_exports.discriminatedUnion("classification", [
1151
+ external_exports.object({
1152
+ classification: external_exports.literal("text"),
1153
+ value: nonEmptyFieldTextSchema
1154
+ }).strict(),
1155
+ external_exports.object({
1156
+ classification: external_exports.literal("secret"),
1157
+ value: nonEmptySecretValueSchema
1158
+ }).strict()
1159
+ ])
1160
+ }).strict()
1161
+ ]);
1162
+ var fieldValueElementLifecycleSchema = external_exports.discriminatedUnion("status", [
1163
+ external_exports.object({
1164
+ version: external_exports.literal(1),
1165
+ status: external_exports.literal("available"),
1166
+ usedAt: external_exports.undefined().optional()
1167
+ }).strict(),
1168
+ external_exports.object({
1169
+ version: external_exports.literal(1),
1170
+ status: external_exports.literal("used"),
1171
+ usedAt: timestampSchema
1172
+ }).strict()
1173
+ ]);
1174
+ var fieldValueElementSchema = external_exports.object({
1175
+ id: fieldValueElementIdSchema,
1176
+ value: fieldScalarValueSchema,
1177
+ lifecycle: fieldValueElementLifecycleSchema
1178
+ }).strict();
1179
+ var fieldValueContentSchema = external_exports.discriminatedUnion("cardinality", [
1180
+ external_exports.object({
1181
+ cardinality: external_exports.literal("single"),
1182
+ value: fieldScalarValueSchema
1183
+ }).strict(),
1184
+ external_exports.object({
1185
+ cardinality: external_exports.literal("multiple"),
1186
+ elements: external_exports.array(fieldValueElementSchema).min(1).max(1e4)
1187
+ }).strict().superRefine((content, context) => {
1188
+ const ids = /* @__PURE__ */ new Set();
1189
+ const environmentKeys = /* @__PURE__ */ new Set();
1190
+ for (const [index, element] of content.elements.entries()) {
1191
+ if (ids.has(element.id)) {
1192
+ context.addIssue({
1193
+ code: "custom",
1194
+ message: "Repeatable field element IDs must be unique",
1195
+ path: ["elements", index, "id"]
1196
+ });
1197
+ }
1198
+ ids.add(element.id);
1199
+ if (element.value.kind === "environment-entry") {
1200
+ if (environmentKeys.has(element.value.key)) {
1201
+ context.addIssue({
1202
+ code: "custom",
1203
+ message: "Environment entry keys must be unique",
1204
+ path: ["elements", index, "value", "key"]
1205
+ });
1206
+ }
1207
+ environmentKeys.add(element.value.key);
1208
+ }
1209
+ }
1210
+ })
1211
+ ]).refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4194304, { error: "Field value content exceeds the aggregate size limit" });
1212
+ var missingFieldValueSchema = external_exports.object({ version: external_exports.literal(1), state: external_exports.literal("missing") }).strict();
1213
+ var emptyFieldValueSchema = external_exports.object({ version: external_exports.literal(1), state: external_exports.literal("empty") }).strict();
1214
+ var inapplicableFieldValueSchema = external_exports.object({
1215
+ version: external_exports.literal(1),
1216
+ state: external_exports.literal("inapplicable"),
1217
+ reason: external_exports.string().trim().min(1).max(256).optional()
1218
+ }).strict();
1219
+ var unreadableFieldValueSchema = external_exports.object({
1220
+ version: external_exports.literal(1),
1221
+ state: external_exports.literal("unreadable"),
1222
+ reason: external_exports.enum([
1223
+ "unsupported-version",
1224
+ "invalid-encoding",
1225
+ "decryption-failed",
1226
+ "reference-unavailable"
1227
+ ])
1228
+ }).strict();
1229
+ var presentFieldValueSchema = external_exports.object({
1230
+ version: external_exports.literal(1),
1231
+ state: external_exports.literal("present"),
1232
+ content: fieldValueContentSchema
1233
+ }).strict();
1234
+ var activeFieldValueSchema = external_exports.discriminatedUnion("state", [
1235
+ missingFieldValueSchema,
1236
+ emptyFieldValueSchema,
1237
+ presentFieldValueSchema,
1238
+ inapplicableFieldValueSchema,
1239
+ unreadableFieldValueSchema
1240
+ ]);
1241
+ var orphanedFieldValueSchema = external_exports.object({
1242
+ version: external_exports.literal(1),
1243
+ state: external_exports.literal("orphaned"),
1244
+ originalValue: activeFieldValueSchema
1245
+ }).strict();
1246
+ var fieldValueSchema = external_exports.discriminatedUnion("state", [
1247
+ missingFieldValueSchema,
1248
+ emptyFieldValueSchema,
1249
+ presentFieldValueSchema,
1250
+ orphanedFieldValueSchema,
1251
+ inapplicableFieldValueSchema,
1252
+ unreadableFieldValueSchema
1253
+ ]).refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4194304, { error: "Field value exceeds the aggregate size limit" });
1254
+ var stableFieldKeySchema = external_exports.string().min(1).max(128).regex(/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/, "Invalid stable field key");
1255
+ var fieldDefinitionSchema = external_exports.object({
1256
+ id: fieldIdSchema,
1257
+ stableKey: stableFieldKeySchema,
1258
+ label: nonEmptyTextSchema,
1259
+ description: external_exports.string().trim().max(1024).optional(),
1260
+ type: fieldTypeSchema,
1261
+ required: external_exports.boolean(),
1262
+ sensitive: external_exports.boolean(),
1263
+ repeatable: external_exports.boolean(),
1264
+ copyable: external_exports.boolean(),
1265
+ searchableLocally: external_exports.boolean(),
1266
+ showInPreview: external_exports.boolean(),
1267
+ defaultValue: presentFieldValueSchema.optional(),
1268
+ placeholder: external_exports.string().max(256).optional(),
1269
+ validationRules: validationRulesSchema.optional(),
1270
+ selectOptions: external_exports.array(selectOptionSchema).max(1e3).optional(),
1271
+ environmentVariableName: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256).optional(),
1272
+ copyPolicy: copyPolicySchema,
1273
+ revealPolicy: revealPolicySchema,
1274
+ reauthenticationPolicy: reauthenticationPolicySchema,
1275
+ exportPolicy: exportPolicySchema,
1276
+ sortOrder: sortOrderSchema,
1277
+ createdAt: timestampSchema,
1278
+ updatedAt: timestampSchema
1279
+ }).strict().superRefine((field, context) => {
1280
+ if (field.copyable !== (field.copyPolicy !== "never")) {
1281
+ context.addIssue({
1282
+ code: "custom",
1283
+ message: "Copyable and copy policy must describe one canonical state",
1284
+ path: ["copyPolicy"]
1285
+ });
1286
+ }
1287
+ if (field.sensitive && field.defaultValue !== void 0) {
1288
+ context.addIssue({
1289
+ code: "custom",
1290
+ message: "Sensitive fields cannot define default values",
1291
+ path: ["defaultValue"]
1292
+ });
1293
+ }
1294
+ if (isSensitiveFieldType(field.type) && !field.sensitive) {
1295
+ context.addIssue({
1296
+ code: "custom",
1297
+ message: "This field type must be sensitive",
1298
+ path: ["sensitive"]
1299
+ });
1300
+ }
1301
+ if (field.sensitive && field.showInPreview) {
1302
+ context.addIssue({
1303
+ code: "custom",
1304
+ message: "Sensitive fields cannot appear in list previews",
1305
+ path: ["showInPreview"]
1306
+ });
1307
+ }
1308
+ if (field.sensitive && field.reauthenticationPolicy === "never") {
1309
+ context.addIssue({
1310
+ code: "custom",
1311
+ message: "Sensitive fields require reauthentication after locking",
1312
+ path: ["reauthenticationPolicy"]
1313
+ });
1314
+ }
1315
+ if (!field.sensitive && field.revealPolicy !== "never") {
1316
+ context.addIssue({
1317
+ code: "custom",
1318
+ message: "Non-sensitive fields do not use reveal policies",
1319
+ path: ["revealPolicy"]
1320
+ });
1321
+ }
1322
+ const isSelect = field.type === "select" || field.type === "multi-select";
1323
+ if (isSelect && (!field.selectOptions || field.selectOptions.length === 0)) {
1324
+ context.addIssue({
1325
+ code: "custom",
1326
+ message: "Select fields require at least one option",
1327
+ path: ["selectOptions"]
1328
+ });
1329
+ }
1330
+ if (!isSelect && field.selectOptions !== void 0) {
1331
+ context.addIssue({
1332
+ code: "custom",
1333
+ message: "Only select fields may define options",
1334
+ path: ["selectOptions"]
1335
+ });
1336
+ }
1337
+ if (field.defaultValue !== void 0 && !fieldValueMatchesDefinition(field, field.defaultValue)) {
1338
+ context.addIssue({
1339
+ code: "custom",
1340
+ message: "A default value must satisfy its field definition",
1341
+ path: ["defaultValue"]
1342
+ });
1343
+ }
1344
+ });
1345
+ var storedFieldValueSchema = external_exports.object({
1346
+ fieldId: fieldIdSchema,
1347
+ stableKey: stableFieldKeySchema,
1348
+ value: activeFieldValueSchema,
1349
+ updatedAt: timestampSchema
1350
+ }).strict();
1351
+ var archivedFieldValueReasonSchema = external_exports.enum([
1352
+ "template-field-removed",
1353
+ "type-conversion",
1354
+ "user-archived"
1355
+ ]);
1356
+ var archivedFieldValueSchema = external_exports.object({
1357
+ definition: fieldDefinitionSchema,
1358
+ value: orphanedFieldValueSchema,
1359
+ sourceTemplateId: templateIdSchema,
1360
+ sourceTemplateVersion: templateVersionSchema,
1361
+ archivedAt: timestampSchema,
1362
+ reason: archivedFieldValueReasonSchema
1363
+ }).strict().superRefine((archived, context) => {
1364
+ if (!fieldValueMatchesDefinition(archived.definition, archived.value.originalValue)) {
1365
+ context.addIssue({
1366
+ code: "custom",
1367
+ message: "Archived values must preserve a state valid for their definition",
1368
+ path: ["value", "originalValue"]
1369
+ });
1370
+ }
1371
+ });
1372
+ var itemReferenceSchema = external_exports.object({
1373
+ itemId: itemIdSchema,
1374
+ relationship: external_exports.string().trim().min(1).max(128)
1375
+ }).strict();
1376
+ var collectionFieldTypes = /* @__PURE__ */ new Set([
1377
+ "multi-select",
1378
+ "tags",
1379
+ "recovery-code-list",
1380
+ "environment-map"
1381
+ ]);
1382
+ function fieldExpectsMultipleValues(field) {
1383
+ return field.repeatable || collectionFieldTypes.has(field.type);
1384
+ }
1385
+ function fieldValueMatchesDefinition(field, value) {
1386
+ if (value.state === "orphaned")
1387
+ return false;
1388
+ if (value.state !== "present")
1389
+ return !field.required;
1390
+ const expectsMultiple = fieldExpectsMultipleValues(field);
1391
+ if (expectsMultiple !== (value.content.cardinality === "multiple"))
1392
+ return false;
1393
+ const elements = value.content.cardinality === "multiple" ? value.content.elements : void 0;
1394
+ if (field.type !== "recovery-code-list" && elements?.some(({ lifecycle }) => lifecycle.status === "used") === true) {
1395
+ return false;
1396
+ }
1397
+ const candidates = value.content.cardinality === "multiple" ? value.content.elements.map(({ value: candidate }) => candidate) : [value.content.value];
1398
+ return candidates.every((candidate) => singleValueMatchesType(field, candidate) && valueMatchesRules(field, candidate));
1399
+ }
1400
+ function singleValueMatchesType(field, value) {
1401
+ switch (field.type) {
1402
+ case "number":
1403
+ return value.kind === "number";
1404
+ case "port":
1405
+ return value.kind === "number" && Number.isInteger(value.value) && value.value >= 1 && value.value <= 65535;
1406
+ case "boolean":
1407
+ return value.kind === "boolean";
1408
+ case "attachment":
1409
+ return value.kind === "attachment-reference";
1410
+ case "item-reference":
1411
+ return value.kind === "item-reference";
1412
+ case "environment-map":
1413
+ return value.kind === "environment-entry" && value.value.classification === (field.sensitive ? "secret" : "text");
1414
+ case "json":
1415
+ if (!isExpectedTextKind(field, value))
1416
+ return false;
1417
+ try {
1418
+ JSON.parse(value.value);
1419
+ return true;
1420
+ } catch {
1421
+ return false;
1422
+ }
1423
+ case "select":
1424
+ case "multi-select":
1425
+ return isExpectedTextKind(field, value) && selectValuesMatch(field, value.value);
1426
+ case "email":
1427
+ return isExpectedTextKind(field, value) && isSimpleEmail(value.value);
1428
+ case "url":
1429
+ if (!isExpectedTextKind(field, value))
1430
+ return false;
1431
+ try {
1432
+ const parsed = new URL(value.value);
1433
+ const schemes = field.validationRules?.allowedSchemes;
1434
+ return schemes === void 0 || schemes.includes(parsed.protocol.slice(0, -1));
1435
+ } catch {
1436
+ return false;
1437
+ }
1438
+ default:
1439
+ return isExpectedTextKind(field, value);
1440
+ }
1441
+ }
1442
+ function isExpectedTextKind(field, value) {
1443
+ return field.sensitive ? value.kind === "secret" : value.kind === "text";
1444
+ }
1445
+ function valueMatchesRules(field, value) {
1446
+ const rules = field.validationRules;
1447
+ if (rules === void 0)
1448
+ return true;
1449
+ if (value.kind === "text" || value.kind === "secret") {
1450
+ if (rules.minLength !== void 0 && value.value.length < rules.minLength)
1451
+ return false;
1452
+ if (rules.maxLength !== void 0 && value.value.length > rules.maxLength)
1453
+ return false;
1454
+ if (rules.namedValidation !== void 0 && !matchesNamedValidation(rules.namedValidation, value.value))
1455
+ return false;
1456
+ }
1457
+ if (value.kind === "number") {
1458
+ if (rules.min !== void 0 && value.value < rules.min)
1459
+ return false;
1460
+ if (rules.max !== void 0 && value.value > rules.max)
1461
+ return false;
1462
+ }
1463
+ return true;
1464
+ }
1465
+ function matchesNamedValidation(validation, value) {
1466
+ switch (validation) {
1467
+ case "ascii":
1468
+ return everyCodeUnit(value, (code) => code <= 127);
1469
+ case "lowercase-ascii":
1470
+ return everyCodeUnit(value, (code) => code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 45 || code === 95);
1471
+ case "alphanumeric-ascii":
1472
+ return everyCodeUnit(value, (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122);
1473
+ case "hostname":
1474
+ return isHostname(value);
1475
+ case "ipv4":
1476
+ return isIpv4(value);
1477
+ case "base64url":
1478
+ return everyCodeUnit(value, (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 45 || code === 95);
1479
+ }
1480
+ }
1481
+ function everyCodeUnit(value, predicate) {
1482
+ if (value.length === 0)
1483
+ return false;
1484
+ for (let index = 0; index < value.length; index += 1) {
1485
+ if (!predicate(value.charCodeAt(index)))
1486
+ return false;
1487
+ }
1488
+ return true;
1489
+ }
1490
+ function isHostname(value) {
1491
+ if (value.length === 0 || value.length > 253)
1492
+ return false;
1493
+ const labels = value.split(".");
1494
+ return labels.every((label) => {
1495
+ if (label.length === 0 || label.length > 63)
1496
+ return false;
1497
+ if (label.startsWith("-") || label.endsWith("-"))
1498
+ return false;
1499
+ return everyCodeUnit(label, (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 45);
1500
+ });
1501
+ }
1502
+ function isIpv4(value) {
1503
+ const parts = value.split(".");
1504
+ if (parts.length !== 4)
1505
+ return false;
1506
+ return parts.every((part) => {
1507
+ if (part.length === 0 || part.length > 3)
1508
+ return false;
1509
+ if (part.length > 1 && part.startsWith("0"))
1510
+ return false;
1511
+ if (!everyCodeUnit(part, (code) => code >= 48 && code <= 57))
1512
+ return false;
1513
+ const octet = Number(part);
1514
+ return octet >= 0 && octet <= 255;
1515
+ });
1516
+ }
1517
+ function isSimpleEmail(value) {
1518
+ const at = value.indexOf("@");
1519
+ if (at <= 0 || at !== value.lastIndexOf("@"))
1520
+ return false;
1521
+ const domain = value.slice(at + 1);
1522
+ return domain.includes(".") && !value.includes(" ") && !value.includes(" ");
1523
+ }
1524
+ function selectValuesMatch(field, value) {
1525
+ return field.selectOptions?.some((option) => option.value === value) === true;
1526
+ }
1527
+
1528
+ // ../../packages/schemas/dist/notes.js
1529
+ var noteSchema = external_exports.object({
1530
+ id: noteIdSchema,
1531
+ title: nonEmptyTextSchema,
1532
+ content: secretValueSchema,
1533
+ isSensitive: external_exports.boolean(),
1534
+ isPinned: external_exports.boolean(),
1535
+ tags: external_exports.array(external_exports.string().trim().min(1).max(128)).max(256),
1536
+ sortOrder: sortOrderSchema,
1537
+ createdAt: timestampSchema,
1538
+ updatedAt: timestampSchema,
1539
+ archivedAt: timestampSchema.optional()
1540
+ }).strict();
1541
+ var noteCollectionSchema = external_exports.array(noteSchema).max(1e4).superRefine((notes, context) => {
1542
+ const ids = /* @__PURE__ */ new Set();
1543
+ for (const [index, note] of notes.entries()) {
1544
+ if (ids.has(note.id)) {
1545
+ context.addIssue({
1546
+ code: "custom",
1547
+ message: "Note IDs must be unique",
1548
+ path: [index, "id"]
1549
+ });
1550
+ }
1551
+ ids.add(note.id);
1552
+ }
1553
+ });
1554
+
1555
+ // ../../packages/schemas/dist/templates.js
1556
+ var builtInTemplateKeySchema = external_exports.enum([
1557
+ "email",
1558
+ "database",
1559
+ "api-oauth",
1560
+ "server-ssh",
1561
+ "cloud-provider",
1562
+ "git-source-control",
1563
+ "application-environment",
1564
+ "software-license",
1565
+ "secure-note",
1566
+ "custom"
1567
+ ]);
1568
+ var groupTemplateSchema = external_exports.object({
1569
+ id: templateIdSchema,
1570
+ name: nonEmptyTextSchema,
1571
+ description: external_exports.string().trim().max(1024).optional(),
1572
+ builtInKey: builtInTemplateKeySchema.optional(),
1573
+ version: templateVersionSchema,
1574
+ fields: external_exports.array(fieldDefinitionSchema).max(1e3),
1575
+ createdAt: timestampSchema,
1576
+ updatedAt: timestampSchema
1577
+ }).strict().superRefine((template, context) => {
1578
+ const ids = /* @__PURE__ */ new Set();
1579
+ const keys = /* @__PURE__ */ new Set();
1580
+ const orders = /* @__PURE__ */ new Set();
1581
+ for (const [index, field] of template.fields.entries()) {
1582
+ if (ids.has(field.id)) {
1583
+ context.addIssue({
1584
+ code: "custom",
1585
+ message: "Field IDs must be unique",
1586
+ path: ["fields", index, "id"]
1587
+ });
1588
+ }
1589
+ if (keys.has(field.stableKey)) {
1590
+ context.addIssue({
1591
+ code: "custom",
1592
+ message: "Stable field keys must be unique",
1593
+ path: ["fields", index, "stableKey"]
1594
+ });
1595
+ }
1596
+ if (orders.has(field.sortOrder)) {
1597
+ context.addIssue({
1598
+ code: "custom",
1599
+ message: "Field sort orders must be unique",
1600
+ path: ["fields", index, "sortOrder"]
1601
+ });
1602
+ }
1603
+ ids.add(field.id);
1604
+ keys.add(field.stableKey);
1605
+ orders.add(field.sortOrder);
1606
+ }
1607
+ });
1608
+ var migrationStepBaseSchema = external_exports.object({
1609
+ affectedItemCount: external_exports.number().int().nonnegative(),
1610
+ requiresConfirmation: external_exports.boolean()
1611
+ });
1612
+ var templateMigrationStepSchema = external_exports.discriminatedUnion("kind", [
1613
+ migrationStepBaseSchema.extend({
1614
+ kind: external_exports.literal("add-field"),
1615
+ field: fieldDefinitionSchema
1616
+ }),
1617
+ migrationStepBaseSchema.extend({
1618
+ kind: external_exports.literal("restore-field"),
1619
+ field: fieldDefinitionSchema
1620
+ }),
1621
+ migrationStepBaseSchema.extend({
1622
+ kind: external_exports.literal("rename-label"),
1623
+ fieldId: fieldIdSchema,
1624
+ fromLabel: nonEmptyTextSchema,
1625
+ toLabel: nonEmptyTextSchema
1626
+ }),
1627
+ migrationStepBaseSchema.extend({
1628
+ kind: external_exports.literal("reorder-field"),
1629
+ fieldId: fieldIdSchema,
1630
+ fromSortOrder: sortOrderSchema,
1631
+ toSortOrder: sortOrderSchema
1632
+ }),
1633
+ migrationStepBaseSchema.extend({
1634
+ kind: external_exports.literal("change-required"),
1635
+ fieldId: fieldIdSchema,
1636
+ fromRequired: external_exports.boolean(),
1637
+ toRequired: external_exports.boolean(),
1638
+ missingValueCount: external_exports.number().int().nonnegative()
1639
+ }),
1640
+ migrationStepBaseSchema.extend({
1641
+ kind: external_exports.literal("update-field-policy"),
1642
+ fieldId: fieldIdSchema,
1643
+ fromField: fieldDefinitionSchema,
1644
+ toField: fieldDefinitionSchema
1645
+ }),
1646
+ migrationStepBaseSchema.extend({
1647
+ kind: external_exports.literal("convert-type"),
1648
+ fieldId: fieldIdSchema,
1649
+ fromField: fieldDefinitionSchema,
1650
+ toField: fieldDefinitionSchema,
1651
+ fromType: fieldTypeSchema,
1652
+ toType: fieldTypeSchema,
1653
+ strategy: external_exports.enum([
1654
+ "identity",
1655
+ "number-to-string",
1656
+ "string-to-number",
1657
+ "boolean-to-string",
1658
+ "string-to-boolean",
1659
+ "archive-incompatible"
1660
+ ]),
1661
+ incompatibleValueCount: external_exports.number().int().nonnegative()
1662
+ }),
1663
+ migrationStepBaseSchema.extend({
1664
+ kind: external_exports.literal("archive-field"),
1665
+ field: fieldDefinitionSchema
1666
+ })
1667
+ ]);
1668
+ var templateMigrationPlanSchema = external_exports.object({
1669
+ id: templateMigrationIdSchema,
1670
+ fromVersion: templateVersionSchema,
1671
+ toVersion: templateVersionSchema,
1672
+ sourceTemplate: groupTemplateSchema,
1673
+ targetTemplate: groupTemplateSchema,
1674
+ itemSnapshots: external_exports.array(external_exports.object({
1675
+ itemId: itemIdSchema,
1676
+ revision: recordRevisionSchema
1677
+ }).strict()).max(1e6),
1678
+ steps: external_exports.array(templateMigrationStepSchema).max(4e3),
1679
+ status: external_exports.enum(["pending", "running", "completed"]),
1680
+ nextItemIndex: external_exports.number().int().nonnegative(),
1681
+ totalItems: external_exports.number().int().nonnegative(),
1682
+ auditEventId: auditEventIdSchema,
1683
+ createdAt: timestampSchema,
1684
+ updatedAt: timestampSchema
1685
+ }).strict().superRefine((plan, context) => {
1686
+ if (plan.toVersion <= plan.fromVersion) {
1687
+ context.addIssue({
1688
+ code: "custom",
1689
+ message: "Migration target version must be newer",
1690
+ path: ["toVersion"]
1691
+ });
1692
+ }
1693
+ if (plan.targetTemplate.version !== plan.toVersion) {
1694
+ context.addIssue({
1695
+ code: "custom",
1696
+ message: "Target template version must match the migration",
1697
+ path: ["targetTemplate", "version"]
1698
+ });
1699
+ }
1700
+ if (plan.sourceTemplate.version !== plan.fromVersion) {
1701
+ context.addIssue({
1702
+ code: "custom",
1703
+ message: "Source template version must match the migration",
1704
+ path: ["sourceTemplate", "version"]
1705
+ });
1706
+ }
1707
+ if (plan.sourceTemplate.id !== plan.targetTemplate.id) {
1708
+ context.addIssue({
1709
+ code: "custom",
1710
+ message: "A migration cannot change template identity",
1711
+ path: ["targetTemplate", "id"]
1712
+ });
1713
+ }
1714
+ if (plan.itemSnapshots.length !== plan.totalItems) {
1715
+ context.addIssue({
1716
+ code: "custom",
1717
+ message: "Migration item snapshots must match the item count",
1718
+ path: ["itemSnapshots"]
1719
+ });
1720
+ }
1721
+ const snapshotIds = /* @__PURE__ */ new Set();
1722
+ for (const [index, snapshot] of plan.itemSnapshots.entries()) {
1723
+ if (snapshotIds.has(snapshot.itemId)) {
1724
+ context.addIssue({
1725
+ code: "custom",
1726
+ message: "Migration item snapshots must have unique item IDs",
1727
+ path: ["itemSnapshots", index, "itemId"]
1728
+ });
1729
+ }
1730
+ snapshotIds.add(snapshot.itemId);
1731
+ }
1732
+ if (plan.nextItemIndex > plan.totalItems) {
1733
+ context.addIssue({
1734
+ code: "custom",
1735
+ message: "Migration checkpoint exceeds item count",
1736
+ path: ["nextItemIndex"]
1737
+ });
1738
+ }
1739
+ if (plan.status === "completed" && plan.nextItemIndex !== plan.totalItems) {
1740
+ context.addIssue({
1741
+ code: "custom",
1742
+ message: "Completed migration must include every item",
1743
+ path: ["status"]
1744
+ });
1745
+ }
1746
+ });
1747
+
1748
+ // ../../packages/schemas/dist/payloads.js
1749
+ var aliasesSchema = external_exports.array(external_exports.string().trim().min(1).max(256)).max(256);
1750
+ var tagsSchema = external_exports.array(external_exports.string().trim().min(1).max(128)).max(256);
1751
+ var copySequenceIdSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._~-]*$/).brand();
1752
+ var copySequenceSchema = external_exports.object({
1753
+ id: copySequenceIdSchema,
1754
+ name: nonEmptyTextSchema,
1755
+ fieldKeys: external_exports.array(stableFieldKeySchema).min(1).max(100)
1756
+ }).strict().superRefine((sequence, context) => {
1757
+ const keys = /* @__PURE__ */ new Set();
1758
+ for (const [index, key] of sequence.fieldKeys.entries()) {
1759
+ if (keys.has(key)) {
1760
+ context.addIssue({
1761
+ code: "custom",
1762
+ message: "A copy sequence cannot contain the same field twice",
1763
+ path: ["fieldKeys", index]
1764
+ });
1765
+ }
1766
+ keys.add(key);
1767
+ }
1768
+ });
1769
+ var groupPayloadSchema = external_exports.object({
1770
+ id: groupIdSchema,
1771
+ vaultId: vaultIdSchema,
1772
+ name: nonEmptyTextSchema,
1773
+ slug: slugSchema.optional(),
1774
+ aliases: aliasesSchema,
1775
+ description: external_exports.string().trim().max(8192).optional(),
1776
+ icon: external_exports.string().max(64).optional(),
1777
+ colorToken: external_exports.string().max(64).optional(),
1778
+ tags: tagsSchema,
1779
+ notes: noteCollectionSchema,
1780
+ template: groupTemplateSchema,
1781
+ sortOrder: sortOrderSchema,
1782
+ revision: recordRevisionSchema,
1783
+ createdAt: timestampSchema,
1784
+ updatedAt: timestampSchema,
1785
+ archivedAt: timestampSchema.optional(),
1786
+ deletedAt: timestampSchema.optional()
1787
+ }).strict();
1788
+ var itemPayloadV1Schema = external_exports.object({
1789
+ version: external_exports.literal(1),
1790
+ id: itemIdSchema,
1791
+ vaultId: vaultIdSchema,
1792
+ groupId: groupIdSchema,
1793
+ templateId: templateIdSchema,
1794
+ title: nonEmptyTextSchema,
1795
+ slug: slugSchema.optional(),
1796
+ aliases: aliasesSchema,
1797
+ subtitle: external_exports.string().trim().max(512).optional(),
1798
+ templateVersion: templateVersionSchema,
1799
+ templateValues: external_exports.array(storedFieldValueSchema).max(1e3),
1800
+ itemFields: external_exports.array(fieldDefinitionSchema).max(1e3),
1801
+ itemValues: external_exports.array(storedFieldValueSchema).max(1e3),
1802
+ archivedFieldValues: external_exports.array(archivedFieldValueSchema).max(1e4),
1803
+ notes: noteCollectionSchema,
1804
+ tags: tagsSchema,
1805
+ favorite: external_exports.boolean(),
1806
+ environment: external_exports.string().trim().max(128).optional(),
1807
+ owner: external_exports.string().trim().min(1).max(512).optional(),
1808
+ purpose: external_exports.string().trim().min(1).max(2048).optional(),
1809
+ productionSensitive: external_exports.boolean(),
1810
+ expiresAt: timestampSchema.optional(),
1811
+ rotationIntervalDays: external_exports.number().int().positive().max(36500).optional(),
1812
+ lastRotatedAt: timestampSchema.optional(),
1813
+ lastVerifiedAt: timestampSchema.optional(),
1814
+ relatedItemIds: external_exports.array(itemIdSchema).max(1e3),
1815
+ attachmentIds: external_exports.array(attachmentIdSchema).max(1e3),
1816
+ copySequences: external_exports.array(copySequenceSchema).max(100),
1817
+ revision: recordRevisionSchema,
1818
+ createdAt: timestampSchema,
1819
+ updatedAt: timestampSchema,
1820
+ archivedAt: timestampSchema.optional(),
1821
+ deletedAt: timestampSchema.optional()
1822
+ }).strict().superRefine((item, context) => {
1823
+ const fieldIds = /* @__PURE__ */ new Set();
1824
+ const stableKeys = /* @__PURE__ */ new Set();
1825
+ const templateFieldIds = /* @__PURE__ */ new Set();
1826
+ const templateStableKeys = /* @__PURE__ */ new Set();
1827
+ for (const [index, value] of [
1828
+ ...item.templateValues,
1829
+ ...item.itemValues
1830
+ ].entries()) {
1831
+ if (fieldIds.has(value.fieldId) || stableKeys.has(value.stableKey)) {
1832
+ context.addIssue({
1833
+ code: "custom",
1834
+ message: "Active field values must have unique IDs and stable keys",
1835
+ path: ["templateValues", index]
1836
+ });
1837
+ }
1838
+ fieldIds.add(value.fieldId);
1839
+ stableKeys.add(value.stableKey);
1840
+ if (index < item.templateValues.length) {
1841
+ templateFieldIds.add(value.fieldId);
1842
+ templateStableKeys.add(value.stableKey);
1843
+ }
1844
+ }
1845
+ const itemDefinitionsById = /* @__PURE__ */ new Map();
1846
+ const itemDefinitionKeys = /* @__PURE__ */ new Set();
1847
+ for (const [index, definition] of item.itemFields.entries()) {
1848
+ if (itemDefinitionsById.has(definition.id) || itemDefinitionKeys.has(definition.stableKey) || templateFieldIds.has(definition.id) || templateStableKeys.has(definition.stableKey)) {
1849
+ context.addIssue({
1850
+ code: "custom",
1851
+ message: "Item-only field definitions must be unique and cannot shadow template fields",
1852
+ path: ["itemFields", index]
1853
+ });
1854
+ }
1855
+ itemDefinitionsById.set(definition.id, definition);
1856
+ itemDefinitionKeys.add(definition.stableKey);
1857
+ }
1858
+ const itemValueIds = /* @__PURE__ */ new Set();
1859
+ for (const [index, value] of item.itemValues.entries()) {
1860
+ const definition = itemDefinitionsById.get(value.fieldId);
1861
+ const definitionMatches = definition?.stableKey === value.stableKey && fieldValueMatchesDefinition(definition, value.value);
1862
+ if (itemValueIds.has(value.fieldId) || !definitionMatches) {
1863
+ context.addIssue({
1864
+ code: "custom",
1865
+ message: "Item-only values must match one unique item-only definition",
1866
+ path: ["itemValues", index]
1867
+ });
1868
+ }
1869
+ itemValueIds.add(value.fieldId);
1870
+ }
1871
+ for (const [index, definition] of item.itemFields.entries()) {
1872
+ const stored = item.itemValues.find((value) => value.fieldId === definition.id);
1873
+ if (definition.required && (stored === void 0 || !fieldValueMatchesDefinition(definition, stored.value))) {
1874
+ context.addIssue({
1875
+ code: "custom",
1876
+ message: "Required item-only fields must have a value",
1877
+ path: ["itemFields", index]
1878
+ });
1879
+ }
1880
+ }
1881
+ const activeDefinitionIds = /* @__PURE__ */ new Set([
1882
+ ...item.templateValues.map(({ fieldId }) => fieldId),
1883
+ ...item.itemFields.map(({ id }) => id)
1884
+ ]);
1885
+ const activeDefinitionKeys = /* @__PURE__ */ new Set([
1886
+ ...item.templateValues.map(({ stableKey }) => stableKey),
1887
+ ...item.itemFields.map(({ stableKey }) => stableKey)
1888
+ ]);
1889
+ const archivedIds = /* @__PURE__ */ new Set();
1890
+ const archivedKeys = /* @__PURE__ */ new Set();
1891
+ for (const [index, archived] of item.archivedFieldValues.entries()) {
1892
+ if (archivedIds.has(archived.definition.id) || archivedKeys.has(archived.definition.stableKey) || activeDefinitionIds.has(archived.definition.id) || activeDefinitionKeys.has(archived.definition.stableKey)) {
1893
+ context.addIssue({
1894
+ code: "custom",
1895
+ message: "Archived field IDs and stable keys must be unique and disjoint from active fields",
1896
+ path: ["archivedFieldValues", index]
1897
+ });
1898
+ }
1899
+ archivedIds.add(archived.definition.id);
1900
+ archivedKeys.add(archived.definition.stableKey);
1901
+ }
1902
+ const relatedItemIds = /* @__PURE__ */ new Set();
1903
+ for (const [index, relatedItemId] of item.relatedItemIds.entries()) {
1904
+ if (relatedItemId === item.id || relatedItemIds.has(relatedItemId)) {
1905
+ context.addIssue({
1906
+ code: "custom",
1907
+ message: "Related item IDs must be unique and cannot reference the item itself",
1908
+ path: ["relatedItemIds", index]
1909
+ });
1910
+ }
1911
+ relatedItemIds.add(relatedItemId);
1912
+ }
1913
+ const attachmentIds = /* @__PURE__ */ new Set();
1914
+ for (const [index, attachmentId] of item.attachmentIds.entries()) {
1915
+ if (attachmentIds.has(attachmentId)) {
1916
+ context.addIssue({
1917
+ code: "custom",
1918
+ message: "Attachment IDs must be unique",
1919
+ path: ["attachmentIds", index]
1920
+ });
1921
+ }
1922
+ attachmentIds.add(attachmentId);
1923
+ }
1924
+ for (const [collectionName, values] of [
1925
+ ["templateValues", item.templateValues],
1926
+ ["itemValues", item.itemValues]
1927
+ ]) {
1928
+ for (const [valueIndex, stored] of values.entries()) {
1929
+ for (const reference of referencedEntities(stored.value)) {
1930
+ const valid = reference.kind === "item-reference" ? relatedItemIds.has(reference.itemId) : attachmentIds.has(reference.attachmentId);
1931
+ if (!valid) {
1932
+ context.addIssue({
1933
+ code: "custom",
1934
+ message: "Field references must resolve through the item reference lists",
1935
+ path: [collectionName, valueIndex, "value"]
1936
+ });
1937
+ }
1938
+ }
1939
+ }
1940
+ }
1941
+ const activeKeys = /* @__PURE__ */ new Set([
1942
+ ...item.templateValues.map(({ stableKey }) => stableKey),
1943
+ ...item.itemFields.map(({ stableKey }) => stableKey)
1944
+ ]);
1945
+ const sequenceIds = /* @__PURE__ */ new Set();
1946
+ for (const [index, sequence] of item.copySequences.entries()) {
1947
+ if (sequenceIds.has(sequence.id)) {
1948
+ context.addIssue({
1949
+ code: "custom",
1950
+ message: "Copy sequence IDs must be unique",
1951
+ path: ["copySequences", index, "id"]
1952
+ });
1953
+ }
1954
+ sequenceIds.add(sequence.id);
1955
+ if (sequence.fieldKeys.some((key) => !activeKeys.has(key))) {
1956
+ context.addIssue({
1957
+ code: "custom",
1958
+ message: "Copy sequences may contain only active stable field keys",
1959
+ path: ["copySequences", index, "fieldKeys"]
1960
+ });
1961
+ }
1962
+ }
1963
+ });
1964
+ var itemPayloadSchema = itemPayloadV1Schema;
1965
+ function referencedEntities(value) {
1966
+ if (value.state !== "present")
1967
+ return [];
1968
+ const scalars = value.content.cardinality === "single" ? [value.content.value] : value.content.elements.map(({ value: scalar }) => scalar);
1969
+ const references = [];
1970
+ for (const scalar of scalars) {
1971
+ if (scalar.kind === "item-reference")
1972
+ references.push(scalar);
1973
+ if (scalar.kind === "attachment-reference")
1974
+ references.push(scalar);
1975
+ }
1976
+ return references;
1977
+ }
1978
+ var vaultPreferencesSchema = external_exports.object({
1979
+ productLabel: nonEmptyTextSchema,
1980
+ executableName: external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/),
1981
+ clipboardClearSeconds: external_exports.number().int().min(1).max(3600),
1982
+ revealHideSeconds: external_exports.number().int().min(1).max(3600),
1983
+ historyRetentionDays: external_exports.number().int().min(1).max(36500),
1984
+ telemetryEnabled: external_exports.literal(false)
1985
+ }).strict();
1986
+
1987
+ // ../../packages/schemas/dist/local-vault.js
1988
+ var localVaultFormatSchema = external_exports.literal("kavrix-local-vault");
1989
+ var CURRENT_LOCAL_VAULT_VERSION = 2;
1990
+ var localVaultVersionSchema = external_exports.literal(CURRENT_LOCAL_VAULT_VERSION);
1991
+ var MAX_LOCAL_RECOVERY_SLOTS = 32;
1992
+ var localRecoveryKeySlotSchema = keySlotSchema.refine((slot) => slot.type === "recovery-key", { error: "Local recovery slots require recovery-key material" });
1993
+ var localVaultValueSchema = external_exports.object({
1994
+ value: maxTextBytesSchema,
1995
+ updatedAt: timestampSchema
1996
+ }).strict();
1997
+ var localVaultPayloadSchema = external_exports.object({
1998
+ records: external_exports.record(external_exports.string().min(1).max(256), localVaultValueSchema)
1999
+ }).strict().superRefine((payload, context) => {
2000
+ if (Object.keys(payload.records).length > 1e4) {
2001
+ context.addIssue({
2002
+ code: "custom",
2003
+ message: "Local vault contains too many credentials",
2004
+ path: ["records"]
2005
+ });
2006
+ }
2007
+ });
2008
+ var localVaultDocumentSchema = external_exports.object({
2009
+ format: localVaultFormatSchema,
2010
+ version: localVaultVersionSchema,
2011
+ id: vaultIdSchema,
2012
+ schemaVersion: supportedSchemaVersionSchema,
2013
+ cryptographicVersion: supportedCryptographicVersionSchema,
2014
+ currentKeyVersion: keyVersionSchema,
2015
+ keySlot: keySlotSchema,
2016
+ recoverySlots: external_exports.array(localRecoveryKeySlotSchema).max(MAX_LOCAL_RECOVERY_SLOTS).default([]),
2017
+ revision: vaultRevisionSchema,
2018
+ encryptedPayload: aeadEnvelopeSchema,
2019
+ createdAt: timestampSchema,
2020
+ updatedAt: timestampSchema
2021
+ }).strict().superRefine((document, context) => {
2022
+ if (document.schemaVersion !== CURRENT_SCHEMA_VERSION) {
2023
+ context.addIssue({
2024
+ code: "custom",
2025
+ message: "Unsupported local vault schema version",
2026
+ path: ["schemaVersion"]
2027
+ });
2028
+ }
2029
+ if (document.cryptographicVersion !== CURRENT_CRYPTOGRAPHIC_VERSION) {
2030
+ context.addIssue({
2031
+ code: "custom",
2032
+ message: "Unsupported local vault cryptographic version",
2033
+ path: ["cryptographicVersion"]
2034
+ });
2035
+ }
2036
+ if (document.keySlot.type !== "portable-key") {
2037
+ context.addIssue({
2038
+ code: "custom",
2039
+ message: "Local vaults require a portable-key unlock slot",
2040
+ path: ["keySlot", "type"]
2041
+ });
2042
+ } else {
2043
+ if (document.keySlot.state !== "active") {
2044
+ context.addIssue({
2045
+ code: "custom",
2046
+ message: "Local vault unlock slot must be active",
2047
+ path: ["keySlot", "state"]
2048
+ });
2049
+ }
2050
+ if (document.keySlot.keyVersion !== document.currentKeyVersion) {
2051
+ context.addIssue({
2052
+ code: "custom",
2053
+ message: "Local vault key versions do not agree",
2054
+ path: ["keySlot", "keyVersion"]
2055
+ });
2056
+ }
2057
+ if (document.keySlot.wrappedRootKey.aad.vaultId !== document.id) {
2058
+ context.addIssue({
2059
+ code: "custom",
2060
+ message: "Local vault key slot belongs to another vault",
2061
+ path: ["keySlot", "wrappedRootKey", "aad", "vaultId"]
2062
+ });
2063
+ }
2064
+ }
2065
+ const slotIds = /* @__PURE__ */ new Set([document.keySlot.id]);
2066
+ for (const [index, slot] of document.recoverySlots.entries()) {
2067
+ if (slotIds.has(slot.id)) {
2068
+ context.addIssue({
2069
+ code: "custom",
2070
+ message: "Local key slot IDs must be unique",
2071
+ path: ["recoverySlots", index, "id"]
2072
+ });
2073
+ }
2074
+ slotIds.add(slot.id);
2075
+ if (slot.keyVersion !== document.currentKeyVersion) {
2076
+ context.addIssue({
2077
+ code: "custom",
2078
+ message: "Local recovery slot key version does not match the vault",
2079
+ path: ["recoverySlots", index, "keyVersion"]
2080
+ });
2081
+ }
2082
+ if (slot.wrappedRootKey.aad.vaultId !== document.id) {
2083
+ context.addIssue({
2084
+ code: "custom",
2085
+ message: "Local recovery slot belongs to another vault",
2086
+ path: ["recoverySlots", index, "wrappedRootKey", "aad", "vaultId"]
2087
+ });
2088
+ }
2089
+ if (slot.wrappedRootKey.aad.schemaVersion !== document.schemaVersion) {
2090
+ context.addIssue({
2091
+ code: "custom",
2092
+ message: "Local recovery slot schema version does not match the vault",
2093
+ path: ["recoverySlots", index, "wrappedRootKey", "aad", "schemaVersion"]
2094
+ });
2095
+ }
2096
+ if (slot.state !== "active" && slot.state !== "revoked") {
2097
+ context.addIssue({
2098
+ code: "custom",
2099
+ message: "Local recovery slots must be active or revoked",
2100
+ path: ["recoverySlots", index, "state"]
2101
+ });
2102
+ }
2103
+ }
2104
+ const aad = document.encryptedPayload.aad;
2105
+ if (aad.revision === void 0 || aad.metadataDigest === void 0 || aad.revision !== document.revision) {
2106
+ context.addIssue({
2107
+ code: "custom",
2108
+ message: "Local vault payload metadata binding is invalid",
2109
+ path: ["encryptedPayload", "aad"]
2110
+ });
2111
+ }
2112
+ if (aad.vaultId !== document.id || aad.entityId !== document.id || aad.schemaVersion !== document.schemaVersion || aad.keyVersion !== document.currentKeyVersion) {
2113
+ context.addIssue({
2114
+ code: "custom",
2115
+ message: "Local vault payload has invalid associated data",
2116
+ path: ["encryptedPayload", "aad"]
2117
+ });
2118
+ }
2119
+ });
2120
+
2121
+ // ../../packages/schemas/dist/authorization.js
2122
+ var API_SCOPE_VALUES = Object.freeze([
2123
+ "sync:read",
2124
+ "sync:write",
2125
+ "device:manage"
2126
+ ]);
2127
+ var MIN_API_SCOPES = 1;
2128
+ var MAX_API_SCOPES = API_SCOPE_VALUES.length;
2129
+ var apiScopeSchema = external_exports.enum(API_SCOPE_VALUES);
2130
+ var apiScopesSchema = external_exports.array(apiScopeSchema).min(MIN_API_SCOPES).max(MAX_API_SCOPES).superRefine((scopes, context) => {
2131
+ if (new Set(scopes).size !== scopes.length) {
2132
+ context.addIssue({
2133
+ code: "custom",
2134
+ message: "API scopes must be unique"
2135
+ });
2136
+ }
2137
+ });
2138
+
2139
+ // ../../packages/schemas/dist/sync.js
2140
+ var MIN_IDEMPOTENCY_KEY_CHARS = 16;
2141
+ var MAX_IDEMPOTENCY_KEY_CHARS = 256;
2142
+ var syncEntityTypeSchema = external_exports.enum(["vault", "group", "item", "attachment"]);
2143
+ var syncOperationSchema = external_exports.enum(["upsert", "tombstone", "restore", "purge"]);
2144
+ var changeRecordBaseSchema = external_exports.object({
2145
+ id: changeIdSchema,
2146
+ vaultId: vaultIdSchema,
2147
+ serverSequence: changeSequenceSchema,
2148
+ recordRevision: recordRevisionSchema,
2149
+ operation: syncOperationSchema,
2150
+ ciphertextHash: sha256DigestSchema.optional(),
2151
+ createdAt: timestampSchema
2152
+ }).strict();
2153
+ var changeRecordSchema = external_exports.discriminatedUnion("entityType", [
2154
+ changeRecordBaseSchema.extend({
2155
+ entityType: external_exports.literal("vault"),
2156
+ entityId: vaultIdSchema
2157
+ }),
2158
+ changeRecordBaseSchema.extend({
2159
+ entityType: external_exports.literal("group"),
2160
+ entityId: groupIdSchema
2161
+ }),
2162
+ changeRecordBaseSchema.extend({
2163
+ entityType: external_exports.literal("item"),
2164
+ entityId: itemIdSchema
2165
+ }),
2166
+ changeRecordBaseSchema.extend({
2167
+ entityType: external_exports.literal("attachment"),
2168
+ entityId: attachmentIdSchema
2169
+ })
2170
+ ]).superRefine((change, context) => {
2171
+ if (change.serverSequence === 0) {
2172
+ context.addIssue({
2173
+ code: "custom",
2174
+ message: "Change records require a positive server sequence",
2175
+ path: ["serverSequence"]
2176
+ });
2177
+ }
2178
+ if (change.operation !== "purge" && change.ciphertextHash === void 0) {
2179
+ context.addIssue({
2180
+ code: "custom",
2181
+ message: "Non-purge changes require the applicable content hash",
2182
+ path: ["ciphertextHash"]
2183
+ });
2184
+ }
2185
+ if (change.entityType === "vault" && change.entityId !== change.vaultId) {
2186
+ context.addIssue({
2187
+ code: "custom",
2188
+ message: "A vault change must identify its containing vault",
2189
+ path: ["entityId"]
2190
+ });
2191
+ }
2192
+ });
2193
+ var publicDeviceRecordObjectSchema = external_exports.object({
2194
+ id: deviceIdSchema,
2195
+ vaultId: vaultIdSchema,
2196
+ schemaVersion: supportedSchemaVersionSchema,
2197
+ tokenVersion: supportedTokenVersionSchema,
2198
+ encryptedLabel: encryptedDeviceLabelSchema.optional(),
2199
+ scopes: apiScopesSchema,
2200
+ createdAt: timestampSchema,
2201
+ lastSeenAt: timestampSchema.optional(),
2202
+ revokedAt: timestampSchema.optional()
2203
+ }).strict();
2204
+ function validateDeviceBinding(device, context) {
2205
+ if (device.encryptedLabel !== void 0 && (device.encryptedLabel.aad.vaultId !== device.vaultId || device.encryptedLabel.aad.schemaVersion !== device.schemaVersion || device.encryptedLabel.aad.entityType !== "device-label" || device.encryptedLabel.aad.entityId !== device.id)) {
2206
+ context.addIssue({
2207
+ code: "custom",
2208
+ message: "Encrypted device label has invalid associated data",
2209
+ path: ["encryptedLabel", "aad"]
2210
+ });
2211
+ }
2212
+ }
2213
+ var publicDeviceRecordSchema = publicDeviceRecordObjectSchema.superRefine(validateDeviceBinding);
2214
+ var deviceRecordSchema = publicDeviceRecordObjectSchema.extend({ tokenHash: sha256DigestSchema }).superRefine(validateDeviceBinding);
2215
+ var outboundObservationKindSchema = external_exports.enum([
2216
+ "generic-push",
2217
+ "template-publication"
2218
+ ]);
2219
+ var outboundObservationContentObjectSchema = external_exports.object({
2220
+ version: external_exports.literal(1),
2221
+ kind: outboundObservationKindSchema,
2222
+ batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2223
+ requestHash: sha256DigestSchema,
2224
+ responseHash: sha256DigestSchema,
2225
+ responseVaultRevision: vaultRevisionSchema,
2226
+ replayFromServerSequence: changeSequenceSchema,
2227
+ requiredThroughServerSequence: changeSequenceSchema
2228
+ }).strict();
2229
+ function validateObservationSequence(observation, context) {
2230
+ if (observation.requiredThroughServerSequence < observation.replayFromServerSequence) {
2231
+ context.addIssue({
2232
+ code: "custom",
2233
+ message: "The required sequence cannot precede the replay start",
2234
+ path: ["requiredThroughServerSequence"]
2235
+ });
2236
+ }
2237
+ }
2238
+ var outboundObservationContentSchema = outboundObservationContentObjectSchema.superRefine(validateObservationSequence);
2239
+ var outboundObservationSchema = outboundObservationContentObjectSchema.extend({ observationId: sha256DigestSchema }).strict().superRefine(validateObservationSequence);
2240
+ var protectedLocalDeviceStateSchema = external_exports.object({
2241
+ version: external_exports.literal(2),
2242
+ vaultId: vaultIdSchema,
2243
+ deviceId: deviceIdSchema,
2244
+ highestSeenVaultRevision: vaultRevisionSchema,
2245
+ updatedAt: timestampSchema,
2246
+ outboundObservation: outboundObservationSchema.optional(),
2247
+ lastCompletedObservationId: sha256DigestSchema.optional()
2248
+ }).strict().superRefine((state, context) => {
2249
+ if (state.outboundObservation !== void 0 && state.outboundObservation.responseVaultRevision > state.highestSeenVaultRevision) {
2250
+ context.addIssue({
2251
+ code: "custom",
2252
+ message: "The protected anchor must include the observed response revision",
2253
+ path: ["highestSeenVaultRevision"]
2254
+ });
2255
+ }
2256
+ });
2257
+ var tombstoneRecordBaseSchema = external_exports.object({
2258
+ vaultId: vaultIdSchema,
2259
+ state: external_exports.enum(["deleted", "restored"]),
2260
+ tombstoneRevision: recordRevisionSchema,
2261
+ lastRecordRevision: recordRevisionSchema,
2262
+ lastCiphertextHash: sha256DigestSchema,
2263
+ deletedAt: timestampSchema,
2264
+ restoredAt: timestampSchema.optional(),
2265
+ purgeAfter: timestampSchema.optional()
2266
+ }).strict();
2267
+ var tombstoneRecordSchema = external_exports.discriminatedUnion("entityType", [
2268
+ tombstoneRecordBaseSchema.extend({
2269
+ entityType: external_exports.literal("vault"),
2270
+ entityId: vaultIdSchema
2271
+ }),
2272
+ tombstoneRecordBaseSchema.extend({
2273
+ entityType: external_exports.literal("group"),
2274
+ entityId: groupIdSchema
2275
+ }),
2276
+ tombstoneRecordBaseSchema.extend({
2277
+ entityType: external_exports.literal("item"),
2278
+ entityId: itemIdSchema
2279
+ }),
2280
+ tombstoneRecordBaseSchema.extend({
2281
+ entityType: external_exports.literal("attachment"),
2282
+ entityId: attachmentIdSchema
2283
+ })
2284
+ ]).superRefine((tombstone, context) => {
2285
+ if (tombstone.tombstoneRevision <= tombstone.lastRecordRevision) {
2286
+ context.addIssue({
2287
+ code: "custom",
2288
+ message: "Tombstone revision must be newer than the deleted record",
2289
+ path: ["tombstoneRevision"]
2290
+ });
2291
+ }
2292
+ if (tombstone.entityType === "vault" && tombstone.entityId !== tombstone.vaultId) {
2293
+ context.addIssue({
2294
+ code: "custom",
2295
+ message: "A vault tombstone must identify its containing vault",
2296
+ path: ["entityId"]
2297
+ });
2298
+ }
2299
+ if (tombstone.state === "restored" && tombstone.restoredAt === void 0) {
2300
+ context.addIssue({
2301
+ code: "custom",
2302
+ message: "Restored tombstones require a restoration timestamp",
2303
+ path: ["restoredAt"]
2304
+ });
2305
+ }
2306
+ if (tombstone.state === "deleted" && tombstone.restoredAt !== void 0) {
2307
+ context.addIssue({
2308
+ code: "custom",
2309
+ message: "Deleted tombstones cannot have a restoration timestamp",
2310
+ path: ["restoredAt"]
2311
+ });
2312
+ }
2313
+ if (tombstone.state === "restored" && tombstone.purgeAfter !== void 0) {
2314
+ context.addIssue({
2315
+ code: "custom",
2316
+ message: "Restored tombstones cannot remain scheduled for purge",
2317
+ path: ["purgeAfter"]
2318
+ });
2319
+ }
2320
+ });
2321
+ var opaqueMutationSchema = external_exports.discriminatedUnion("entityType", [
2322
+ external_exports.object({
2323
+ entityType: external_exports.literal("vault"),
2324
+ expectedVaultRevision: vaultRevisionSchema.nullable(),
2325
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2326
+ record: vaultRecordSchema
2327
+ }).strict(),
2328
+ external_exports.object({
2329
+ entityType: external_exports.literal("group"),
2330
+ expectedRecordRevision: recordRevisionSchema.nullable(),
2331
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2332
+ record: encryptedGroupRecordSchema
2333
+ }).strict(),
2334
+ external_exports.object({
2335
+ entityType: external_exports.literal("item"),
2336
+ expectedRecordRevision: recordRevisionSchema.nullable(),
2337
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2338
+ record: encryptedItemRecordSchema
2339
+ }).strict()
2340
+ ]);
2341
+ var attachmentStreamStartInputSchema = external_exports.object({
2342
+ version: external_exports.literal(1),
2343
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2344
+ expectedAttachmentRevision: recordRevisionSchema.nullable(),
2345
+ header: persistedAttachmentHeaderRecordSchema
2346
+ }).strict().superRefine((input, context) => {
2347
+ const expectedNewRevision = input.expectedAttachmentRevision === null ? 0 : input.expectedAttachmentRevision + 1;
2348
+ if (input.header.recordRevision !== expectedNewRevision) {
2349
+ context.addIssue({
2350
+ code: "custom",
2351
+ message: "Staged header revision must immediately follow the expected attachment",
2352
+ path: ["header", "recordRevision"]
2353
+ });
2354
+ }
2355
+ if (attachmentHeaderContentHash(input.header) !== input.header.contentHash) {
2356
+ context.addIssue({
2357
+ code: "custom",
2358
+ message: "Staged attachment headers require their exact canonical content hash",
2359
+ path: ["header", "contentHash"]
2360
+ });
2361
+ }
2362
+ });
2363
+ var attachmentStreamProgressCountersSchema = external_exports.object({
2364
+ version: external_exports.literal(1),
2365
+ nextChunkIndex: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS),
2366
+ totalPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES),
2367
+ totalCiphertextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_STREAM_CIPHERTEXT_BYTES)
2368
+ });
2369
+ var attachmentStreamProgressSchema = external_exports.discriminatedUnion("state", [
2370
+ attachmentStreamProgressCountersSchema.extend({
2371
+ state: external_exports.literal("empty"),
2372
+ nextChunkIndex: external_exports.literal(0),
2373
+ totalPlaintextBytes: external_exports.literal(0),
2374
+ totalCiphertextBytes: external_exports.literal(0)
2375
+ }).strict(),
2376
+ attachmentStreamProgressCountersSchema.extend({
2377
+ state: external_exports.literal("writing"),
2378
+ nextChunkIndex: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
2379
+ lastChunkIndex: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS - 1),
2380
+ lastChunkCiphertextHash: sha256DigestSchema,
2381
+ lastChunkPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES)
2382
+ }).strict(),
2383
+ attachmentStreamProgressCountersSchema.extend({
2384
+ state: external_exports.literal("ready-to-finalize"),
2385
+ nextChunkIndex: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
2386
+ lastChunkIndex: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS - 1),
2387
+ lastChunkCiphertextHash: sha256DigestSchema,
2388
+ lastChunkPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES)
2389
+ }).strict()
2390
+ ]).superRefine((progress, context) => {
2391
+ if (progress.state === "empty")
2392
+ return;
2393
+ if (progress.state === "writing" && progress.nextChunkIndex === MAX_ATTACHMENT_CHUNKS) {
2394
+ context.addIssue({
2395
+ code: "custom",
2396
+ message: "The maximum chunk count requires final-chunk state",
2397
+ path: ["state"]
2398
+ });
2399
+ }
2400
+ if (progress.lastChunkIndex !== progress.nextChunkIndex - 1) {
2401
+ context.addIssue({
2402
+ code: "custom",
2403
+ message: "Last chunk index must immediately precede the next chunk index",
2404
+ path: ["lastChunkIndex"]
2405
+ });
2406
+ }
2407
+ if (progress.totalCiphertextBytes !== progress.totalPlaintextBytes + progress.nextChunkIndex * SECRETSTREAM_CHUNK_OVERHEAD_BYTES) {
2408
+ context.addIssue({
2409
+ code: "custom",
2410
+ message: "Staging byte totals must include exactly one overhead per chunk",
2411
+ path: ["totalCiphertextBytes"]
2412
+ });
2413
+ }
2414
+ });
2415
+ var attachmentStreamFinalizeInputSchema = external_exports.object({
2416
+ version: external_exports.literal(1),
2417
+ record: encryptedAttachmentRecordSchema
2418
+ }).strict();
2419
+ var syncCursorSchema = external_exports.object({
2420
+ vaultId: vaultIdSchema,
2421
+ serverSequence: changeSequenceSchema,
2422
+ highestSeenVaultRevision: vaultRevisionSchema
2423
+ }).strict();
2424
+ var syncStateSchema = external_exports.enum([
2425
+ "synced",
2426
+ "offline",
2427
+ "syncing",
2428
+ "conflict",
2429
+ "error"
2430
+ ]);
2431
+ var syncConflictResolutionStrategySchema = external_exports.enum([
2432
+ "keep-local",
2433
+ "accept-remote"
2434
+ ]);
2435
+ var syncConflictResolutionSchema = external_exports.object({
2436
+ version: external_exports.literal(1),
2437
+ strategy: syncConflictResolutionStrategySchema,
2438
+ currentRevision: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
2439
+ replacementIdempotencyKey: external_exports.string().nullable(),
2440
+ resolvedAt: timestampSchema
2441
+ }).strict();
2442
+
2443
+ // ../../packages/schemas/dist/api.js
2444
+ var healthResponseSchema = external_exports.object({ status: external_exports.literal("ok") }).strict();
2445
+ var readinessResponseSchema = external_exports.object({ status: external_exports.enum(["ready", "not_ready"]) }).strict();
2446
+ var CONTROL_LIST_CURSOR_VERSION = 1;
2447
+ var DEFAULT_CONTROL_LIST_PAGE_SIZE = 50;
2448
+ var MAX_CONTROL_LIST_PAGE_SIZE = 200;
2449
+ var MAX_CONTROL_LIST_CURSOR_CHARS = 512;
2450
+ var MAX_SYNC_PUSH_MUTATIONS = 100;
2451
+ var MAX_TEMPLATE_MIGRATION_RESULTS = 100;
2452
+ var MAX_SYNC_PULL_PAGE_CHANGES = 500;
2453
+ var controlListCursorPayloadBaseSchema = external_exports.object({
2454
+ version: external_exports.literal(CONTROL_LIST_CURSOR_VERSION),
2455
+ vaultId: vaultIdSchema,
2456
+ createdAt: timestampSchema
2457
+ }).strict();
2458
+ var controlListCursorPayloadSchema = external_exports.discriminatedUnion("resource", [
2459
+ controlListCursorPayloadBaseSchema.extend({
2460
+ resource: external_exports.literal("invites"),
2461
+ id: inviteIdSchema
2462
+ }).strict(),
2463
+ controlListCursorPayloadBaseSchema.extend({
2464
+ resource: external_exports.literal("devices"),
2465
+ id: deviceIdSchema
2466
+ }).strict()
2467
+ ]);
2468
+ var boundedControlListCursorSchema = external_exports.string().min(1).max(MAX_CONTROL_LIST_CURSOR_CHARS).pipe(base64UrlSchema).brand();
2469
+ function encodeControlListCursor(payload) {
2470
+ const parsedPayload = controlListCursorPayloadSchema.parse(payload);
2471
+ return boundedControlListCursorSchema.parse(Buffer.from(canonicalJson(parsedPayload), "utf8").toString("base64url"));
2472
+ }
2473
+ function decodeCanonicalControlListCursor(cursor) {
2474
+ try {
2475
+ const parsedCursor = boundedControlListCursorSchema.parse(cursor);
2476
+ const json = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(parsedCursor, "base64url"));
2477
+ const payload = controlListCursorPayloadSchema.parse(JSON.parse(json));
2478
+ if (encodeControlListCursor(payload) !== parsedCursor) {
2479
+ throw new TypeError("Noncanonical control-list cursor");
2480
+ }
2481
+ return payload;
2482
+ } catch {
2483
+ throw new TypeError("Invalid control-list cursor");
2484
+ }
2485
+ }
2486
+ function decodeControlListCursor(cursor) {
2487
+ return decodeCanonicalControlListCursor(cursor);
2488
+ }
2489
+ var controlListCursorSchema = boundedControlListCursorSchema.superRefine((cursor, context) => {
2490
+ try {
2491
+ decodeCanonicalControlListCursor(cursor);
2492
+ } catch {
2493
+ context.addIssue({
2494
+ code: "custom",
2495
+ message: "Control-list cursor is malformed or noncanonical"
2496
+ });
2497
+ }
2498
+ });
2499
+ var apiBearerTokenSchema = external_exports.string().length(43).regex(/^[A-Za-z0-9_-]+$/, "Bearer tokens use canonical unpadded base64url").refine((value) => Buffer.from(value, "base64url").toString("base64url") === value, {
2500
+ error: "Bearer tokens use canonical unpadded base64url"
2501
+ }).brand();
2502
+ var apiErrorResponseSchema = external_exports.object({
2503
+ error: external_exports.object({
2504
+ code: external_exports.string().min(1).max(64),
2505
+ message: external_exports.string().min(1).max(256),
2506
+ conflict: external_exports.object({
2507
+ entityType: external_exports.enum(["vault", "group", "item", "attachment"]),
2508
+ entityId: external_exports.string().min(1).max(128),
2509
+ expectedRevision: external_exports.number().int().nonnegative().nullable(),
2510
+ currentRevision: external_exports.number().int().nonnegative().nullable()
2511
+ }).strict().optional()
2512
+ }).strict()
2513
+ }).strict();
2514
+ var inviteIssueRequestSchema = external_exports.object({
2515
+ scopes: apiScopesSchema,
2516
+ expiresInSeconds: external_exports.number().int().min(60).max(86400)
2517
+ }).strict();
2518
+ var inviteIssueResponseSchema = external_exports.object({
2519
+ inviteId: inviteIdSchema,
2520
+ inviteToken: apiBearerTokenSchema,
2521
+ expiresAt: timestampSchema
2522
+ }).strict();
2523
+ var publicInviteRecordSchema = external_exports.object({
2524
+ id: inviteIdSchema,
2525
+ vaultId: vaultIdSchema,
2526
+ issuedByDeviceId: deviceIdSchema,
2527
+ scopes: apiScopesSchema,
2528
+ state: external_exports.enum(["active", "redeemed", "revoked", "expired"]),
2529
+ createdAt: timestampSchema,
2530
+ expiresAt: timestampSchema,
2531
+ consumedAt: timestampSchema.optional(),
2532
+ revokedAt: timestampSchema.optional()
2533
+ }).strict().superRefine((invite, context) => {
2534
+ if (invite.state === "redeemed" !== (invite.consumedAt !== void 0)) {
2535
+ context.addIssue({
2536
+ code: "custom",
2537
+ path: ["consumedAt"],
2538
+ message: "Only redeemed invites carry a consumption timestamp"
2539
+ });
2540
+ }
2541
+ if (invite.state === "revoked" !== (invite.revokedAt !== void 0)) {
2542
+ context.addIssue({
2543
+ code: "custom",
2544
+ path: ["revokedAt"],
2545
+ message: "Only revoked invites carry a revocation timestamp"
2546
+ });
2547
+ }
2548
+ });
2549
+ var inviteListPageResponseSchema = external_exports.object({
2550
+ invites: external_exports.array(publicInviteRecordSchema).max(MAX_CONTROL_LIST_PAGE_SIZE),
2551
+ nextCursor: controlListCursorSchema.nullable()
2552
+ }).strict().superRefine((page, context) => {
2553
+ validateControlListPage("invites", page.invites, page.nextCursor, context);
2554
+ });
2555
+ var vaultInvitePathSchema = external_exports.object({ vaultId: vaultIdSchema, inviteId: inviteIdSchema }).strict();
2556
+ var inviteRedeemResponseSchema = external_exports.object({
2557
+ vaultId: vaultIdSchema,
2558
+ expiresAt: timestampSchema,
2559
+ vault: vaultRecordSchema
2560
+ }).strict().refine((response) => response.vault.id === response.vaultId, {
2561
+ path: ["vault", "id"],
2562
+ error: "Redeemed vaults must match the invite vault"
2563
+ });
2564
+ var enrollmentCompleteRequestSchema = external_exports.object({
2565
+ vaultId: vaultIdSchema,
2566
+ deviceId: deviceIdSchema,
2567
+ schemaVersion: supportedSchemaVersionSchema,
2568
+ encryptedLabel: encryptedDeviceLabelSchema.optional()
2569
+ }).strict().superRefine((request, context) => {
2570
+ validateDeviceLabelBinding(request.encryptedLabel, request.vaultId, request.deviceId, request.schemaVersion, context, ["encryptedLabel", "aad"]);
2571
+ });
2572
+ var enrollmentCompleteResponseSchema = external_exports.object({
2573
+ vaultId: vaultIdSchema,
2574
+ deviceId: deviceIdSchema
2575
+ }).strict();
2576
+ var apiSessionResponseSchema = external_exports.object({
2577
+ vaultId: vaultIdSchema,
2578
+ deviceId: deviceIdSchema,
2579
+ scopes: apiScopesSchema
2580
+ }).strict();
2581
+ var vaultBootstrapRequestSchema = external_exports.object({
2582
+ vault: vaultRecordSchema,
2583
+ device: external_exports.object({
2584
+ id: deviceIdSchema,
2585
+ schemaVersion: supportedSchemaVersionSchema,
2586
+ encryptedLabel: encryptedDeviceLabelSchema.optional()
2587
+ }).strict()
2588
+ }).strict().superRefine((request, context) => {
2589
+ if (request.vault.revision !== 0) {
2590
+ context.addIssue({
2591
+ code: "custom",
2592
+ path: ["vault", "revision"],
2593
+ message: "Initial vaults must start at revision zero"
2594
+ });
2595
+ }
2596
+ if (request.vault.createdAt !== request.vault.updatedAt) {
2597
+ context.addIssue({
2598
+ code: "custom",
2599
+ path: ["vault", "updatedAt"],
2600
+ message: "Initial vault timestamps must match"
2601
+ });
2602
+ }
2603
+ if (request.device.schemaVersion !== request.vault.schemaVersion) {
2604
+ context.addIssue({
2605
+ code: "custom",
2606
+ path: ["device", "schemaVersion"],
2607
+ message: "The first device and vault schema versions must match"
2608
+ });
2609
+ }
2610
+ validateDeviceLabelBinding(request.device.encryptedLabel, request.vault.id, request.device.id, request.device.schemaVersion, context, ["device", "encryptedLabel", "aad"]);
2611
+ });
2612
+ var vaultBootstrapResponseSchema = external_exports.object({
2613
+ vaultId: vaultIdSchema,
2614
+ deviceId: deviceIdSchema
2615
+ }).strict();
2616
+ var deviceListPageResponseSchema = external_exports.object({
2617
+ devices: external_exports.array(publicDeviceRecordSchema).max(MAX_CONTROL_LIST_PAGE_SIZE),
2618
+ nextCursor: controlListCursorSchema.nullable()
2619
+ }).strict().superRefine((page, context) => {
2620
+ validateControlListPage("devices", page.devices, page.nextCursor, context);
2621
+ });
2622
+ var vaultPathSchema = external_exports.object({ vaultId: vaultIdSchema }).strict();
2623
+ var vaultDevicePathSchema = external_exports.object({ vaultId: vaultIdSchema, deviceId: deviceIdSchema }).strict();
2624
+ var vaultKeySlotPathSchema = external_exports.object({ vaultId: vaultIdSchema, slotId: keySlotIdSchema }).strict();
2625
+ var vaultKeySlotUpdateRequestSchema = external_exports.object({
2626
+ expectedVaultRevision: vaultRevisionSchema,
2627
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2628
+ record: vaultRecordSchema,
2629
+ /** New slot mutations carry an opaque encrypted audit sidecar. */
2630
+ audit: encryptedAuditRecordSchema.optional()
2631
+ }).strict().refine((value) => value.record.revision === value.expectedVaultRevision + 1, {
2632
+ path: ["record", "revision"],
2633
+ error: "Key-slot updates must advance the vault revision exactly once"
2634
+ });
2635
+ var decimalIntegerQuerySchema = external_exports.string().regex(/^(?:0|[1-9][0-9]*)$/, "Must be a canonical nonnegative integer").transform((value, context) => {
2636
+ const parsed = Number(value);
2637
+ if (!Number.isSafeInteger(parsed)) {
2638
+ context.addIssue({
2639
+ code: "custom",
2640
+ message: "Integer is outside the safe range"
2641
+ });
2642
+ return external_exports.NEVER;
2643
+ }
2644
+ return parsed;
2645
+ });
2646
+ var numericControlListPageLimitSchema = external_exports.number().int().min(1).max(MAX_CONTROL_LIST_PAGE_SIZE);
2647
+ var controlListPageOptionsSchema = external_exports.object({
2648
+ limit: numericControlListPageLimitSchema.default(DEFAULT_CONTROL_LIST_PAGE_SIZE),
2649
+ cursor: controlListCursorSchema.optional()
2650
+ }).strict();
2651
+ var controlListPageLimitQuerySchema = decimalIntegerQuerySchema.pipe(numericControlListPageLimitSchema);
2652
+ var controlListPageQuerySchema = external_exports.object({
2653
+ limit: controlListPageLimitQuerySchema.optional(),
2654
+ cursor: controlListCursorSchema.optional()
2655
+ }).strict().transform((query) => controlListPageOptionsSchema.parse(query));
2656
+ var attachmentTransferPathSchema = external_exports.object({
2657
+ vaultId: vaultIdSchema,
2658
+ groupId: groupIdSchema,
2659
+ itemId: itemIdSchema,
2660
+ attachmentId: attachmentIdSchema
2661
+ }).strict();
2662
+ var attachmentChunkPathSchema = attachmentTransferPathSchema.extend({ chunkIndex: decimalIntegerQuerySchema }).strict().refine((path) => path.chunkIndex < MAX_ATTACHMENT_CHUNKS, {
2663
+ path: ["chunkIndex"],
2664
+ error: "Attachment chunk index is outside the canonical bound"
2665
+ });
2666
+ var attachmentChunkStageRequestSchema = external_exports.object({
2667
+ start: attachmentStreamStartInputSchema,
2668
+ chunk: persistedAttachmentChunkRecordSchema
2669
+ }).strict().superRefine((request, context) => {
2670
+ validateAttachmentTransportIdentity(request.start, request.chunk.record, request.chunk.recordRevision, context, ["chunk"]);
2671
+ });
2672
+ var attachmentFinalizeRequestSchema = external_exports.object({
2673
+ start: attachmentStreamStartInputSchema,
2674
+ finalize: attachmentStreamFinalizeInputSchema
2675
+ }).strict().superRefine((request, context) => {
2676
+ validateAttachmentTransportIdentity(request.start, request.finalize.record, request.finalize.record.recordRevision, context, ["finalize", "record"]);
2677
+ });
2678
+ var syncPullQuerySchema = external_exports.object({
2679
+ serverSequence: decimalIntegerQuerySchema.default(0),
2680
+ highestSeenVaultRevision: decimalIntegerQuerySchema,
2681
+ limit: decimalIntegerQuerySchema.default(100)
2682
+ }).strict().transform((value) => ({
2683
+ serverSequence: changeSequenceSchema.parse(value.serverSequence),
2684
+ highestSeenVaultRevision: vaultRevisionSchema.parse(value.highestSeenVaultRevision),
2685
+ limit: value.limit
2686
+ })).refine((value) => value.limit >= 1 && value.limit <= MAX_SYNC_PULL_PAGE_CHANGES, {
2687
+ path: ["limit"],
2688
+ error: "Sync pull limits must be between 1 and 500"
2689
+ });
2690
+ var opaqueSyncRecordSchema = external_exports.union([
2691
+ vaultRecordSchema,
2692
+ encryptedGroupRecordSchema,
2693
+ encryptedItemRecordSchema,
2694
+ encryptedAttachmentRecordSchema,
2695
+ tombstoneRecordSchema
2696
+ ]);
2697
+ var syncPulledChangeSchema = external_exports.object({
2698
+ change: changeRecordSchema,
2699
+ record: opaqueSyncRecordSchema.nullable()
2700
+ }).strict().superRefine((pulled, context) => {
2701
+ const { change, record } = pulled;
2702
+ if (change.operation === "purge") {
2703
+ if (record !== null) {
2704
+ context.addIssue({
2705
+ code: "custom",
2706
+ path: ["record"],
2707
+ message: "Purged changes cannot include a record"
2708
+ });
2709
+ }
2710
+ return;
2711
+ }
2712
+ if (record === null || syncRecordVaultId(record) !== change.vaultId || syncRecordEntityType(record) !== change.entityType || syncRecordId(record) !== change.entityId || syncRecordRevision(record) !== change.recordRevision) {
2713
+ context.addIssue({
2714
+ code: "custom",
2715
+ path: ["record"],
2716
+ message: "Pulled records must be bound to their change metadata"
2717
+ });
2718
+ return;
2719
+ }
2720
+ if (change.operation === "tombstone" && (!isTombstoneRecord(record) || record.state !== "deleted")) {
2721
+ context.addIssue({
2722
+ code: "custom",
2723
+ path: ["record"],
2724
+ message: "Tombstone changes require a deleted tombstone record"
2725
+ });
2726
+ }
2727
+ if ((change.operation === "upsert" || change.operation === "restore") && !isCurrentOpaqueRecord(record)) {
2728
+ context.addIssue({
2729
+ code: "custom",
2730
+ path: ["record"],
2731
+ message: "Upsert and restore changes require a current encrypted record"
2732
+ });
2733
+ }
2734
+ });
2735
+ var syncPullResponseSchema = external_exports.object({
2736
+ vaultId: vaultIdSchema,
2737
+ serverVaultRevision: vaultRevisionSchema,
2738
+ changes: external_exports.array(syncPulledChangeSchema).max(MAX_SYNC_PULL_PAGE_CHANGES),
2739
+ nextCursor: syncCursorSchema,
2740
+ hasMore: external_exports.boolean()
2741
+ }).strict().superRefine((page, context) => {
2742
+ if (page.nextCursor.vaultId !== page.vaultId || page.nextCursor.highestSeenVaultRevision !== page.serverVaultRevision) {
2743
+ context.addIssue({
2744
+ code: "custom",
2745
+ path: ["nextCursor"],
2746
+ message: "The next cursor must be bound to the returned vault revision"
2747
+ });
2748
+ }
2749
+ if (page.changes.some(({ change }) => change.vaultId !== page.vaultId)) {
2750
+ context.addIssue({
2751
+ code: "custom",
2752
+ path: ["changes"],
2753
+ message: "All changes must belong to the response vault"
2754
+ });
2755
+ }
2756
+ if (page.hasMore && page.changes.length === 0) {
2757
+ context.addIssue({
2758
+ code: "custom",
2759
+ path: ["hasMore"],
2760
+ message: "A nonterminal page must contain at least one change"
2761
+ });
2762
+ }
2763
+ });
2764
+ var syncPushRequestSchema = external_exports.object({
2765
+ vaultId: vaultIdSchema,
2766
+ batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2767
+ mutations: external_exports.array(opaqueMutationSchema).min(1).max(MAX_SYNC_PUSH_MUTATIONS)
2768
+ }).strict().superRefine((batch, context) => {
2769
+ const keys = /* @__PURE__ */ new Set();
2770
+ for (const [index, mutation] of batch.mutations.entries()) {
2771
+ if (syncMutationVaultId(mutation) !== batch.vaultId) {
2772
+ context.addIssue({
2773
+ code: "custom",
2774
+ path: ["mutations", index],
2775
+ message: "Every mutation must belong to the batch vault"
2776
+ });
2777
+ }
2778
+ if (keys.has(mutation.idempotencyKey)) {
2779
+ context.addIssue({
2780
+ code: "custom",
2781
+ path: ["mutations", index, "idempotencyKey"],
2782
+ message: "Mutation idempotency keys must be unique within a batch"
2783
+ });
2784
+ }
2785
+ keys.add(mutation.idempotencyKey);
2786
+ const expected = mutation.entityType === "vault" ? mutation.expectedVaultRevision : mutation.expectedRecordRevision;
2787
+ const revision = mutation.entityType === "vault" ? mutation.record.revision : mutation.record.recordRevision;
2788
+ if (revision !== (expected === null ? 0 : expected + 1)) {
2789
+ context.addIssue({
2790
+ code: "custom",
2791
+ path: ["mutations", index, "record"],
2792
+ message: "Mutations must advance their expected revision exactly once"
2793
+ });
2794
+ }
2795
+ }
2796
+ });
2797
+ var syncAcceptedPushResultSchema = external_exports.object({
2798
+ status: external_exports.literal("accepted"),
2799
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2800
+ disposition: external_exports.enum(["committed", "duplicate"]),
2801
+ change: changeRecordSchema
2802
+ }).strict();
2803
+ var syncConflictingPushResultSchema = external_exports.object({
2804
+ status: external_exports.literal("conflict"),
2805
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2806
+ currentRevision: external_exports.union([vaultRevisionSchema, recordRevisionSchema]),
2807
+ current: opaqueSyncRecordSchema.nullable()
2808
+ }).strict();
2809
+ var syncPushResponseSchema = external_exports.object({
2810
+ vaultId: vaultIdSchema,
2811
+ serverVaultRevision: vaultRevisionSchema,
2812
+ batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2813
+ results: external_exports.array(external_exports.discriminatedUnion("status", [
2814
+ syncAcceptedPushResultSchema,
2815
+ syncConflictingPushResultSchema
2816
+ ])).min(1).max(MAX_SYNC_PUSH_MUTATIONS)
2817
+ }).strict();
2818
+ var templateMigrationPublicationRequestSchema = syncPushRequestSchema.superRefine((batch, context) => {
2819
+ const entityIds = /* @__PURE__ */ new Set();
2820
+ const itemIds = [];
2821
+ let groupMutation;
2822
+ for (const [index, mutation] of batch.mutations.entries()) {
2823
+ if (mutation.entityType !== "group" && mutation.entityType !== "item") {
2824
+ context.addIssue({
2825
+ code: "custom",
2826
+ path: ["mutations", index, "entityType"],
2827
+ message: "Template migration batches accept only group and item mutations"
2828
+ });
2829
+ continue;
2830
+ }
2831
+ if (mutation.expectedRecordRevision === null || mutation.record.tombstonedAt !== void 0) {
2832
+ context.addIssue({
2833
+ code: "custom",
2834
+ path: ["mutations", index],
2835
+ message: "Template migration mutations must update active current records"
2836
+ });
2837
+ }
2838
+ if (entityIds.has(mutation.record.id)) {
2839
+ context.addIssue({
2840
+ code: "custom",
2841
+ path: ["mutations", index, "record", "id"],
2842
+ message: "Template migration entity IDs must be unique"
2843
+ });
2844
+ }
2845
+ entityIds.add(mutation.record.id);
2846
+ if (mutation.entityType === "group") {
2847
+ if (groupMutation !== void 0) {
2848
+ context.addIssue({
2849
+ code: "custom",
2850
+ path: ["mutations", index],
2851
+ message: "A template migration batch requires exactly one group mutation"
2852
+ });
2853
+ }
2854
+ groupMutation = mutation;
2855
+ } else {
2856
+ itemIds.push(mutation.record.id);
2857
+ }
2858
+ }
2859
+ if (groupMutation === void 0) {
2860
+ context.addIssue({
2861
+ code: "custom",
2862
+ path: ["mutations"],
2863
+ message: "A template migration batch requires one group mutation"
2864
+ });
2865
+ return;
2866
+ }
2867
+ if (batch.mutations.at(-1) !== groupMutation) {
2868
+ context.addIssue({
2869
+ code: "custom",
2870
+ path: ["mutations"],
2871
+ message: "The group mutation must be last"
2872
+ });
2873
+ }
2874
+ for (const [index, mutation] of batch.mutations.entries()) {
2875
+ if (mutation.entityType === "item" && mutation.record.groupId !== groupMutation.record.id) {
2876
+ context.addIssue({
2877
+ code: "custom",
2878
+ path: ["mutations", index, "record", "groupId"],
2879
+ message: "Every item must belong to the migrated group"
2880
+ });
2881
+ }
2882
+ }
2883
+ const sortedItemIds = [...itemIds].sort();
2884
+ if (itemIds.some((itemId, index) => itemId !== sortedItemIds[index])) {
2885
+ context.addIssue({
2886
+ code: "custom",
2887
+ path: ["mutations"],
2888
+ message: "Item mutations must be ordered by item ID"
2889
+ });
2890
+ }
2891
+ });
2892
+ var templateMigrationPublicationResultSchema = external_exports.object({
2893
+ idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2894
+ change: changeRecordSchema
2895
+ }).strict().superRefine((result, context) => {
2896
+ if (result.change.entityType !== "group" && result.change.entityType !== "item" || result.change.operation !== "upsert") {
2897
+ context.addIssue({
2898
+ code: "custom",
2899
+ path: ["change"],
2900
+ message: "Template migration results require group or item upserts"
2901
+ });
2902
+ }
2903
+ });
2904
+ var templateMigrationPublicationResponseSchema = external_exports.object({
2905
+ vaultId: vaultIdSchema,
2906
+ batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
2907
+ serverVaultRevision: vaultRevisionSchema,
2908
+ results: external_exports.array(templateMigrationPublicationResultSchema).min(1).max(MAX_TEMPLATE_MIGRATION_RESULTS)
2909
+ }).strict().superRefine((response, context) => {
2910
+ const itemIds = [];
2911
+ let groupCount = 0;
2912
+ for (const [index, result] of response.results.entries()) {
2913
+ if (result.change.vaultId !== response.vaultId) {
2914
+ context.addIssue({
2915
+ code: "custom",
2916
+ path: ["results", index, "change", "vaultId"],
2917
+ message: "Every result must belong to the response vault"
2918
+ });
2919
+ }
2920
+ if (index > 0) {
2921
+ const previous = response.results[index - 1];
2922
+ if (previous !== void 0 && result.change.serverSequence !== previous.change.serverSequence + 1) {
2923
+ context.addIssue({
2924
+ code: "custom",
2925
+ path: ["results", index, "change", "serverSequence"],
2926
+ message: "Result sequences must be contiguous"
2927
+ });
2928
+ }
2929
+ }
2930
+ if (result.change.entityType === "group")
2931
+ groupCount += 1;
2932
+ if (result.change.entityType === "item")
2933
+ itemIds.push(result.change.entityId);
2934
+ }
2935
+ if (groupCount !== 1 || response.results.at(-1)?.change.entityType !== "group") {
2936
+ context.addIssue({
2937
+ code: "custom",
2938
+ path: ["results"],
2939
+ message: "Results require exactly one group upsert last"
2940
+ });
2941
+ }
2942
+ const sortedItemIds = [...itemIds].sort();
2943
+ if (itemIds.some((itemId, index) => itemId !== sortedItemIds[index])) {
2944
+ context.addIssue({
2945
+ code: "custom",
2946
+ path: ["results"],
2947
+ message: "Item results must be ordered by item ID"
2948
+ });
2949
+ }
2950
+ });
2951
+ function validateDeviceLabelBinding(encryptedLabel, vaultId, deviceId, schemaVersion, context, path) {
2952
+ if (encryptedLabel !== void 0 && (encryptedLabel.aad.vaultId !== vaultId || encryptedLabel.aad.entityId !== deviceId || encryptedLabel.aad.schemaVersion !== schemaVersion)) {
2953
+ context.addIssue({
2954
+ code: "custom",
2955
+ path,
2956
+ message: "Encrypted device labels must match their containing request"
2957
+ });
2958
+ }
2959
+ }
2960
+ function validateControlListPage(resource, rows, nextCursor, context) {
2961
+ const firstRow = rows[0];
2962
+ if (firstRow !== void 0 && rows.some((row) => row.vaultId !== firstRow.vaultId)) {
2963
+ context.addIssue({
2964
+ code: "custom",
2965
+ message: "Every control-list page row must belong to one vault",
2966
+ path: [resource]
2967
+ });
2968
+ }
2969
+ if (nextCursor === null)
2970
+ return;
2971
+ const finalRow = rows.at(-1);
2972
+ if (finalRow === void 0) {
2973
+ context.addIssue({
2974
+ code: "custom",
2975
+ message: "An empty control-list page cannot carry a next cursor",
2976
+ path: ["nextCursor"]
2977
+ });
2978
+ return;
2979
+ }
2980
+ let cursorPayload;
2981
+ try {
2982
+ cursorPayload = decodeControlListCursor(nextCursor);
2983
+ } catch {
2984
+ context.addIssue({
2985
+ code: "custom",
2986
+ message: "Control-list page carries an invalid next cursor",
2987
+ path: ["nextCursor"]
2988
+ });
2989
+ return;
2990
+ }
2991
+ if (cursorPayload.resource !== resource || cursorPayload.vaultId !== finalRow.vaultId || cursorPayload.createdAt !== finalRow.createdAt || cursorPayload.id !== finalRow.id) {
2992
+ context.addIssue({
2993
+ code: "custom",
2994
+ message: "Next cursor must identify the final control-list page row",
2995
+ path: ["nextCursor"]
2996
+ });
2997
+ }
2998
+ }
2999
+ function validateAttachmentTransportIdentity(start, record, recordRevision, context, path) {
3000
+ const header = start.header;
3001
+ const attachmentId = "id" in record ? record.id : record.attachmentId;
3002
+ const keyVersions = "id" in record ? [record.wrappedAttachmentKey.keyVersion, record.encryptedManifest.keyVersion] : [record.keyVersion];
3003
+ if (record.vaultId !== header.record.vaultId || record.groupId !== header.record.groupId || record.itemId !== header.record.itemId || attachmentId !== header.record.attachmentId || record.schemaVersion !== header.record.schemaVersion || keyVersions.some((keyVersion) => keyVersion !== header.record.keyVersion) || recordRevision !== header.recordRevision) {
3004
+ context.addIssue({
3005
+ code: "custom",
3006
+ path,
3007
+ message: "Attachment transport records must share one exact stream identity"
3008
+ });
3009
+ }
3010
+ }
3011
+ function isTombstoneRecord(record) {
3012
+ return "state" in record;
3013
+ }
3014
+ function isCurrentOpaqueRecord(record) {
3015
+ return !isTombstoneRecord(record) && (!("tombstonedAt" in record) || record.tombstonedAt === void 0);
3016
+ }
3017
+ function syncRecordVaultId(record) {
3018
+ return "vaultId" in record ? record.vaultId : record.id;
3019
+ }
3020
+ function syncRecordId(record) {
3021
+ return isTombstoneRecord(record) ? record.entityId : record.id;
3022
+ }
3023
+ function syncRecordEntityType(record) {
3024
+ if (isTombstoneRecord(record))
3025
+ return record.entityType;
3026
+ if ("revision" in record)
3027
+ return "vault";
3028
+ if ("itemId" in record)
3029
+ return "attachment";
3030
+ if ("groupId" in record)
3031
+ return "item";
3032
+ return "group";
3033
+ }
3034
+ function syncRecordRevision(record) {
3035
+ if (isTombstoneRecord(record))
3036
+ return record.tombstoneRevision;
3037
+ return "revision" in record ? record.revision : record.recordRevision;
3038
+ }
3039
+ function syncMutationVaultId(mutation) {
3040
+ return mutation.entityType === "vault" ? mutation.record.id : mutation.record.vaultId;
3041
+ }
3042
+
3043
+ // ../../packages/schemas/dist/audit.js
3044
+ var keySlotAuditPayloadSchema = external_exports.object({
3045
+ version: external_exports.literal(1),
3046
+ action: external_exports.enum(["create", "revoke"]),
3047
+ slotId: keySlotIdSchema,
3048
+ slotType: external_exports.enum(["portable-key", "passphrase", "recovery-key", "device-key"]),
3049
+ resultingState: external_exports.enum(["active", "revoked"]),
3050
+ keyVersion: keyVersionSchema,
3051
+ actorDeviceId: deviceIdSchema,
3052
+ occurredAt: timestampSchema
3053
+ }).strict();
3054
+ var auditEventClassSchema = external_exports.enum([
3055
+ "device",
3056
+ "slot",
3057
+ "mutation",
3058
+ "backup",
3059
+ "recovery"
3060
+ ]);
3061
+ var auditEventActionSchema = external_exports.enum([
3062
+ "create",
3063
+ "supersede",
3064
+ "revoke",
3065
+ "queue"
3066
+ ]);
3067
+ var auditEventStateSchema = external_exports.enum([
3068
+ "pending",
3069
+ "active",
3070
+ "superseded",
3071
+ "revoked"
3072
+ ]);
3073
+ var AUDIT_EVENT_ID_BOUNDS = { min: 1, max: 512 };
3074
+ var AUDIT_EVENT_SUBJECT_BOUNDS = { min: 1, max: 256 };
3075
+ var auditEventIdentifierSchema = external_exports.string().min(AUDIT_EVENT_ID_BOUNDS.min).max(AUDIT_EVENT_ID_BOUNDS.max).regex(/^[A-Za-z0-9][A-Za-z0-9._~:-]*$/u, {
3076
+ message: "Audit event identifiers accept only [A-Za-z0-9._~:-]"
3077
+ });
3078
+ var auditEventSubjectSchema = external_exports.string().min(AUDIT_EVENT_SUBJECT_BOUNDS.min).max(AUDIT_EVENT_SUBJECT_BOUNDS.max).regex(/^[A-Za-z0-9][A-Za-z0-9._~:-]*$/u, {
3079
+ message: "Audit event subjects accept only [A-Za-z0-9._~:-]"
3080
+ });
3081
+ var localAuditEventSchema = external_exports.object({
3082
+ version: external_exports.literal(1),
3083
+ eventId: auditEventIdentifierSchema,
3084
+ eventClass: auditEventClassSchema,
3085
+ action: auditEventActionSchema,
3086
+ subject: auditEventSubjectSchema,
3087
+ occurredAt: timestampSchema,
3088
+ keyVersion: keyVersionSchema.optional(),
3089
+ state: auditEventStateSchema.optional(),
3090
+ deviceId: deviceIdSchema.optional(),
3091
+ recordRevision: external_exports.number().int().nonnegative().optional()
3092
+ }).strict();
3093
+
3094
+ // ../../packages/schemas/dist/backup.js
3095
+ var DEFAULT_MAX_BACKUP_RECORDS = 2e6;
3096
+ var MAX_SUPPORTED_BACKUP_BYTES = 64 * 1024 * 1024 * 1024;
3097
+ var canonical32ByteValueSchema = base64UrlSchema.length(43).refine((value) => Buffer.from(value, "base64url").byteLength === 32, {
3098
+ error: "Value must canonically encode exactly 32 bytes"
3099
+ });
3100
+ var backupAuthenticationSaltSchema = canonical32ByteValueSchema.brand();
3101
+ var backupAuthenticationTagSchema = canonical32ByteValueSchema.brand();
3102
+ var backupAuthenticationSchema = external_exports.object({
3103
+ algorithm: external_exports.literal("hkdf-sha256+hmac-sha256"),
3104
+ salt: backupAuthenticationSaltSchema
3105
+ }).strict();
3106
+ var encryptedBackupHeaderSchema = external_exports.object({
3107
+ type: external_exports.literal("header"),
3108
+ format: external_exports.literal("kavrix-encrypted-backup"),
3109
+ version: external_exports.literal(1),
3110
+ vaultId: vaultIdSchema,
3111
+ schemaVersion: supportedSchemaVersionSchema,
3112
+ createdAt: timestampSchema,
3113
+ authentication: backupAuthenticationSchema
3114
+ }).strict();
3115
+ var encryptedBackupEntrySchema = external_exports.discriminatedUnion("kind", [
3116
+ external_exports.object({ kind: external_exports.literal("vault"), record: vaultRecordSchema }).strict(),
3117
+ external_exports.object({ kind: external_exports.literal("group"), record: encryptedGroupRecordSchema }).strict(),
3118
+ external_exports.object({ kind: external_exports.literal("item"), record: encryptedItemRecordSchema }).strict(),
3119
+ external_exports.object({ kind: external_exports.literal("attachment"), record: encryptedAttachmentRecordSchema }).strict(),
3120
+ external_exports.object({
3121
+ kind: external_exports.literal("attachment-header"),
3122
+ record: persistedAttachmentHeaderRecordSchema
3123
+ }).strict(),
3124
+ external_exports.object({
3125
+ kind: external_exports.literal("attachment-chunk"),
3126
+ record: persistedAttachmentChunkRecordSchema
3127
+ }).strict(),
3128
+ external_exports.object({ kind: external_exports.literal("audit"), record: encryptedAuditRecordSchema }).strict(),
3129
+ external_exports.object({ kind: external_exports.literal("history"), record: encryptedHistoryRecordSchema }).strict(),
3130
+ external_exports.object({
3131
+ kind: external_exports.literal("tombstone-predecessor"),
3132
+ entityType: external_exports.enum(["group", "item", "attachment"]),
3133
+ record: external_exports.union([
3134
+ encryptedGroupRecordSchema,
3135
+ encryptedItemRecordSchema,
3136
+ encryptedAttachmentRecordSchema
3137
+ ])
3138
+ }).strict().superRefine((entry, context) => {
3139
+ const actualType = "itemId" in entry.record ? "attachment" : "groupId" in entry.record ? "item" : "group";
3140
+ if (entry.entityType !== actualType) {
3141
+ context.addIssue({
3142
+ code: "custom",
3143
+ path: ["entityType"],
3144
+ message: "Tombstone predecessor kind does not match its opaque record"
3145
+ });
3146
+ }
3147
+ if (entry.record.tombstonedAt !== void 0) {
3148
+ context.addIssue({
3149
+ code: "custom",
3150
+ path: ["record", "tombstonedAt"],
3151
+ message: "Tombstone predecessor must be an active opaque record"
3152
+ });
3153
+ }
3154
+ }),
3155
+ external_exports.object({ kind: external_exports.literal("tombstone"), record: tombstoneRecordSchema }).strict()
3156
+ ]);
3157
+ var encryptedBackupFooterSchema = external_exports.object({
3158
+ type: external_exports.literal("footer"),
3159
+ version: external_exports.literal(1),
3160
+ recordCount: external_exports.number().int().positive().max(1e7),
3161
+ transcriptSha256: sha256DigestSchema,
3162
+ authenticationTag: backupAuthenticationTagSchema
3163
+ }).strict();
3164
+ var backupRecordCountSchema = external_exports.number().int().positive().max(DEFAULT_MAX_BACKUP_RECORDS);
3165
+ var backupSubcountSchema = external_exports.number().int().nonnegative().max(DEFAULT_MAX_BACKUP_RECORDS);
3166
+ var backupVerificationSchema = external_exports.object({
3167
+ header: encryptedBackupHeaderSchema,
3168
+ restoreSessionId: sha256DigestSchema,
3169
+ recordCount: backupRecordCountSchema,
3170
+ transcriptSha256: sha256DigestSchema,
3171
+ canonicalEntriesSha256: sha256DigestSchema
3172
+ }).strict();
3173
+ var selectedRestoreSlotSchema = external_exports.object({
3174
+ id: keySlotIdSchema,
3175
+ type: external_exports.enum(["portable-key", "passphrase", "recovery-key"]),
3176
+ keyVersion: keyVersionSchema
3177
+ }).strict();
3178
+ var verifiedRestoreCountsSchema = external_exports.object({
3179
+ vaults: external_exports.literal(1),
3180
+ groups: backupSubcountSchema,
3181
+ items: backupSubcountSchema,
3182
+ attachments: backupSubcountSchema,
3183
+ attachmentHeaders: backupSubcountSchema,
3184
+ attachmentChunks: backupSubcountSchema,
3185
+ tombstonePredecessors: external_exports.object({
3186
+ groups: backupSubcountSchema,
3187
+ items: backupSubcountSchema,
3188
+ attachments: backupSubcountSchema
3189
+ }).strict(),
3190
+ tombstones: backupSubcountSchema,
3191
+ histories: backupSubcountSchema,
3192
+ audits: backupSubcountSchema
3193
+ }).strict();
3194
+ var restoreKnownRecordsVerificationV1Schema = external_exports.object({
3195
+ version: external_exports.literal(1),
3196
+ scope: external_exports.literal("known-v1-records"),
3197
+ vaultId: vaultIdSchema,
3198
+ vaultRevision: vaultRevisionSchema,
3199
+ restoreSessionId: sha256DigestSchema,
3200
+ transcriptSha256: sha256DigestSchema,
3201
+ canonicalEntriesSha256: sha256DigestSchema,
3202
+ recordCount: backupRecordCountSchema,
3203
+ selectedSlot: selectedRestoreSlotSchema,
3204
+ verified: verifiedRestoreCountsSchema
3205
+ }).strict().superRefine((receipt, context) => {
3206
+ const predecessors = receipt.verified.tombstonePredecessors;
3207
+ const predecessorCount = predecessors.groups + predecessors.items + predecessors.attachments;
3208
+ const observedCount = receipt.verified.vaults + receipt.verified.groups + receipt.verified.items + receipt.verified.attachments + receipt.verified.attachmentHeaders + receipt.verified.attachmentChunks + predecessorCount + receipt.verified.tombstones + receipt.verified.histories + receipt.verified.audits;
3209
+ if (observedCount !== receipt.recordCount) {
3210
+ context.addIssue({
3211
+ code: "custom",
3212
+ path: ["recordCount"],
3213
+ message: "Restore verification counts do not match the backup record count"
3214
+ });
3215
+ }
3216
+ if (receipt.verified.attachmentHeaders !== receipt.verified.attachments) {
3217
+ context.addIssue({
3218
+ code: "custom",
3219
+ path: ["verified", "attachmentHeaders"],
3220
+ message: "Every verified attachment must have one verified header"
3221
+ });
3222
+ }
3223
+ if (receipt.verified.attachmentChunks < receipt.verified.attachments) {
3224
+ context.addIssue({
3225
+ code: "custom",
3226
+ path: ["verified", "attachmentChunks"],
3227
+ message: "Every verified attachment must have at least one verified chunk"
3228
+ });
3229
+ }
3230
+ if (receipt.verified.tombstones < predecessorCount) {
3231
+ context.addIssue({
3232
+ code: "custom",
3233
+ path: ["verified", "tombstones"],
3234
+ message: "Verified tombstones cannot have more predecessors than tombstones"
3235
+ });
3236
+ }
3237
+ });
3238
+ var restoreProgressStatusSchema = external_exports.object({
3239
+ protocolVersion: external_exports.literal(2),
3240
+ restoreSessionId: sha256DigestSchema,
3241
+ maximumBytes: external_exports.number().int().positive().max(MAX_SUPPORTED_BACKUP_BYTES),
3242
+ maximumRecords: backupRecordCountSchema,
3243
+ stagedBytes: external_exports.number().int().nonnegative().max(MAX_SUPPORTED_BACKUP_BYTES),
3244
+ stagedRecords: backupSubcountSchema,
3245
+ createdAt: timestampSchema,
3246
+ updatedAt: timestampSchema
3247
+ });
3248
+ var stagingRestoreStatusSchema = restoreProgressStatusSchema.extend({
3249
+ state: external_exports.literal("staging"),
3250
+ vaultId: vaultIdSchema.optional()
3251
+ }).strict();
3252
+ var sealedRestoreStatusSchema = restoreProgressStatusSchema.extend({
3253
+ state: external_exports.literal("sealed"),
3254
+ vaultId: vaultIdSchema,
3255
+ summary: backupVerificationSchema,
3256
+ sealedAt: timestampSchema
3257
+ }).strict();
3258
+ var publishedRestoreStatusSchema = restoreProgressStatusSchema.extend({
3259
+ state: external_exports.literal("published"),
3260
+ vaultId: vaultIdSchema,
3261
+ summary: backupVerificationSchema,
3262
+ sealedAt: timestampSchema,
3263
+ publishedAt: timestampSchema
3264
+ }).strict();
3265
+ var committedRestoreStatusSchema = external_exports.object({
3266
+ state: external_exports.literal("committed"),
3267
+ protocolVersion: external_exports.literal(2),
3268
+ restoreSessionId: sha256DigestSchema,
3269
+ summary: backupVerificationSchema,
3270
+ committedAt: timestampSchema
3271
+ }).strict();
3272
+ var abortedRestoreStatusSchema = external_exports.object({
3273
+ state: external_exports.literal("aborted"),
3274
+ protocolVersion: external_exports.literal(2),
3275
+ restoreSessionId: sha256DigestSchema,
3276
+ abortedAt: timestampSchema
3277
+ }).strict();
3278
+ var backupRestoreStatusSchema = external_exports.discriminatedUnion("state", [
3279
+ stagingRestoreStatusSchema,
3280
+ sealedRestoreStatusSchema,
3281
+ publishedRestoreStatusSchema,
3282
+ committedRestoreStatusSchema,
3283
+ abortedRestoreStatusSchema
3284
+ ]).superRefine((status, context) => {
3285
+ if ("stagedBytes" in status && status.stagedBytes > status.maximumBytes) {
3286
+ context.addIssue({
3287
+ code: "custom",
3288
+ path: ["stagedBytes"],
3289
+ message: "Staged bytes exceed the restore session bound"
3290
+ });
3291
+ }
3292
+ if ("stagedRecords" in status && status.stagedRecords > status.maximumRecords) {
3293
+ context.addIssue({
3294
+ code: "custom",
3295
+ path: ["stagedRecords"],
3296
+ message: "Staged records exceed the restore session bound"
3297
+ });
3298
+ }
3299
+ if ("stagedRecords" in status) {
3300
+ const hasStagedRecords = status.stagedRecords > 0;
3301
+ const hasStagedBytes = status.stagedBytes > 0;
3302
+ if (hasStagedRecords !== hasStagedBytes) {
3303
+ context.addIssue({
3304
+ code: "custom",
3305
+ path: ["stagedRecords"],
3306
+ message: "Restore staging record and byte progress must advance together"
3307
+ });
3308
+ }
3309
+ if (status.state === "staging" && status.vaultId !== void 0 !== hasStagedRecords) {
3310
+ context.addIssue({
3311
+ code: "custom",
3312
+ path: ["vaultId"],
3313
+ message: "Restore staging binds a vault exactly when its prefix is nonempty"
3314
+ });
3315
+ }
3316
+ }
3317
+ if (status.state === "staging" || status.state === "aborted")
3318
+ return;
3319
+ if (status.restoreSessionId !== status.summary.restoreSessionId) {
3320
+ context.addIssue({
3321
+ code: "custom",
3322
+ path: ["restoreSessionId"],
3323
+ message: "Restore status and authenticated summary identify different sessions"
3324
+ });
3325
+ }
3326
+ if (status.state === "committed")
3327
+ return;
3328
+ if (status.vaultId !== status.summary.header.vaultId) {
3329
+ context.addIssue({
3330
+ code: "custom",
3331
+ path: ["vaultId"],
3332
+ message: "Restore status and authenticated summary identify different vaults"
3333
+ });
3334
+ }
3335
+ if (status.stagedRecords !== status.summary.recordCount || status.summary.recordCount > status.maximumRecords) {
3336
+ context.addIssue({
3337
+ code: "custom",
3338
+ path: ["stagedRecords"],
3339
+ message: "Frozen restore progress does not match the authenticated summary"
3340
+ });
3341
+ }
3342
+ });
3343
+
3344
+ // ../../packages/schemas/dist/cli-contract.js
3345
+ var CLI_EXIT_CODES = Object.freeze({
3346
+ ok: 0,
3347
+ unclassifiedFailure: 1,
3348
+ usageError: 2,
3349
+ authenticationFailed: 10,
3350
+ credentialMissing: 11,
3351
+ authorizationDenied: 12,
3352
+ grantInvalid: 13,
3353
+ invalidConfiguration: 14,
3354
+ datastoreFailure: 15,
3355
+ securityIntegrityFailure: 16,
3356
+ confirmationRequired: 17
3357
+ });
3358
+ var CLI_ERROR_CODES = [
3359
+ "OK",
3360
+ "UNCLASSIFIED_FAILURE",
3361
+ "USAGE_ERROR",
3362
+ "AUTHENTICATION_FAILED",
3363
+ "CREDENTIAL_MISSING",
3364
+ "AUTHORIZATION_DENIED",
3365
+ "GRANT_INVALID",
3366
+ "INVALID_CONFIGURATION",
3367
+ "DATASTORE_FAILURE",
3368
+ "SECURITY_INTEGRITY_FAILURE",
3369
+ "CONFIRMATION_REQUIRED"
3370
+ ];
3371
+ var cliErrorCodeSchema = external_exports.enum(CLI_ERROR_CODES);
3372
+ var CLI_ERROR_EXIT_CODES = Object.freeze({
3373
+ OK: CLI_EXIT_CODES.ok,
3374
+ UNCLASSIFIED_FAILURE: CLI_EXIT_CODES.unclassifiedFailure,
3375
+ USAGE_ERROR: CLI_EXIT_CODES.usageError,
3376
+ AUTHENTICATION_FAILED: CLI_EXIT_CODES.authenticationFailed,
3377
+ CREDENTIAL_MISSING: CLI_EXIT_CODES.credentialMissing,
3378
+ AUTHORIZATION_DENIED: CLI_EXIT_CODES.authorizationDenied,
3379
+ GRANT_INVALID: CLI_EXIT_CODES.grantInvalid,
3380
+ INVALID_CONFIGURATION: CLI_EXIT_CODES.invalidConfiguration,
3381
+ DATASTORE_FAILURE: CLI_EXIT_CODES.datastoreFailure,
3382
+ SECURITY_INTEGRITY_FAILURE: CLI_EXIT_CODES.securityIntegrityFailure,
3383
+ CONFIRMATION_REQUIRED: CLI_EXIT_CODES.confirmationRequired
3384
+ });
3385
+ function exitCodeForCliError(code) {
3386
+ return CLI_ERROR_EXIT_CODES[code];
3387
+ }
3388
+ var cliErrorEnvelopeSchema = external_exports.object({
3389
+ error: external_exports.object({
3390
+ code: cliErrorCodeSchema,
3391
+ exitCode: external_exports.number().int().min(0).max(255),
3392
+ message: external_exports.string().min(1).max(1024)
3393
+ }).strict()
3394
+ }).strict();
3395
+
3396
+ // ../../packages/schemas/dist/database-container.js
3397
+ var DATABASE_CONTAINER_FORMAT = "kavrix-encrypted-database";
3398
+ var FILE_DATABASE_CONTAINER_FORMAT = "kavrix-file-database-container";
3399
+ var CURRENT_DATABASE_CONTAINER_VERSION = 1;
3400
+ var MAX_DATABASE_RECOVERY_SLOTS = 32;
3401
+ var MAX_DATABASE_VAULTS = 1e3;
3402
+ var databaseRevisionSchema = external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).brand();
3403
+ var opaqueDatabaseEntityIdSchema = external_exports.union([
3404
+ databaseIdSchema,
3405
+ vaultIdSchema,
3406
+ keySlotIdSchema
3407
+ ]);
3408
+ var databaseAssociatedDataSchema = external_exports.object({
3409
+ version: external_exports.literal(1),
3410
+ databaseId: databaseIdSchema,
3411
+ entityType: external_exports.enum([
3412
+ "database-catalog",
3413
+ "wrapped-database-root",
3414
+ "wrapped-vault-root"
3415
+ ]),
3416
+ entityId: opaqueDatabaseEntityIdSchema,
3417
+ purpose: external_exports.enum(["catalog", "database-root", "vault-root"]),
3418
+ schemaVersion: supportedSchemaVersionSchema,
3419
+ keyVersion: keyVersionSchema,
3420
+ revision: databaseRevisionSchema,
3421
+ vaultId: vaultIdSchema.optional(),
3422
+ metadataDigest: sha256DigestSchema
3423
+ }).strict().superRefine((associatedData, context) => {
3424
+ const invalidRelation = associatedData.entityType === "database-catalog" && (associatedData.purpose !== "catalog" || associatedData.entityId !== associatedData.databaseId || associatedData.vaultId !== void 0) || associatedData.entityType === "wrapped-database-root" && (associatedData.purpose !== "database-root" || !keySlotIdSchema.safeParse(associatedData.entityId).success || associatedData.vaultId !== void 0) || associatedData.entityType === "wrapped-vault-root" && (associatedData.purpose !== "vault-root" || !vaultIdSchema.safeParse(associatedData.entityId).success || associatedData.vaultId === void 0 || associatedData.entityId !== associatedData.vaultId);
3425
+ if (invalidRelation) {
3426
+ context.addIssue({
3427
+ code: "custom",
3428
+ message: "Database associated data has an invalid entity, purpose, or identity binding"
3429
+ });
3430
+ }
3431
+ });
3432
+ var databaseAeadEnvelopeSchema = external_exports.object({
3433
+ version: envelopeVersionSchema,
3434
+ algorithm: external_exports.literal("xchacha20-poly1305-ietf"),
3435
+ nonce: base64UrlSchema,
3436
+ ciphertext: base64UrlSchema,
3437
+ authenticationTag: base64UrlSchema,
3438
+ aad: databaseAssociatedDataSchema,
3439
+ keyVersion: keyVersionSchema
3440
+ }).strict().superRefine((envelope, context) => {
3441
+ if (envelope.nonce.length !== AEAD_NONCE_BASE64URL_CHARS) {
3442
+ context.addIssue({
3443
+ code: "custom",
3444
+ message: "Nonce length does not match the authenticated-encryption algorithm",
3445
+ path: ["nonce"]
3446
+ });
3447
+ }
3448
+ if (envelope.authenticationTag.length !== AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS) {
3449
+ context.addIssue({
3450
+ code: "custom",
3451
+ message: "Authentication tag must encode 16 bytes",
3452
+ path: ["authenticationTag"]
3453
+ });
3454
+ }
3455
+ if (envelope.keyVersion !== envelope.aad.keyVersion) {
3456
+ context.addIssue({
3457
+ code: "custom",
3458
+ message: "Envelope key version must be authenticated in associated data",
3459
+ path: ["keyVersion"]
3460
+ });
3461
+ }
3462
+ });
3463
+ var databaseCatalogVaultSchema = external_exports.object({
3464
+ id: vaultIdSchema,
3465
+ label: external_exports.string().trim().min(1).max(256),
3466
+ createdAt: timestampSchema
3467
+ }).strict();
3468
+ var databaseCatalogPayloadSchema = external_exports.object({
3469
+ label: external_exports.string().trim().min(1).max(256),
3470
+ vaults: external_exports.array(databaseCatalogVaultSchema).max(MAX_DATABASE_VAULTS)
3471
+ }).strict().superRefine((catalog, context) => {
3472
+ const vaultIds = /* @__PURE__ */ new Set();
3473
+ for (const [index, vault] of catalog.vaults.entries()) {
3474
+ if (vaultIds.has(vault.id)) {
3475
+ context.addIssue({
3476
+ code: "custom",
3477
+ path: ["vaults", index, "id"],
3478
+ message: "Database catalog vault IDs must be unique"
3479
+ });
3480
+ }
3481
+ vaultIds.add(vault.id);
3482
+ }
3483
+ });
3484
+ var databasePortableKeyDerivationSchema = external_exports.object({
3485
+ algorithm: external_exports.literal("hkdf-sha256"),
3486
+ version: external_exports.literal(1),
3487
+ salt: base64UrlSchema.length(43),
3488
+ context: external_exports.literal("kavrix/database-root-wrap/v1"),
3489
+ outputLength: external_exports.literal(32)
3490
+ }).strict();
3491
+ var databaseRecoveryKeyDerivationSchema = external_exports.object({
3492
+ algorithm: external_exports.literal("hkdf-sha256"),
3493
+ version: external_exports.literal(1),
3494
+ salt: base64UrlSchema.length(43),
3495
+ context: external_exports.literal("kavrix/database-recovery-wrap/v1"),
3496
+ outputLength: external_exports.literal(32)
3497
+ }).strict();
3498
+ var databaseKeySlotBaseSchema = external_exports.object({
3499
+ slotVersion: keySlotVersionSchema,
3500
+ id: keySlotIdSchema,
3501
+ state: external_exports.enum(["active", "revoked"]),
3502
+ keyVersion: keyVersionSchema,
3503
+ wrappedDatabaseRoot: databaseAeadEnvelopeSchema,
3504
+ createdAt: timestampSchema,
3505
+ revokedAt: timestampSchema.optional()
3506
+ });
3507
+ var databasePortableKeySlotSchema = databaseKeySlotBaseSchema.extend({
3508
+ type: external_exports.literal("portable-key"),
3509
+ state: external_exports.literal("active"),
3510
+ derivation: databasePortableKeyDerivationSchema
3511
+ }).strict().superRefine((slot, context) => {
3512
+ if (slot.revokedAt !== void 0) {
3513
+ context.addIssue({
3514
+ code: "custom",
3515
+ path: ["revokedAt"],
3516
+ message: "Active database portable-key slots cannot have a revocation timestamp"
3517
+ });
3518
+ }
3519
+ validateDatabaseRootSlotBinding(slot, context);
3520
+ });
3521
+ var databaseRecoverySlotSchema = databaseKeySlotBaseSchema.extend({
3522
+ type: external_exports.literal("recovery-key"),
3523
+ derivation: databaseRecoveryKeyDerivationSchema
3524
+ }).strict().superRefine((slot, context) => {
3525
+ if (slot.state === "revoked" && slot.revokedAt === void 0) {
3526
+ context.addIssue({
3527
+ code: "custom",
3528
+ path: ["revokedAt"],
3529
+ message: "Revoked database recovery slots require a timestamp"
3530
+ });
3531
+ }
3532
+ if (slot.state === "active" && slot.revokedAt !== void 0) {
3533
+ context.addIssue({
3534
+ code: "custom",
3535
+ path: ["revokedAt"],
3536
+ message: "Active database recovery slots cannot have a revocation timestamp"
3537
+ });
3538
+ }
3539
+ validateDatabaseRootSlotBinding(slot, context);
3540
+ });
3541
+ var encryptedDatabaseDocumentSchema = external_exports.object({
3542
+ format: external_exports.literal(DATABASE_CONTAINER_FORMAT),
3543
+ version: external_exports.literal(CURRENT_DATABASE_CONTAINER_VERSION),
3544
+ id: databaseIdSchema,
3545
+ schemaVersion: supportedSchemaVersionSchema,
3546
+ cryptographicVersion: supportedCryptographicVersionSchema,
3547
+ currentKeyVersion: keyVersionSchema,
3548
+ keySlot: databasePortableKeySlotSchema,
3549
+ recoverySlots: external_exports.array(databaseRecoverySlotSchema).max(MAX_DATABASE_RECOVERY_SLOTS),
3550
+ revision: databaseRevisionSchema,
3551
+ encryptedCatalog: databaseAeadEnvelopeSchema,
3552
+ catalogMetadataDigest: sha256DigestSchema,
3553
+ createdAt: timestampSchema,
3554
+ updatedAt: timestampSchema
3555
+ }).strict().superRefine((database, context) => {
3556
+ if (database.keySlot.keyVersion !== database.currentKeyVersion) {
3557
+ context.addIssue({
3558
+ code: "custom",
3559
+ path: ["keySlot", "keyVersion"],
3560
+ message: "Database portable-key slot version must match the current key version"
3561
+ });
3562
+ }
3563
+ if (database.keySlot.wrappedDatabaseRoot.aad.databaseId !== database.id) {
3564
+ context.addIssue({
3565
+ code: "custom",
3566
+ path: ["keySlot", "wrappedDatabaseRoot", "aad", "databaseId"],
3567
+ message: "Database portable-key slot belongs to another database"
3568
+ });
3569
+ }
3570
+ const keySlotIds = /* @__PURE__ */ new Set([database.keySlot.id]);
3571
+ for (const [index, slot] of database.recoverySlots.entries()) {
3572
+ if (keySlotIds.has(slot.id)) {
3573
+ context.addIssue({
3574
+ code: "custom",
3575
+ path: ["recoverySlots", index, "id"],
3576
+ message: "Database key slot IDs must be unique"
3577
+ });
3578
+ }
3579
+ keySlotIds.add(slot.id);
3580
+ if (slot.keyVersion !== database.currentKeyVersion) {
3581
+ context.addIssue({
3582
+ code: "custom",
3583
+ path: ["recoverySlots", index, "keyVersion"],
3584
+ message: "Database recovery slot version must match the current key version"
3585
+ });
3586
+ }
3587
+ if (slot.wrappedDatabaseRoot.aad.databaseId !== database.id) {
3588
+ context.addIssue({
3589
+ code: "custom",
3590
+ path: ["recoverySlots", index, "wrappedDatabaseRoot", "aad", "databaseId"],
3591
+ message: "Database recovery slot belongs to another database"
3592
+ });
3593
+ }
3594
+ }
3595
+ const catalog = database.encryptedCatalog;
3596
+ if (catalog.aad.databaseId !== database.id || catalog.aad.schemaVersion !== database.schemaVersion || catalog.aad.keyVersion !== database.currentKeyVersion || catalog.aad.revision !== database.revision || catalog.aad.metadataDigest !== database.catalogMetadataDigest) {
3597
+ context.addIssue({
3598
+ code: "custom",
3599
+ path: ["encryptedCatalog", "aad"],
3600
+ message: "Encrypted database catalog has invalid associated data"
3601
+ });
3602
+ }
3603
+ });
3604
+ var databaseVaultDocumentSchema = external_exports.object({
3605
+ databaseId: databaseIdSchema,
3606
+ id: vaultIdSchema,
3607
+ schemaVersion: supportedSchemaVersionSchema,
3608
+ cryptographicVersion: supportedCryptographicVersionSchema,
3609
+ currentKeyVersion: keyVersionSchema,
3610
+ databaseRevision: databaseRevisionSchema,
3611
+ revision: vaultRevisionSchema,
3612
+ wrappedVaultRoot: databaseAeadEnvelopeSchema,
3613
+ encryptedPayload: aeadEnvelopeSchema,
3614
+ payloadMetadataDigest: sha256DigestSchema,
3615
+ createdAt: timestampSchema,
3616
+ updatedAt: timestampSchema
3617
+ }).strict().superRefine((vault, context) => {
3618
+ const wrappedRoot = vault.wrappedVaultRoot;
3619
+ if (wrappedRoot.aad.databaseId !== vault.databaseId || wrappedRoot.aad.vaultId !== vault.id || wrappedRoot.aad.schemaVersion !== vault.schemaVersion || wrappedRoot.aad.keyVersion !== vault.currentKeyVersion || wrappedRoot.aad.revision !== vault.databaseRevision) {
3620
+ context.addIssue({
3621
+ code: "custom",
3622
+ path: ["wrappedVaultRoot", "aad"],
3623
+ message: "Wrapped vault root has invalid associated data"
3624
+ });
3625
+ }
3626
+ const payload = vault.encryptedPayload;
3627
+ if (payload.aad.vaultId !== vault.id || !isVaultPreferencesPayloadDomain(payload.aad) || payload.aad.entityId !== vault.id || payload.aad.schemaVersion !== vault.schemaVersion || payload.aad.keyVersion !== vault.currentKeyVersion || payload.aad.revision !== vault.revision || payload.aad.metadataDigest !== vault.payloadMetadataDigest) {
3628
+ context.addIssue({
3629
+ code: "custom",
3630
+ path: ["encryptedPayload", "aad"],
3631
+ message: "Encrypted vault payload has invalid associated data"
3632
+ });
3633
+ }
3634
+ });
3635
+ function isVaultPreferencesPayloadDomain(value) {
3636
+ return value.entityType === "vault-preferences" && value.purpose === "vault-preferences";
3637
+ }
3638
+ var fileDatabaseContainerSchema = external_exports.object({
3639
+ format: external_exports.literal(FILE_DATABASE_CONTAINER_FORMAT),
3640
+ version: external_exports.literal(CURRENT_DATABASE_CONTAINER_VERSION),
3641
+ database: encryptedDatabaseDocumentSchema,
3642
+ vaults: external_exports.record(vaultIdSchema, databaseVaultDocumentSchema)
3643
+ }).strict().superRefine((container, context) => {
3644
+ const entries = Object.entries(container.vaults);
3645
+ if (entries.length > MAX_DATABASE_VAULTS) {
3646
+ context.addIssue({
3647
+ code: "custom",
3648
+ path: ["vaults"],
3649
+ message: "Database container contains too many vaults"
3650
+ });
3651
+ }
3652
+ for (const [vaultId, vault] of entries) {
3653
+ if (vaultId !== vault.id) {
3654
+ context.addIssue({
3655
+ code: "custom",
3656
+ path: ["vaults", vaultId],
3657
+ message: "Database container vault map keys must match vault IDs"
3658
+ });
3659
+ }
3660
+ if (vault.databaseId !== container.database.id) {
3661
+ context.addIssue({
3662
+ code: "custom",
3663
+ path: ["vaults", vaultId, "databaseId"],
3664
+ message: "Database container vault belongs to another database"
3665
+ });
3666
+ }
3667
+ }
3668
+ });
3669
+ function validateDatabaseRootSlotBinding(slot, context) {
3670
+ const envelope = slot.wrappedDatabaseRoot;
3671
+ if (envelope.aad.entityId !== slot.id) {
3672
+ context.addIssue({
3673
+ code: "custom",
3674
+ path: ["wrappedDatabaseRoot", "aad", "entityId"],
3675
+ message: "Database root slot envelope is bound to a different slot"
3676
+ });
3677
+ }
3678
+ if (envelope.keyVersion !== slot.keyVersion) {
3679
+ context.addIssue({
3680
+ code: "custom",
3681
+ path: ["wrappedDatabaseRoot", "keyVersion"],
3682
+ message: "Database root slot envelope version must match its slot"
3683
+ });
3684
+ }
3685
+ }
3686
+
3687
+ // ../../packages/schemas/dist/keychain.js
3688
+ var deviceUnlockSecretSchema = external_exports.instanceof(Uint8Array).refine((value) => value.byteLength === 32, {
3689
+ error: "Device unlock secrets must contain exactly 32 bytes"
3690
+ }).brand();
3691
+ var keychainLocatorSchema = external_exports.object({
3692
+ version: external_exports.literal(1),
3693
+ vaultId: vaultIdSchema,
3694
+ deviceId: deviceIdSchema,
3695
+ keySlotId: keySlotIdSchema
3696
+ }).strict();
3697
+ var sessionCredentialSecretSchema = external_exports.instanceof(Uint8Array).refine((value) => value.byteLength === 32, {
3698
+ error: "Session credential secrets must contain exactly 32 bytes"
3699
+ }).brand();
3700
+ var sessionCredentialLocatorSchema = external_exports.object({
3701
+ version: external_exports.literal(1),
3702
+ vaultId: vaultIdSchema,
3703
+ deviceId: deviceIdSchema,
3704
+ purpose: external_exports.literal("api-session")
3705
+ }).strict();
3706
+
3707
+ // ../../packages/schemas/dist/policy.js
3708
+ var MAX_CREDENTIAL_REFERENCE_CHARS = 256;
3709
+ var MAX_COMMANDS_PER_ENTRY = 64;
3710
+ var MAX_STORED_POLICIES = 128;
3711
+ var MAX_STORED_GRANTS = 128;
3712
+ var MAX_RUNTIME_AUDIT_EVENTS = 512;
3713
+ var MAX_PROJECT_POLICIES = 128;
3714
+ var MAX_PROJECT_ENVIRONMENTS = 32;
3715
+ var MAX_SECRETS_PER_ENVIRONMENT = 64;
3716
+ var MAX_PROJECT_AGENTS = 32;
3717
+ var MAX_PERMISSIONS_PER_AGENT = 64;
3718
+ var MAX_CONFIRMATION_TOKENS = 16;
3719
+ var MAX_ARGV_PREVIEW_ENTRIES = 8;
3720
+ var MAX_ARGV_PREVIEW_CHARS = 64;
3721
+ var MAX_POLICY_DURATION_MS = 30 * 24 * 60 * 60 * 1e3;
3722
+ var MAX_AUTHORIZATION_STATE_BYTES = 512 * 1024;
3723
+ var RESERVED_CREDENTIAL_REFERENCES = /* @__PURE__ */ new Set([
3724
+ "__proto__",
3725
+ "constructor",
3726
+ "prototype"
3727
+ ]);
3728
+ var credentialReferenceSchema = external_exports.string().min(1).max(MAX_CREDENTIAL_REFERENCE_CHARS).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), {
3729
+ message: "Credential references must not contain control characters"
3730
+ }).refine((value) => value.trim() === value, {
3731
+ message: "Credential references must not start or end with whitespace"
3732
+ }).refine((value) => !RESERVED_CREDENTIAL_REFERENCES.has(value), {
3733
+ message: "Credential reference is reserved"
3734
+ });
3735
+ var environmentNameSchema = external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u, "Invalid environment name");
3736
+ var ENVIRONMENT_VARIABLE_NAME_PATTERN_SOURCE = "^[A-Za-z_][A-Za-z0-9_]{0,127}$";
3737
+ var environmentVariableNameSchema = external_exports.string().regex(new RegExp(ENVIRONMENT_VARIABLE_NAME_PATTERN_SOURCE), "Invalid environment variable name");
3738
+ var commandNameSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/u, "Command names must be bare executable names");
3739
+ var commandTokenSchema = external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._=+-]*$/u, "Invalid command token");
3740
+ var opaquePattern = new RegExp(OPAQUE_ID_PATTERN_SOURCE);
3741
+ var opaqueIdentifierSchema = external_exports.string().min(1).max(128).regex(opaquePattern, "Must be an opaque identifier");
3742
+ var sha256HexDigestSchema = external_exports.string().regex(/^[0-9a-f]{64}$/u, "Must be a lowercase hex SHA-256 digest");
3743
+ var DURATION_PATTERN_SOURCE = "^([1-9][0-9]{0,6})([smhd])$";
3744
+ var durationPattern = new RegExp(DURATION_PATTERN_SOURCE);
3745
+ var durationSchema = external_exports.string().regex(durationPattern, "Invalid duration");
3746
+ function parseDurationToMs(value) {
3747
+ if (!durationPattern.test(value))
3748
+ return void 0;
3749
+ const match = durationPattern.exec(value);
3750
+ const amountText = match?.[1];
3751
+ const unit = match?.[2];
3752
+ if (amountText === void 0 || unit === void 0)
3753
+ return void 0;
3754
+ const amount = Number(amountText);
3755
+ if (!Number.isSafeInteger(amount) || amount <= 0)
3756
+ return void 0;
3757
+ const multiplier = UNIT_MULTIPLIERS[unit];
3758
+ if (multiplier === void 0)
3759
+ return void 0;
3760
+ const totalMs = amount * multiplier;
3761
+ return totalMs <= MAX_POLICY_DURATION_MS ? totalMs : void 0;
3762
+ }
3763
+ var UNIT_MULTIPLIERS = Object.freeze({
3764
+ s: 1e3,
3765
+ m: 6e4,
3766
+ h: 36e5,
3767
+ d: 864e5
3768
+ });
3769
+ var confirmationRequirementSchema = external_exports.union([
3770
+ external_exports.boolean(),
3771
+ external_exports.array(commandTokenSchema).min(1).max(MAX_CONFIRMATION_TOKENS)
3772
+ ]);
3773
+ var positiveMaxUsesSchema = external_exports.number().int().min(1).max(1e6);
3774
+ var workingDirectorySchema = external_exports.string().min(1).max(1024).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), {
3775
+ message: "Working directories must not contain control characters"
3776
+ });
3777
+ var permissionEntrySchema = external_exports.object({
3778
+ secret: credentialReferenceSchema.optional(),
3779
+ commands: external_exports.array(commandNameSchema).min(1).max(MAX_COMMANDS_PER_ENTRY).optional(),
3780
+ hashes: external_exports.record(commandNameSchema, sha256HexDigestSchema).optional(),
3781
+ env: environmentVariableNameSchema.optional(),
3782
+ reveal: external_exports.boolean().optional(),
3783
+ ttl: durationSchema.optional(),
3784
+ maxUses: positiveMaxUsesSchema.optional(),
3785
+ requireConfirmation: confirmationRequirementSchema.optional(),
3786
+ /** Restricts use to invocations whose working directory is inside this directory subtree. */
3787
+ workingDirectory: workingDirectorySchema.optional(),
3788
+ deny: external_exports.boolean().optional()
3789
+ }).strict().superRefine((entry, context) => {
3790
+ const deny = entry.deny === true;
3791
+ if (!deny) {
3792
+ if (entry.secret === void 0) {
3793
+ context.addIssue({
3794
+ code: "custom",
3795
+ message: "A permission entry requires a secret reference unless it denies",
3796
+ path: ["secret"]
3797
+ });
3798
+ }
3799
+ if (entry.commands === void 0) {
3800
+ context.addIssue({
3801
+ code: "custom",
3802
+ message: "A permission entry requires at least one allowed command",
3803
+ path: ["commands"]
3804
+ });
3805
+ }
3806
+ } else {
3807
+ for (const field of [
3808
+ "commands",
3809
+ "hashes",
3810
+ "ttl",
3811
+ "maxUses",
3812
+ "requireConfirmation",
3813
+ "workingDirectory"
3814
+ ]) {
3815
+ if (entry[field] !== void 0) {
3816
+ context.addIssue({
3817
+ code: "custom",
3818
+ message: "A deny entry must not carry allowlist fields",
3819
+ path: [field]
3820
+ });
3821
+ }
3822
+ }
3823
+ }
3824
+ if (entry.hashes === void 0 || entry.commands === void 0)
3825
+ return;
3826
+ const commands = new Set(entry.commands);
3827
+ for (const pinned of Object.keys(entry.hashes)) {
3828
+ if (!commands.has(pinned)) {
3829
+ context.addIssue({
3830
+ code: "custom",
3831
+ message: "Executable pins must reference listed commands",
3832
+ path: ["hashes"]
3833
+ });
3834
+ return;
3835
+ }
3836
+ }
3837
+ });
3838
+ function normalizePermissionEntryAliases(value) {
3839
+ if (!isPlainObject(value))
3840
+ return value;
3841
+ let renamed = false;
3842
+ const output = {};
3843
+ for (const [key, entryValue] of Object.entries(value)) {
3844
+ if (key === "require_confirmation") {
3845
+ output["requireConfirmation"] ??= entryValue;
3846
+ renamed = true;
3847
+ continue;
3848
+ }
3849
+ if (key === "max_uses") {
3850
+ output["maxUses"] ??= entryValue;
3851
+ renamed = true;
3852
+ continue;
3853
+ }
3854
+ output[key] = entryValue;
3855
+ }
3856
+ return renamed ? output : value;
3857
+ }
3858
+ function isPlainObject(value) {
3859
+ return typeof value === "object" && value !== null && !Array.isArray(value);
3860
+ }
3861
+ function normalizeProjectConfigAliases(input) {
3862
+ if (!isPlainObject(input))
3863
+ return input;
3864
+ let document = input;
3865
+ let changed = false;
3866
+ const policies = normalizedMap(document["policies"]);
3867
+ if (policies.changed) {
3868
+ document = { ...document, policies: policies.map };
3869
+ changed = true;
3870
+ }
3871
+ if (isPlainObject(document["agents"])) {
3872
+ const agents = {};
3873
+ let agentsChanged = false;
3874
+ for (const [agentId, agent] of Object.entries(document["agents"])) {
3875
+ if (!isPlainObject(agent)) {
3876
+ agents[agentId] = agent;
3877
+ continue;
3878
+ }
3879
+ const permissions = normalizedMap(agent["permissions"]);
3880
+ if (permissions.changed) {
3881
+ agents[agentId] = { ...agent, ["permissions"]: permissions.map };
3882
+ agentsChanged = true;
3883
+ continue;
3884
+ }
3885
+ agents[agentId] = agent;
3886
+ }
3887
+ if (agentsChanged) {
3888
+ document = { ...document, agents };
3889
+ changed = true;
3890
+ }
3891
+ }
3892
+ if (isPlainObject(document["environments"])) {
3893
+ const environments = {};
3894
+ let environmentsChanged = false;
3895
+ for (const [environmentId, environment] of Object.entries(document["environments"])) {
3896
+ if (!isPlainObject(environment)) {
3897
+ environments[environmentId] = environment;
3898
+ continue;
3899
+ }
3900
+ const policies2 = normalizedMap(environment["policies"]);
3901
+ if (policies2.changed) {
3902
+ environments[environmentId] = { ...environment, ["policies"]: policies2.map };
3903
+ environmentsChanged = true;
3904
+ continue;
3905
+ }
3906
+ environments[environmentId] = environment;
3907
+ }
3908
+ if (environmentsChanged) {
3909
+ document = { ...document, environments };
3910
+ changed = true;
3911
+ }
3912
+ }
3913
+ return changed ? document : input;
3914
+ }
3915
+ function normalizedMap(mapValue) {
3916
+ if (!isPlainObject(mapValue))
3917
+ return { changed: false, map: mapValue };
3918
+ const next = {};
3919
+ let changed = false;
3920
+ for (const [key, entry] of Object.entries(mapValue)) {
3921
+ const normalized = normalizePermissionEntryAliases(entry);
3922
+ if (normalized !== entry)
3923
+ changed = true;
3924
+ next[key] = normalized;
3925
+ }
3926
+ return changed ? { changed: true, map: next } : { changed: false, map: mapValue };
3927
+ }
3928
+ var projectEnvironmentSchema = external_exports.object({
3929
+ secrets: external_exports.record(environmentVariableNameSchema, credentialReferenceSchema).optional(),
3930
+ policies: external_exports.record(opaqueIdentifierSchema, permissionEntrySchema).optional()
3931
+ }).strict().superRefine((environment, context) => {
3932
+ if ((environment.secrets === void 0 ? 0 : Object.keys(environment.secrets).length) > MAX_SECRETS_PER_ENVIRONMENT) {
3933
+ context.addIssue({
3934
+ code: "custom",
3935
+ message: "An environment defines too many secret mappings",
3936
+ path: ["secrets"]
3937
+ });
3938
+ }
3939
+ if ((environment.policies === void 0 ? 0 : Object.keys(environment.policies).length) > MAX_PERMISSIONS_PER_AGENT) {
3940
+ context.addIssue({
3941
+ code: "custom",
3942
+ message: "An environment defines too many policies",
3943
+ path: ["policies"]
3944
+ });
3945
+ }
3946
+ });
3947
+ var projectAgentSchema = external_exports.object({
3948
+ permissions: external_exports.record(opaqueIdentifierSchema, permissionEntrySchema)
3949
+ }).strict().superRefine((agent, context) => {
3950
+ if (Object.keys(agent.permissions).length < 1) {
3951
+ context.addIssue({
3952
+ code: "custom",
3953
+ message: "An agent requires at least one permission entry",
3954
+ path: ["permissions"]
3955
+ });
3956
+ }
3957
+ if (Object.keys(agent.permissions).length > MAX_PERMISSIONS_PER_AGENT) {
3958
+ context.addIssue({
3959
+ code: "custom",
3960
+ message: "An agent defines too many permission entries",
3961
+ path: ["permissions"]
3962
+ });
3963
+ }
3964
+ });
3965
+ var projectConfigDocumentSchema = external_exports.object({
3966
+ version: external_exports.literal(1),
3967
+ project: slugSchema.optional(),
3968
+ environments: external_exports.record(environmentNameSchema, projectEnvironmentSchema).optional(),
3969
+ policies: external_exports.record(opaqueIdentifierSchema, permissionEntrySchema).optional(),
3970
+ agents: external_exports.record(opaqueIdentifierSchema, projectAgentSchema).optional()
3971
+ }).strict().superRefine((document, context) => {
3972
+ if ((document.environments === void 0 ? 0 : Object.keys(document.environments).length) > MAX_PROJECT_ENVIRONMENTS) {
3973
+ context.addIssue({
3974
+ code: "custom",
3975
+ message: "The project file defines too many environments",
3976
+ path: ["environments"]
3977
+ });
3978
+ }
3979
+ if ((document.agents === void 0 ? 0 : Object.keys(document.agents).length) > MAX_PROJECT_AGENTS) {
3980
+ context.addIssue({
3981
+ code: "custom",
3982
+ message: "The project file defines too many agents",
3983
+ path: ["agents"]
3984
+ });
3985
+ }
3986
+ const policyCount = (document.policies === void 0 ? 0 : Object.keys(document.policies).length) + Object.values(document.environments ?? {}).reduce((total, environment) => total + (environment.policies === void 0 ? 0 : Object.keys(environment.policies).length), 0);
3987
+ if (policyCount > MAX_PROJECT_POLICIES) {
3988
+ context.addIssue({
3989
+ code: "custom",
3990
+ message: "The project file defines too many policies",
3991
+ path: ["policies"]
3992
+ });
3993
+ }
3994
+ });
3995
+ var grantActorSchema = external_exports.enum(["user", "agent"]);
3996
+ var grantRecordSchema = external_exports.object({
3997
+ grantId: grantIdSchema,
3998
+ secret: credentialReferenceSchema,
3999
+ actor: grantActorSchema,
4000
+ commands: external_exports.array(commandNameSchema).min(1).max(MAX_COMMANDS_PER_ENTRY),
4001
+ hashes: external_exports.record(commandNameSchema, sha256HexDigestSchema).optional(),
4002
+ env: environmentVariableNameSchema.optional(),
4003
+ createdByPolicyId: opaqueIdentifierSchema.optional(),
4004
+ agentPermissionKey: opaqueIdentifierSchema.optional(),
4005
+ createdAt: timestampSchema,
4006
+ expiresAt: timestampSchema.optional(),
4007
+ maxUses: positiveMaxUsesSchema.optional(),
4008
+ usedCount: external_exports.number().int().nonnegative(),
4009
+ lastUsedAt: timestampSchema.optional(),
4010
+ revokedAt: timestampSchema.optional()
4011
+ }).strict().superRefine((grant, context) => {
4012
+ if (grant.maxUses !== void 0 && grant.usedCount > grant.maxUses) {
4013
+ context.addIssue({
4014
+ code: "custom",
4015
+ message: "A grant cannot record more uses than its maximum",
4016
+ path: ["usedCount"]
4017
+ });
4018
+ }
4019
+ if (grant.expiresAt !== void 0 && grant.expiresAt <= grant.createdAt) {
4020
+ context.addIssue({
4021
+ code: "custom",
4022
+ message: "A grant must expire after it was created",
4023
+ path: ["expiresAt"]
4024
+ });
4025
+ }
4026
+ if (grant.revokedAt !== void 0 && grant.revokedAt < grant.createdAt) {
4027
+ context.addIssue({
4028
+ code: "custom",
4029
+ message: "A grant cannot be revoked before it was created",
4030
+ path: ["revokedAt"]
4031
+ });
4032
+ }
4033
+ if (grant.hashes === void 0)
4034
+ return;
4035
+ const commands = new Set(grant.commands);
4036
+ for (const pinned of Object.keys(grant.hashes)) {
4037
+ if (!commands.has(pinned)) {
4038
+ context.addIssue({
4039
+ code: "custom",
4040
+ message: "Executable pins must reference granted commands",
4041
+ path: ["hashes"]
4042
+ });
4043
+ return;
4044
+ }
4045
+ }
4046
+ });
4047
+ var storedPolicyRecordSchema = external_exports.object({
4048
+ definition: permissionEntrySchema,
4049
+ createdAt: timestampSchema
4050
+ }).strict();
4051
+ var ALLOW_DECISION_REASONS = Object.freeze([
4052
+ "no-applicable-policy",
4053
+ "policy-allowed",
4054
+ "grant-allowed"
4055
+ ]);
4056
+ var CONFIRM_DECISION_REASONS = Object.freeze([
4057
+ "confirmation-required"
4058
+ ]);
4059
+ var DENY_DECISION_REASONS = Object.freeze([
4060
+ "policy-denied",
4061
+ "command-not-allowed",
4062
+ "hash-mismatch",
4063
+ "expired",
4064
+ "exhausted",
4065
+ "revoked",
4066
+ "reveal-forbidden-by-policy",
4067
+ "confirmation-declined",
4068
+ "confirmation-unavailable",
4069
+ "executable-unresolved",
4070
+ "executable-refused",
4071
+ "clock-invalid",
4072
+ "state-corrupt",
4073
+ "no-injection-mapping",
4074
+ "working-directory-mismatch",
4075
+ "invalid-request"
4076
+ ]);
4077
+ var authorizationReasonSchema = external_exports.enum([
4078
+ ...ALLOW_DECISION_REASONS,
4079
+ ...CONFIRM_DECISION_REASONS,
4080
+ ...DENY_DECISION_REASONS
4081
+ ]);
4082
+ var authorizationDecisionSchema = external_exports.discriminatedUnion("outcome", [
4083
+ external_exports.object({
4084
+ outcome: external_exports.literal("allow"),
4085
+ reason: external_exports.enum(ALLOW_DECISION_REASONS),
4086
+ policyId: opaqueIdentifierSchema.optional(),
4087
+ grantId: opaqueIdentifierSchema.optional(),
4088
+ secret: credentialReferenceSchema.optional()
4089
+ }).strict(),
4090
+ external_exports.object({
4091
+ outcome: external_exports.literal("confirm"),
4092
+ reason: external_exports.enum(CONFIRM_DECISION_REASONS),
4093
+ policyId: opaqueIdentifierSchema.optional(),
4094
+ secret: credentialReferenceSchema.optional()
4095
+ }).strict(),
4096
+ external_exports.object({
4097
+ outcome: external_exports.literal("deny"),
4098
+ reason: external_exports.enum(DENY_DECISION_REASONS),
4099
+ policyId: opaqueIdentifierSchema.optional(),
4100
+ grantId: opaqueIdentifierSchema.optional(),
4101
+ secret: credentialReferenceSchema.optional()
4102
+ }).strict()
4103
+ ]);
4104
+ var runtimeAuditActorSchema = external_exports.enum(["user", "agent"]);
4105
+ var runtimeAuditActionSchema = external_exports.enum([
4106
+ "unlock",
4107
+ "policy-created",
4108
+ "policy-updated",
4109
+ "policy-removed",
4110
+ "grant-created",
4111
+ "grant-revoked",
4112
+ "grant-expired",
4113
+ "grant-exhausted",
4114
+ "authorization-allowed",
4115
+ "authorization-denied",
4116
+ "reveal-attempted",
4117
+ "reveal-denied",
4118
+ "confirmation-requested",
4119
+ "confirmation-granted",
4120
+ "confirmation-declined",
4121
+ "execution-completed"
4122
+ ]);
4123
+ var sanitizedPreviewTextSchema = external_exports.string().min(1).max(MAX_ARGV_PREVIEW_CHARS).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), {
4124
+ message: "Audit preview text must not contain control characters"
4125
+ });
4126
+ var runtimeAuditEventSchema = external_exports.object({
4127
+ seq: external_exports.number().int().positive(),
4128
+ occurredAt: timestampSchema,
4129
+ actor: runtimeAuditActorSchema,
4130
+ action: runtimeAuditActionSchema,
4131
+ policyId: opaqueIdentifierSchema.optional(),
4132
+ grantId: opaqueIdentifierSchema.optional(),
4133
+ permissionKey: opaqueIdentifierSchema.optional(),
4134
+ secret: credentialReferenceSchema.optional(),
4135
+ command: commandNameSchema.optional(),
4136
+ argvPreview: external_exports.array(sanitizedPreviewTextSchema).max(MAX_ARGV_PREVIEW_ENTRIES).optional(),
4137
+ exitCode: external_exports.number().int().min(-2147483648).max(2147483647).optional(),
4138
+ reason: authorizationReasonSchema.optional()
4139
+ }).strict();
4140
+ var authorizationScopeKindSchema = external_exports.enum(["database", "vault"]);
4141
+ var authorizationStateDomainSchema = external_exports.literal("kavrix/authorization-state/v1");
4142
+ var authorizationEnvelopeContextSchema = external_exports.object({
4143
+ domain: authorizationStateDomainSchema,
4144
+ scopeKind: authorizationScopeKindSchema,
4145
+ scopeId: opaqueIdentifierSchema,
4146
+ sequence: external_exports.number().int().nonnegative()
4147
+ }).strict();
4148
+ var authorizationStateDocumentSchema = external_exports.object({
4149
+ version: external_exports.literal(1),
4150
+ policies: external_exports.record(opaqueIdentifierSchema, storedPolicyRecordSchema),
4151
+ grants: external_exports.record(grantIdSchema, grantRecordSchema),
4152
+ audit: external_exports.array(runtimeAuditEventSchema).max(MAX_RUNTIME_AUDIT_EVENTS)
4153
+ }).strict().superRefine((state, context) => {
4154
+ if (Object.keys(state.policies).length > MAX_STORED_POLICIES) {
4155
+ context.addIssue({
4156
+ code: "custom",
4157
+ message: "The authorization state holds too many policies",
4158
+ path: ["policies"]
4159
+ });
4160
+ }
4161
+ if (Object.keys(state.grants).length > MAX_STORED_GRANTS) {
4162
+ context.addIssue({
4163
+ code: "custom",
4164
+ message: "The authorization state holds too many grants",
4165
+ path: ["grants"]
4166
+ });
4167
+ }
4168
+ });
4169
+ var authorizationStateFormatSchema = external_exports.literal("kavrix-authorization-state");
4170
+ var authorizationStateEnvelopeSchema = external_exports.object({
4171
+ format: authorizationStateFormatSchema,
4172
+ version: external_exports.literal(1),
4173
+ scopeKind: authorizationScopeKindSchema,
4174
+ scopeId: opaqueIdentifierSchema,
4175
+ sequence: external_exports.number().int().nonnegative(),
4176
+ createdAt: timestampSchema,
4177
+ updatedAt: timestampSchema,
4178
+ nonce: base64UrlSchema.length(AEAD_NONCE_BASE64URL_CHARS),
4179
+ ciphertext: base64UrlSchema,
4180
+ authenticationTag: base64UrlSchema.length(AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS)
4181
+ }).strict();
4182
+ var BASE64_CHUNK_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;
4183
+ var MAX_BROKER_ARGV_ENTRIES = 128;
4184
+ var MAX_BROKER_ARG_CHARS = 8192;
4185
+ var MAX_BROKER_FRAME_BYTES = 2 * 1024 * 1024;
4186
+ var agentBrokerRequestSchema = external_exports.object({
4187
+ v: external_exports.literal(1),
4188
+ token: external_exports.string().min(32).max(256),
4189
+ op: external_exports.literal("exec"),
4190
+ permission: opaqueIdentifierSchema,
4191
+ argv: external_exports.array(external_exports.string().min(1).max(MAX_BROKER_ARG_CHARS)).min(1).max(MAX_BROKER_ARGV_ENTRIES)
4192
+ }).strict();
4193
+ var agentBrokerDecisionFrameSchema = external_exports.object({
4194
+ v: external_exports.literal(1),
4195
+ event: external_exports.literal("decision"),
4196
+ outcome: external_exports.enum(["allow", "deny"]),
4197
+ reason: authorizationReasonSchema
4198
+ }).strict();
4199
+ var agentBrokerOutputFrameSchema = external_exports.object({
4200
+ v: external_exports.literal(1),
4201
+ event: external_exports.enum(["stdout", "stderr"]),
4202
+ data: external_exports.string().regex(BASE64_CHUNK_PATTERN, "Frames carry standard base64")
4203
+ }).strict();
4204
+ var agentBrokerExitFrameSchema = external_exports.object({
4205
+ v: external_exports.literal(1),
4206
+ event: external_exports.literal("exit"),
4207
+ exitCode: external_exports.number().int().min(-2147483648).max(2147483647).nullable(),
4208
+ signal: external_exports.string().min(1).max(32).nullable()
4209
+ }).strict();
4210
+ var agentBrokerServerFrameSchema = external_exports.discriminatedUnion("event", [
4211
+ agentBrokerDecisionFrameSchema,
4212
+ agentBrokerOutputFrameSchema,
4213
+ agentBrokerExitFrameSchema
4214
+ ]);
4215
+ var agentBrokerClientFrameSchema = external_exports.discriminatedUnion("event", [
4216
+ external_exports.object({
4217
+ v: external_exports.literal(1),
4218
+ event: external_exports.literal("stdin"),
4219
+ data: external_exports.string().regex(BASE64_CHUNK_PATTERN)
4220
+ }).strict(),
4221
+ external_exports.object({ v: external_exports.literal(1), event: external_exports.literal("close-stdin") }).strict()
4222
+ ]);
4223
+
4224
+ // ../../packages/schemas/dist/rotation.js
4225
+ var portableKeyRotationStateSchema = external_exports.enum([
4226
+ "prepared",
4227
+ "pending-published",
4228
+ "active-published",
4229
+ "completed"
4230
+ ]);
4231
+ var rotationOperationIdSchema = external_exports.string().min(16).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._~-]*$/u);
4232
+ var portableKeyRotationCheckpointPayloadSchema = external_exports.object({
4233
+ version: external_exports.literal(1),
4234
+ vaultId: vaultIdSchema,
4235
+ operationId: rotationOperationIdSchema,
4236
+ sourceSlotId: keySlotIdSchema,
4237
+ replacementSlotId: keySlotIdSchema,
4238
+ sourceRevision: vaultRevisionSchema,
4239
+ remoteRevision: vaultRevisionSchema,
4240
+ sourceSlotDigest: sha256DigestSchema,
4241
+ replacementSlotDigest: sha256DigestSchema,
4242
+ transcriptDigest: sha256DigestSchema,
4243
+ state: portableKeyRotationStateSchema
4244
+ }).strict().superRefine((payload, context) => {
4245
+ if (payload.sourceSlotId === payload.replacementSlotId) {
4246
+ context.addIssue({
4247
+ code: "custom",
4248
+ path: ["replacementSlotId"],
4249
+ message: "A rotation must use distinct source and replacement slots"
4250
+ });
4251
+ }
4252
+ const offset = {
4253
+ prepared: 0,
4254
+ "pending-published": 1,
4255
+ "active-published": 2,
4256
+ completed: 3
4257
+ }[payload.state];
4258
+ if (payload.sourceRevision + offset !== payload.remoteRevision) {
4259
+ context.addIssue({
4260
+ code: "custom",
4261
+ path: ["remoteRevision"],
4262
+ message: "The checkpoint revision does not match its lifecycle state"
4263
+ });
4264
+ }
4265
+ });
4266
+ var portableKeyRotationCheckpointSchema = external_exports.object({
4267
+ payload: portableKeyRotationCheckpointPayloadSchema,
4268
+ authenticationTag: sha256DigestSchema
4269
+ }).strict();
4270
+ var portableKeyRotationSourceKindSchema = external_exports.enum([
4271
+ "generated-file",
4272
+ "imported-file"
4273
+ ]);
4274
+ var portableSlotSchema = keySlotSchema.refine((slot) => slot.type === "portable-key", {
4275
+ error: "Portable-key rotation requires portable-key slots"
4276
+ });
4277
+ var portableKeyRotationJournalRecordSchema = external_exports.object({
4278
+ version: external_exports.literal(1),
4279
+ kind: external_exports.literal("portable-key-rotation"),
4280
+ operationId: rotationOperationIdSchema,
4281
+ vaultId: vaultIdSchema,
4282
+ deviceId: deviceIdSchema,
4283
+ state: portableKeyRotationStateSchema,
4284
+ sourceKind: portableKeyRotationSourceKindSchema,
4285
+ sourceSlot: portableSlotSchema,
4286
+ replacementSlot: portableSlotSchema,
4287
+ sourceRevision: vaultRevisionSchema,
4288
+ createdAt: timestampSchema,
4289
+ updatedAt: timestampSchema,
4290
+ checkpoint: portableKeyRotationCheckpointSchema
4291
+ }).strict().superRefine((record, context) => {
4292
+ const expectedReplacementState = record.state === "prepared" || record.state === "pending-published" ? "pending" : "active";
4293
+ if (record.sourceSlot.state !== "active" || record.replacementSlot.state !== expectedReplacementState || record.sourceSlot.id === record.replacementSlot.id || record.sourceSlot.keyVersion !== record.replacementSlot.keyVersion || record.sourceRevision !== record.checkpoint.payload.sourceRevision || record.checkpoint.payload.vaultId !== record.vaultId || record.checkpoint.payload.operationId !== record.operationId || record.checkpoint.payload.sourceSlotId !== record.sourceSlot.id || record.checkpoint.payload.replacementSlotId !== record.replacementSlot.id || record.checkpoint.payload.state !== record.state) {
4294
+ context.addIssue({
4295
+ code: "custom",
4296
+ path: ["checkpoint"],
4297
+ message: "The rotation journal record and checkpoint must agree"
4298
+ });
4299
+ }
4300
+ });
4301
+ var PORTABLE_KEY_ROTATION_JOURNAL_MAX_SERIALIZED_BYTES = 64 * 1024;
4302
+
4303
+ // ../../packages/schemas/dist/session-lifetime.js
4304
+ var MIN_SESSION_TIMEOUT_MS = 1e3;
4305
+ var MAX_SESSION_TIMEOUT_MS = 864e5;
4306
+ var DEFAULT_INVOCATION_TIMEOUT_MS = 9e5;
4307
+ var DEFAULT_IDLE_TIMEOUT_MS = 12e4;
4308
+ var DEFAULT_REAUTHENTICATION_WINDOW_MS = 12e4;
4309
+ var sessionExpiryReasonSchema = external_exports.enum([
4310
+ /** The whole invocation reached its wall-clock limit. */
4311
+ "invocation-timeout",
4312
+ /** No activity was recorded within the inactivity limit. */
4313
+ "idle-timeout",
4314
+ /** The operator interrupted the invocation (SIGINT). */
4315
+ "interrupted",
4316
+ /** The supervisor asked the process to stop (SIGTERM). */
4317
+ "terminated",
4318
+ /** The controlling terminal went away (SIGHUP). */
4319
+ "hangup",
4320
+ /** The monotonic clock moved backward, so deadlines are unenforceable. */
4321
+ "clock-regression"
4322
+ ]);
4323
+ var sessionLifetimePolicySchema = external_exports.object({
4324
+ invocationTimeoutMs: external_exports.number().int().min(MIN_SESSION_TIMEOUT_MS).max(MAX_SESSION_TIMEOUT_MS),
4325
+ idleTimeoutMs: external_exports.number().int().min(MIN_SESSION_TIMEOUT_MS).max(MAX_SESSION_TIMEOUT_MS),
4326
+ reauthenticationWindowMs: external_exports.number().int().min(MIN_SESSION_TIMEOUT_MS).max(MAX_SESSION_TIMEOUT_MS)
4327
+ }).strict().superRefine((policy, context) => {
4328
+ if (policy.idleTimeoutMs > policy.invocationTimeoutMs) {
4329
+ context.addIssue({
4330
+ code: "custom",
4331
+ message: "An inactivity limit cannot exceed the invocation limit",
4332
+ path: ["idleTimeoutMs"]
4333
+ });
4334
+ }
4335
+ if (policy.reauthenticationWindowMs > policy.invocationTimeoutMs) {
4336
+ context.addIssue({
4337
+ code: "custom",
4338
+ message: "A reauthentication window cannot exceed the invocation limit",
4339
+ path: ["reauthenticationWindowMs"]
4340
+ });
4341
+ }
4342
+ });
4343
+ var DEFAULT_SESSION_LIFETIME_POLICY = Object.freeze({
4344
+ invocationTimeoutMs: DEFAULT_INVOCATION_TIMEOUT_MS,
4345
+ idleTimeoutMs: DEFAULT_IDLE_TIMEOUT_MS,
4346
+ reauthenticationWindowMs: DEFAULT_REAUTHENTICATION_WINDOW_MS
4347
+ });
4348
+
4349
+ // ../../packages/schemas/dist/transfer.js
4350
+ var DEFAULT_MAX_TRANSFER_DOCUMENTS = 2e4;
4351
+ var MAX_SUPPORTED_TRANSFER_BYTES = 512 * 1024 * 1024;
4352
+ var canonical32ByteValueSchema2 = base64UrlSchema.length(43).refine((value) => Buffer.from(value, "base64url").byteLength === 32, {
4353
+ error: "Value must canonically encode exactly 32 bytes"
4354
+ });
4355
+ var transferKeySaltSchema = canonical32ByteValueSchema2.brand();
4356
+ var transferAuthenticationTagSchema = canonical32ByteValueSchema2.brand();
4357
+ var transferProtectionSchema = external_exports.object({
4358
+ algorithm: external_exports.literal("argon2id+hkdf-sha256+xchacha20-poly1305-ietf"),
4359
+ derivation: passphraseDerivationSchema,
4360
+ expansionSalt: transferKeySaltSchema
4361
+ }).strict();
4362
+ var encryptedTransferHeaderSchema = external_exports.object({
4363
+ type: external_exports.literal("header"),
4364
+ format: external_exports.literal("kavrix-encrypted-transfer"),
4365
+ version: external_exports.literal(1),
4366
+ vaultId: vaultIdSchema,
4367
+ schemaVersion: supportedSchemaVersionSchema,
4368
+ createdAt: timestampSchema,
4369
+ protection: transferProtectionSchema
4370
+ }).strict();
4371
+ var transferWithholdingReasonSchema = external_exports.enum([
4372
+ /** The field definition sets `exportPolicy: 'never'`. */
4373
+ "export-policy",
4374
+ /** The value points at attachment content, which this format does not carry. */
4375
+ "attachment-unsupported",
4376
+ /** The value points at an item outside the exported set. */
4377
+ "unresolved-reference"
4378
+ ]);
4379
+ var transferWithholdingSchema = external_exports.object({
4380
+ stableKey: stableFieldKeySchema,
4381
+ scope: external_exports.enum(["template", "item"]),
4382
+ reason: transferWithholdingReasonSchema
4383
+ }).strict();
4384
+ var transferWithholdingsSchema = external_exports.array(transferWithholdingSchema).max(2e3).superRefine((withholdings, context) => {
4385
+ const seen = /* @__PURE__ */ new Set();
4386
+ for (const [index, withheld] of withholdings.entries()) {
4387
+ const key = `${withheld.scope}:${withheld.stableKey}`;
4388
+ if (seen.has(key)) {
4389
+ context.addIssue({
4390
+ code: "custom",
4391
+ message: "A withholding manifest cannot name the same field twice",
4392
+ path: [index, "stableKey"]
4393
+ });
4394
+ }
4395
+ seen.add(key);
4396
+ }
4397
+ });
4398
+ var encryptedTransferEntrySchema = external_exports.discriminatedUnion("kind", [
4399
+ external_exports.object({
4400
+ kind: external_exports.literal("group"),
4401
+ groupId: groupIdSchema,
4402
+ envelope: aeadEnvelopeSchema
4403
+ }).strict(),
4404
+ external_exports.object({
4405
+ kind: external_exports.literal("item"),
4406
+ groupId: groupIdSchema,
4407
+ itemId: itemIdSchema,
4408
+ envelope: aeadEnvelopeSchema,
4409
+ withheld: transferWithholdingsSchema
4410
+ }).strict()
4411
+ ]);
4412
+ var encryptedTransferFooterSchema = external_exports.object({
4413
+ type: external_exports.literal("footer"),
4414
+ version: external_exports.literal(1),
4415
+ groupCount: external_exports.number().int().nonnegative().max(DEFAULT_MAX_TRANSFER_DOCUMENTS),
4416
+ itemCount: external_exports.number().int().nonnegative().max(DEFAULT_MAX_TRANSFER_DOCUMENTS),
4417
+ transcriptSha256: canonical32ByteValueSchema2,
4418
+ authenticationTag: transferAuthenticationTagSchema
4419
+ }).strict();
4420
+ var transferLimitsSchema = external_exports.object({
4421
+ maximumBytes: external_exports.number().int().positive().max(MAX_SUPPORTED_TRANSFER_BYTES),
4422
+ maximumDocuments: external_exports.number().int().positive().max(DEFAULT_MAX_TRANSFER_DOCUMENTS)
4423
+ }).strict();
4424
+ var transferCollisionStrategySchema = external_exports.enum(["fail", "skip", "rename"]);
4425
+ var transferImportSummarySchema = external_exports.object({
4426
+ vaultId: vaultIdSchema,
4427
+ createdAt: timestampSchema,
4428
+ groupsCreated: external_exports.number().int().nonnegative(),
4429
+ groupsSkipped: external_exports.number().int().nonnegative(),
4430
+ itemsCreated: external_exports.number().int().nonnegative(),
4431
+ withheldValues: external_exports.number().int().nonnegative()
4432
+ }).strict();
4433
+
4434
+ export {
4435
+ vaultIdSchema,
4436
+ databaseIdSchema,
4437
+ profileIdSchema,
4438
+ keySlotIdSchema,
4439
+ itemIdSchema,
4440
+ attachmentIdSchema,
4441
+ policyIdSchema,
4442
+ grantIdSchema,
4443
+ MAX_CIPHERTEXT_CHARS,
4444
+ CURRENT_SCHEMA_VERSION,
4445
+ CURRENT_CRYPTOGRAPHIC_VERSION,
4446
+ timestampSchema,
4447
+ keyVersionSchema,
4448
+ supportedSchemaVersionSchema,
4449
+ supportedCryptographicVersionSchema,
4450
+ vaultRevisionSchema,
4451
+ secretValueSchema,
4452
+ sha256DigestSchema,
4453
+ associatedDataSchema,
4454
+ aeadEnvelopeSchema,
4455
+ portableKeyDerivationSchema,
4456
+ passphraseDerivationSchema,
4457
+ recoveryKeyDerivationSchema,
4458
+ keySlotSchema,
4459
+ canonicalJson,
4460
+ CLI_EXIT_CODES,
4461
+ cliErrorCodeSchema,
4462
+ exitCodeForCliError,
4463
+ MAX_DATABASE_VAULTS,
4464
+ databaseRevisionSchema,
4465
+ databaseAssociatedDataSchema,
4466
+ databaseAeadEnvelopeSchema,
4467
+ databaseCatalogPayloadSchema,
4468
+ databasePortableKeySlotSchema,
4469
+ databaseRecoverySlotSchema,
4470
+ encryptedDatabaseDocumentSchema,
4471
+ databaseVaultDocumentSchema,
4472
+ fileDatabaseContainerSchema,
4473
+ fieldValueElementIdSchema,
4474
+ fieldScalarValueSchema,
4475
+ fieldValueMatchesDefinition,
4476
+ itemPayloadSchema,
4477
+ CURRENT_LOCAL_VAULT_VERSION,
4478
+ MAX_LOCAL_RECOVERY_SLOTS,
4479
+ localVaultPayloadSchema,
4480
+ localVaultDocumentSchema,
4481
+ MAX_AUTHORIZATION_STATE_BYTES,
4482
+ environmentVariableNameSchema,
4483
+ parseDurationToMs,
4484
+ permissionEntrySchema,
4485
+ normalizeProjectConfigAliases,
4486
+ projectConfigDocumentSchema,
4487
+ grantRecordSchema,
4488
+ authorizationReasonSchema,
4489
+ authorizationDecisionSchema,
4490
+ runtimeAuditEventSchema,
4491
+ authorizationStateDomainSchema,
4492
+ authorizationEnvelopeContextSchema,
4493
+ authorizationStateDocumentSchema,
4494
+ authorizationStateEnvelopeSchema,
4495
+ agentBrokerRequestSchema,
4496
+ agentBrokerServerFrameSchema,
4497
+ agentBrokerClientFrameSchema
4498
+ };
4499
+ //# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvaWRlbnRpZmllcnMudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvcHJpbWl0aXZlcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9lbmNyeXB0ZWQtcmVjb3Jkcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9jb250ZW50LWhhc2gudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvZmllbGRzLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL25vdGVzLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3RlbXBsYXRlcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9wYXlsb2Fkcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9sb2NhbC12YXVsdC50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9hdXRob3JpemF0aW9uLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3N5bmMudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvYXBpLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL2F1ZGl0LnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL2JhY2t1cC50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9jbGktY29udHJhY3QudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvZGF0YWJhc2UtY29udGFpbmVyLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL2tleWNoYWluLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3BvbGljeS50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9yb3RhdGlvbi50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9zZXNzaW9uLWxpZmV0aW1lLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3RyYW5zZmVyLnRzIl0sCiAgIm1hcHBpbmdzIjogIjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBRU8sSUFBTSxzQkFBc0I7QUFDNUIsSUFBTSxzQkFBc0I7QUFDNUIsSUFBTSwyQkFBMkI7QUFFeEMsSUFBTSxrQkFBa0IsSUFBSSxPQUFPLHdCQUF3QjtBQUMzRCxJQUFNLFdBQVcsaUJBQ2QsT0FBTSxFQUNOLElBQUksbUJBQW1CLEVBQ3ZCLElBQUksbUJBQW1CLEVBQ3ZCLE1BQU0saUJBQWlCLDhCQUE4QjtBQUVqRCxJQUFNLGdCQUFnQixTQUFTLE1BQUs7QUFDcEMsSUFBTSxtQkFBbUIsU0FBUyxNQUFLO0FBQ3ZDLElBQU0sa0JBQWtCLFNBQVMsTUFBSztBQUN0QyxJQUFNLGtCQUFrQixTQUFTLE1BQUs7QUFDdEMsSUFBTSxnQkFBZ0IsU0FBUyxNQUFLO0FBQ3BDLElBQU0sZUFBZSxTQUFTLE1BQUs7QUFDbkMsSUFBTSxnQkFBZ0IsU0FBUyxNQUFLO0FBQ3BDLElBQU0sZUFBZSxTQUFTLE1BQUs7QUFDbkMsSUFBTSxtQkFBbUIsU0FBUyxNQUFLO0FBQ3ZDLElBQU0sNEJBQTRCLFNBQVMsTUFBSztBQUNoRCxJQUFNLGlCQUFpQixTQUFTLE1BQUs7QUFDckMsSUFBTSxpQkFBaUIsU0FBUyxNQUFLO0FBQ3JDLElBQU0scUJBQXFCLFNBQVMsTUFBSztBQUN6QyxJQUFNLHFCQUFxQixTQUFTLE1BQUs7QUFDekMsSUFBTSxrQkFBa0IsU0FBUyxNQUFLO0FBQ3RDLElBQU0saUJBQWlCLFNBQVMsTUFBSztBQUNyQyxJQUFNLGlCQUFpQixTQUFTLE1BQUs7QUFDckMsSUFBTSxnQkFBZ0IsU0FBUyxNQUFLOzs7QUM1QnBDLElBQU0saUJBQWlCO0FBQ3ZCLElBQU0sdUJBQXVCO0FBQzdCLElBQU0sdUJBQXVCO0FBQzdCLElBQU0sd0JBQXdCLE9BQU87QUFFNUMsSUFBTSxjQUFjLElBQUksWUFBVztBQUc3QixTQUFVLGVBQWUsT0FBYTtBQUMxQyxTQUFPLFlBQVksT0FBTyxLQUFLLEVBQUU7QUFDbkM7QUFHTyxJQUFNLHFCQUFxQixpQkFBRSxPQUFNLEVBQUcsWUFBWSxDQUFDLE9BQU8sWUFBVztBQUcxRSxNQUFJLE1BQU0sU0FBUyxrQkFBa0IsZUFBZSxLQUFLLElBQUksZ0JBQWdCO0FBQzNFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixRQUFRO01BQ1IsU0FBUztNQUNULFdBQVc7TUFDWCxTQUFTLHNDQUFzQyxPQUFPLGNBQWMsQ0FBQztLQUN0RTtFQUNIO0FBQ0YsQ0FBQztBQUVNLElBQU0seUJBQXlCO0FBQy9CLElBQU0sNEJBQTRCLE9BQU8sT0FBTztFQUNyRDtDQUNRO0FBQ0gsSUFBTSxnQ0FBZ0M7QUFDdEMsSUFBTSxtQ0FBbUMsT0FBTyxPQUFPO0VBQzVEO0NBQ1E7QUFDSCxJQUFNLHdCQUF3QjtBQUM5QixJQUFNLDJCQUEyQixPQUFPLE9BQU8sQ0FBQyxxQkFBcUIsQ0FBVTtBQUUvRSxJQUFNLHFDQUNYO0FBQ0ssSUFBTSw0QkFBNEI7QUFDbEMsSUFBTSxxQ0FDWDtBQUNLLElBQU0sZ0NBQWdDO0FBRTdDLElBQU0sNEJBQTRCLElBQUksT0FBTyxrQ0FBa0M7QUFDL0UsSUFBTSw0QkFBNEIsSUFBSSxPQUFPLGtDQUFrQztBQUUvRSxTQUFTLGtDQUFrQyxPQUFhO0FBQ3RELE1BQUksTUFBTSxXQUFXO0FBQUcsV0FBTztBQUMvQixRQUFNLFlBQVksTUFBTSxTQUFTO0FBQ2pDLE1BQUksY0FBYztBQUFHLFdBQU87QUFJNUIsUUFBTSxhQUFhLGNBQWMsSUFBSSxLQUFLLElBQUksTUFBTSxRQUFRLENBQUMsSUFBSTtBQUNqRSxTQUFPLDBCQUEwQixLQUFLLE1BQU0sTUFBTSxDQUFDLFVBQVUsQ0FBQztBQUNoRTtBQUVPLElBQU0sa0JBQWtCLGlCQUFFLElBQzlCLFNBQVMsRUFBRSxRQUFRLE9BQU8sV0FBVyxFQUFDLENBQUUsRUFDeEMsT0FBTyx5QkFBeUIsRUFDaEMsTUFBTSx5QkFBeUI7QUFDM0IsSUFBTSxpQkFBaUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXLEVBQUcsTUFBSztBQUMzRCxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTSxFQUNOLElBQUcsRUFDSCxTQUFRLEVBQ1IsSUFBSSxvQkFBb0IsRUFDeEIsTUFBSztBQUNSLElBQU0sd0JBQXdCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsU0FBUSxFQUFHLElBQUksb0JBQW9CO0FBQ2xGLElBQU0seUJBQXlCLGlCQUM1QixPQUFNLEVBQ04sSUFBRyxFQUNILFlBQVcsRUFDWCxJQUFJLHFCQUFxQjtBQU1yQixJQUFNLHNCQUFzQixzQkFBc0IsTUFBSztBQUN2RCxJQUFNLG1CQUFtQixzQkFBc0IsTUFBSztBQUNwRCxJQUFNLHdCQUF3QixzQkFBc0IsTUFBSztBQUV6RCxJQUFNLHFCQUFxQixzQkFBc0IsTUFBSztBQUV0RCxJQUFNLDZCQUNYLHNCQUFzQixNQUFLO0FBQ3RCLElBQU0sK0JBQStCLG9CQUFvQixPQUM5RCxDQUFDLFVBQVUsMEJBQTBCLEtBQUssQ0FBQyxjQUFjLFVBQVUsU0FBUyxHQUM1RSxFQUFFLE9BQU8sNkJBQTRCLENBQUU7QUFFbEMsSUFBTSxzQ0FBc0MsMkJBQTJCLE9BQzVFLENBQUMsVUFBVSxpQ0FBaUMsS0FBSyxDQUFDLGNBQWMsVUFBVSxTQUFTLEdBQ25GLEVBQUUsT0FBTyxvQ0FBbUMsQ0FBRTtBQUV6QyxJQUFNLDhCQUE4QixtQkFBbUIsT0FDNUQsQ0FBQyxVQUFVLHlCQUF5QixLQUFLLENBQUMsY0FBYyxVQUFVLFNBQVMsR0FDM0UsRUFBRSxPQUFPLDRCQUEyQixDQUFFO0FBRWpDLElBQU0sdUJBQXVCLHVCQUF1QixNQUFLO0FBQ3pELElBQU0sc0JBQXNCLHVCQUF1QixNQUFLO0FBQ3hELElBQU0sdUJBQXVCLHVCQUF1QixNQUFLO0FBQ3pELElBQU0sd0JBQXdCLGlCQUFFLFFBQVEsQ0FBQyxFQUFFLE1BQUs7QUFDaEQsSUFBTSw4QkFBOEIsaUJBQ3hDLFFBQVEsQ0FBQyxFQUNULE1BQUs7QUFDRCxJQUFNLHVCQUF1QixpQkFBRSxRQUFRLENBQUMsRUFBRSxNQUFLO0FBQy9DLElBQU0sa0JBQWtCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVztBQUNwRCxJQUFNLHFCQUFxQixpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztBQUMzRCxJQUFNLHNCQUFzQjtBQUM1QixJQUFNLG9CQUFvQixtQkFBbUIsTUFBSztBQUNsRCxJQUFNLG9CQUFvQixpQkFDOUIsV0FBVyxVQUFVLEVBQ3JCLE9BQU8sQ0FBQyxVQUFVLE1BQU0sYUFBYSxLQUFLLE1BQU0sY0FBYyxnQkFBZ0I7RUFDN0UsT0FBTztDQUNSLEVBQ0EsTUFBSztBQUVELElBQU0sa0JBQWtCLGlCQUM1QixPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxvQkFBb0IsRUFDeEIsTUFBTSxvQkFBb0Isc0NBQXNDLEVBQ2hFLE9BQU8sbUNBQW1DO0VBQ3pDLE9BQU87Q0FDUixFQUNBLE9BQU8sQ0FBQyxVQUFVLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRSxTQUFTLFdBQVcsTUFBTSxPQUFPO0VBQ2xGLE9BQU87Q0FDUjtBQUVJLElBQU0scUJBQXFCLGdCQUMvQixPQUFPLDZCQUE2QixFQUNwQyxPQUFPLENBQUMsVUFBVSxPQUFPLEtBQUssT0FBTyxXQUFXLEVBQUUsZUFBZSxJQUFJO0VBQ3BFLE9BQU87Q0FDUixFQUNBLE1BQUs7QUFFRCxJQUFNLGFBQWEsaUJBQ3ZCLE9BQU0sRUFDTixLQUFJLEVBQ0osSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFBTSwrQ0FBK0MsY0FBYzs7O0FDdEgvRCxJQUFNLDRCQUE0QixpQkFBRSxLQUFLO0VBQzlDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRU0sSUFBTSxnQ0FBZ0MsaUJBQUUsS0FBSztFQUNsRDtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQUVNLElBQU0sNkJBQTZCO0FBQ25DLElBQU0sMENBQTBDO0FBRXZELElBQU0sMkJBQTJCLGlCQUM5QixPQUFPO0VBQ04sU0FBUztFQUNULGVBQWU7RUFDZixZQUFZO0VBQ1osU0FBUztFQUNULFVBQVUsb0JBQW9CLFNBQVE7RUFDdEMsZ0JBQWdCLG1CQUFtQixTQUFRO0NBQzVDLEVBQ0EsT0FBTTtBQUVULElBQU0sd0JBQXdCO0VBQzVCLFNBQVMsaUJBQUUsVUFBUyxFQUFHLFNBQVE7RUFDL0IsVUFBVSxpQkFBRSxVQUFTLEVBQUcsU0FBUTs7QUFPM0IsSUFBTSx1QkFBdUIsaUJBQUUsbUJBQW1CLGNBQWM7RUFDckUseUJBQXlCLE9BQU87SUFDOUIsWUFBWSxpQkFBRSxRQUFRLG1CQUFtQjtJQUN6QyxVQUFVO0lBQ1YsU0FBUyxpQkFBRSxRQUFRLG1CQUFtQjtJQUN0QyxHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsT0FBTztJQUM3QixVQUFVO0lBQ1YsU0FBUyxpQkFBRSxRQUFRLGVBQWU7SUFDbEMsR0FBRztHQUNKO0VBQ0QseUJBQXlCLE9BQU87SUFDOUIsWUFBWSxpQkFBRSxRQUFRLE1BQU07SUFDNUIsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxjQUFjO0lBQ2pDLFNBQVM7SUFDVCxVQUFVLGlCQUFFLFVBQVMsRUFBRyxTQUFRO0dBQ2pDO0VBQ0QseUJBQXlCLE9BQU87SUFDOUIsWUFBWSxpQkFBRSxRQUFRLFlBQVk7SUFDbEMsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxxQkFBcUI7SUFDeEMsU0FBUztJQUNULFVBQVU7R0FDWDtFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSxrQkFBa0I7SUFDeEMsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxrQkFBa0I7SUFDckMsU0FBUztJQUNULFVBQVU7R0FDWDtFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSxhQUFhO0lBQ25DLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsYUFBYTtJQUNoQyxHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsU0FBUztJQUMvQixVQUFVO0lBQ1YsU0FBUyxpQkFBRSxRQUFRLGVBQWU7SUFDbEMsU0FBUztJQUNULFVBQVU7R0FDWDtFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSxjQUFjO0lBQ3BDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsY0FBYztJQUNqQyxHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsa0JBQWtCO0lBQ3hDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsVUFBVTtJQUM3QixHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsbUJBQW1CO0lBQ3pDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsV0FBVztJQUM5QixHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsa0JBQWtCO0lBQ3hDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsVUFBVTtJQUM3QixTQUFTO0lBQ1QsVUFBVSxpQkFBRSxVQUFTLEVBQUcsU0FBUTtHQUNqQztFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSx3QkFBd0I7SUFDOUMsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxnQkFBZ0I7SUFDbkMsU0FBUztJQUNULFVBQVU7R0FDWDtDQUNGO0FBRUQsSUFBTSw4QkFBOEIscUJBQXFCLFlBQ3ZELENBQUMsZ0JBQWdCLFlBQVc7QUFDMUIsTUFBSSxDQUFDLDZCQUE2QixVQUFVLGVBQWUsYUFBYSxFQUFFLFNBQVM7QUFDakYsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZUFBZTtLQUN2QjtFQUNIO0FBQ0YsQ0FBQztBQUdJLElBQU0scUJBQXFCLGlCQUMvQixPQUFPO0VBQ04sU0FBUztFQUNULFdBQVcsaUJBQUUsUUFBUSx5QkFBeUI7RUFDOUMsT0FBTztFQUNQLFlBQVk7RUFDWixtQkFBbUI7RUFDbkIsS0FBSztFQUNMLFlBQVk7Q0FDYixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLE1BQUksU0FBUyxNQUFNLFdBQVcsNEJBQTRCO0FBQ3hELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLE9BQU87S0FDZjtFQUNIO0FBQ0EsTUFBSSxTQUFTLGtCQUFrQixXQUFXLHlDQUF5QztBQUNqRixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxtQkFBbUI7S0FDM0I7RUFDSDtBQUNBLE1BQUksU0FBUyxlQUFlLFNBQVMsSUFBSSxZQUFZO0FBQ25ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLDhDQUE4QztBQUVwRCxJQUFNLDZCQUE2QixtQkFBbUIsWUFDM0QsQ0FBQyxVQUFVLFlBQVc7QUFDcEIsTUFBSSxTQUFTLFdBQVcsU0FBUyw2Q0FBNkM7QUFDNUUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsWUFBWTtLQUNwQjtFQUNIO0FBQ0EsTUFBSSxTQUFTLElBQUksZUFBZSxnQkFBZ0I7QUFDOUMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsS0FBSztLQUNiO0VBQ0g7QUFDRixDQUFDO0FBR0ksSUFBTSx1Q0FBdUMsSUFBSSxPQUFPO0FBQ3hELElBQU0sb0NBQW9DO0FBQzFDLElBQU0sd0JBQXdCO0FBQzlCLElBQU0sd0NBQXdDLElBQUksT0FBTyxPQUFPO0FBQ2hFLElBQU0sd0NBQ1gsdUNBQXVDO0FBQ2xDLElBQU0seUNBQ1gsd0NBQ0Esd0JBQXdCO0FBQ25CLElBQU0sc0NBQXNDO0FBQzVDLElBQU0sd0NBQXdDLEtBQUssS0FDdkQsb0NBQW9DLElBQUssQ0FBQztBQUV0QyxJQUFNLHdDQUF3QyxLQUFLLEtBQ3ZELHdDQUF3QyxJQUFLLENBQUM7QUFHakQsSUFBTSwyQkFBMkIsZ0JBQzlCLE9BQU8sbUNBQW1DLEVBQzFDLE9BQU8sQ0FBQyxVQUFVLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRSxlQUFlLElBQUk7RUFDcEUsT0FBTztDQUNSO0FBQ0ksSUFBTSxrQ0FBa0MsZ0JBQzVDLElBQUkscUNBQXFDLEVBQ3pDLElBQUkscUNBQXFDLEVBQ3pDLE9BQ0MsQ0FBQyxVQUFTO0FBQ1IsUUFBTSxhQUFhLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRTtBQUNuRCxTQUNFLGNBQWMscUNBQ2QsY0FBYztBQUVsQixHQUNBLEVBQUUsT0FBTyxtRUFBa0UsQ0FBRSxFQUU5RSxNQUFLO0FBRVIsSUFBTSx1Q0FBdUMsaUJBQUUsT0FBTztFQUNwRCxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixXQUFXLGlCQUFFLFFBQVEsaUNBQWlDO0VBQ3RELGVBQWUsaUJBQUUsUUFBUSxDQUFDO0VBQzFCLGVBQWU7RUFDZixZQUFZO0VBQ1osU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsY0FBYztDQUNmO0FBRU0sSUFBTSwyQ0FDWCxxQ0FDRyxPQUFPO0VBQ04sWUFBWSxpQkFBRSxRQUFRLFFBQVE7RUFDOUIsUUFBUTtDQUNULEVBQ0EsT0FBTTtBQUVKLElBQU0sMENBQ1gscUNBQ0csT0FBTztFQUNOLFlBQVksaUJBQUUsUUFBUSxPQUFPO0VBQzdCLE9BQU8saUJBQ0osT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSx3QkFBd0IsQ0FBQztFQUNoQyxZQUFZO0VBQ1osS0FBSyxpQkFBRSxLQUFLLENBQUMsV0FBVyxPQUFPLENBQUM7Q0FDakMsRUFDQSxPQUFNO0FBRUosSUFBTSxxQ0FBcUMsaUJBQUUsbUJBQW1CLGNBQWM7RUFDbkY7RUFDQTtDQUNEO0FBRU0sSUFBTSx3Q0FBd0MsaUJBQ2xELE9BQU87RUFDTixZQUFZLGlCQUFFLFFBQVEsbUJBQW1CO0VBQ3pDLFFBQVE7RUFDUixnQkFBZ0I7RUFDaEIsYUFBYTtFQUNiLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNO0FBRUYsSUFBTSx1Q0FBdUMsaUJBQ2pELE9BQU87RUFDTixZQUFZLGlCQUFFLFFBQVEsa0JBQWtCO0VBQ3hDLFFBQVE7RUFDUixnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxvQ0FBb0M7RUFDM0MsZ0JBQWdCO0VBQ2hCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxrQkFBa0IsT0FBTyxLQUM3QixNQUFNLE9BQU8sWUFDYixXQUFXLEVBQ1g7QUFDRixNQUFJLG9CQUFvQixNQUFNLGlCQUFpQixtQ0FBbUM7QUFDaEYsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZ0JBQWdCO0tBQ3hCO0VBQ0g7QUFDRixDQUFDO0FBSUksSUFBTSx1Q0FBdUMscUNBQ2pELE9BQU87RUFDTixpQkFBaUIsaUJBQUUsUUFBUSxDQUFDO0VBQzVCLFFBQVE7RUFDUixZQUFZLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsU0FBUSxFQUFHLElBQUkscUJBQXFCO0VBQ2pFLHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxxQ0FBcUM7RUFDNUMsaUJBQWlCO0NBQ2xCLEVBQ0EsT0FBTTtBQUVGLElBQU0sNEJBQTRCO0FBQ2xDLElBQU0sZ0NBQWdDO0FBQ3RDLElBQU0sOEJBQThCO0FBQ3BDLElBQU0sd0JBQXdCO0FBQzlCLElBQU0sd0JBQXdCO0FBQzlCLElBQU0sb0JBQW9CO0FBQzFCLElBQU0sb0JBQW9CO0FBQzFCLElBQU0seUJBQXlCO0FBQy9CLElBQU0seUJBQXlCO0FBQy9CLElBQU0sZ0NBQWdDO0FBRTdDLElBQU0saUJBQWlCLGdCQUFnQixPQUFPLHlCQUF5QjtBQUN2RSxJQUFNLHFCQUFxQixnQkFBZ0IsT0FBTyw2QkFBNkI7QUFFeEUsSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixXQUFXLGlCQUFFLFFBQVEsYUFBYTtFQUNsQyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixNQUFNO0VBQ04sU0FBUyxpQkFBRSxRQUFRLGdDQUFnQztFQUNuRCxjQUFjLGlCQUFFLFFBQVEsMkJBQTJCO0NBQ3BELEVBQ0EsT0FBTTtBQUVGLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sV0FBVyxpQkFBRSxRQUFRLFVBQVU7RUFDL0IsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsTUFBTTtFQUNOLFdBQVcsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLHFCQUFxQixFQUFFLElBQUkscUJBQXFCO0VBQ2hGLFFBQVEsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLGlCQUFpQixFQUFFLElBQUksaUJBQWlCO0VBQ3JFLGFBQWEsaUJBQ1YsT0FBTSxFQUNOLElBQUcsRUFDSCxJQUFJLHNCQUFzQixFQUMxQixJQUFJLHNCQUFzQjtFQUM3QixjQUFjLGlCQUFFLFFBQVEsMkJBQTJCO0NBQ3BELEVBQ0EsT0FBTTtBQUVGLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sV0FBVyxpQkFBRSxRQUFRLGFBQWE7RUFDbEMsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsTUFBTTtFQUNOLFNBQVMsaUJBQUUsUUFBUSxnQ0FBZ0M7RUFDbkQsY0FBYyxpQkFBRSxRQUFRLDJCQUEyQjtDQUNwRCxFQUNBLE9BQU07QUFFRixJQUFNLDRCQUE0QixpQkFDdEMsT0FBTztFQUNOLFdBQVcsaUJBQUUsUUFBUSxhQUFhO0VBQ2xDLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLE1BQU07RUFDTixTQUFTLGlCQUFFLFFBQVEsOEJBQThCO0VBQ2pELGNBQWMsaUJBQUUsUUFBUSwyQkFBMkI7RUFDbkQsVUFBVSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSw2QkFBNkI7Q0FDOUQsRUFDQSxPQUFNO0FBRUYsSUFBTSxzQkFBc0I7QUFDNUIsSUFBTSxzQkFBc0I7QUFFbkMsSUFBTSxvQkFBb0IsaUJBQUUsT0FBTztFQUNqQyxhQUFhO0VBQ2IsSUFBSTtFQUNKLE9BQU8saUJBQUUsS0FBSyxDQUFDLFdBQVcsVUFBVSxjQUFjLFNBQVMsQ0FBQztFQUM1RCxZQUFZO0VBQ1osZ0JBQWdCO0VBQ2hCLFdBQVc7RUFDWCxjQUFjLGdCQUFnQixTQUFRO0VBQ3RDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEM7QUFFTSxJQUFNLGdCQUFnQixpQkFDMUIsbUJBQW1CLFFBQVE7RUFDMUIsa0JBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxjQUFjO0lBQzlCLFlBQVk7R0FDYixFQUNBLE9BQU07RUFDVCxrQkFDRyxPQUFPO0lBQ04sTUFBTSxpQkFBRSxRQUFRLFlBQVk7SUFDNUIsWUFBWTtHQUNiLEVBQ0EsT0FBTTtFQUNULGtCQUNHLE9BQU87SUFDTixNQUFNLGlCQUFFLFFBQVEsY0FBYztJQUM5QixZQUFZO0dBQ2IsRUFDQSxPQUFNO0VBQ1Qsa0JBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxZQUFZO0lBQzVCLFlBQVk7SUFDWixVQUFVO0dBQ1gsRUFDQSxPQUFNO0NBQ1YsRUFDQSxZQUFZLENBQUMsTUFBTSxZQUFXO0FBQzdCLE1BQUksS0FBSyxlQUFlLElBQUksZUFBZSxvQkFBb0I7QUFDN0QsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsa0JBQWtCLE9BQU8sWUFBWTtLQUM3QztFQUNIO0FBQ0EsTUFBSSxLQUFLLGVBQWUsSUFBSSxhQUFhLEtBQUssSUFBSTtBQUNoRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxrQkFBa0IsT0FBTyxVQUFVO0tBQzNDO0VBQ0g7QUFDQSxNQUFJLEtBQUssZUFBZSxlQUFlLEtBQUssWUFBWTtBQUN0RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxrQkFBa0IsWUFBWTtLQUN0QztFQUNIO0FBQ0EsTUFBSSxLQUFLLFVBQVUsYUFBYSxLQUFLLGNBQWMsUUFBVztBQUM1RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLEtBQUssVUFBVSxhQUFhLEtBQUssY0FBYyxRQUFXO0FBQzVELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFdBQVc7S0FDbkI7RUFDSDtBQUNBLE1BQUksS0FBSyxVQUFVLGdCQUFnQixLQUFLLGlCQUFpQixRQUFXO0FBQ2xFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGNBQWM7S0FDdEI7RUFDSDtBQUNBLE1BQUksS0FBSyxVQUFVLGdCQUFnQixLQUFLLGlCQUFpQixRQUFXO0FBQ2xFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGNBQWM7S0FDdEI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLG9CQUFvQixpQkFDOUIsT0FBTztFQUNOLElBQUk7RUFDSixlQUFlO0VBQ2Ysc0JBQXNCO0VBQ3RCLFVBQVUsaUJBQUUsTUFBTSxhQUFhLEVBQUUsSUFBSSxtQkFBbUIsRUFBRSxJQUFJLG1CQUFtQjtFQUNqRixtQkFBbUI7RUFDbkIsVUFBVTtFQUNWLHNCQUFzQjtFQUN0QixXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxNQUFNLG9CQUFJLElBQUc7QUFDbkIsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLE1BQU0sU0FBUyxRQUFPLEdBQUk7QUFDcEQsUUFBSSxLQUFLLGVBQWUsSUFBSSxZQUFZLE1BQU0sSUFBSTtBQUNoRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxZQUFZLE9BQU8sa0JBQWtCLE9BQU8sU0FBUztPQUM3RDtJQUNIO0FBQ0EsUUFBSSxLQUFLLGVBQWUsSUFBSSxrQkFBa0IsTUFBTSxlQUFlO0FBQ2pFLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFlBQVksT0FBTyxrQkFBa0IsT0FBTyxlQUFlO09BQ25FO0lBQ0g7QUFDQSxRQUFJLElBQUksSUFBSSxLQUFLLEVBQUUsR0FBRztBQUNwQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxZQUFZLE9BQU8sSUFBSTtPQUMvQjtJQUNIO0FBQ0EsUUFBSSxJQUFJLEtBQUssRUFBRTtFQUNqQjtBQUNBLE1BQUksQ0FBQyxNQUFNLFNBQVMsS0FBSyxDQUFDLFNBQVMsS0FBSyxVQUFVLFFBQVEsR0FBRztBQUMzRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxVQUFVO0tBQ2xCO0VBQ0g7QUFDQSxNQUNFLENBQUMsTUFBTSxTQUFTLEtBQ2QsQ0FBQyxTQUNDLEtBQUssVUFBVSxZQUFZLEtBQUssZUFBZSxNQUFNLGlCQUFpQixHQUUxRTtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLG1CQUFtQjtLQUMzQjtFQUNIO0FBQ0EsTUFDRSxNQUFNLHFCQUFxQixJQUFJLFlBQVksTUFBTSxNQUNqRCxNQUFNLHFCQUFxQixJQUFJLGVBQWUsdUJBQzlDLE1BQU0scUJBQXFCLElBQUksYUFBYSxNQUFNLE1BQ2xELE1BQU0scUJBQXFCLElBQUksa0JBQWtCLE1BQU0sZUFDdkQ7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyx3QkFBd0IsS0FBSztLQUNyQztFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sSUFBSTtFQUNKLFNBQVM7RUFDVCxlQUFlO0VBQ2YsaUJBQWlCO0VBQ2pCLGtCQUFrQjtFQUNsQixpQkFBaUI7RUFDakIsZ0JBQWdCO0VBQ2hCLFdBQVc7RUFDWCxXQUFXO0VBQ1gsY0FBYyxnQkFBZ0IsU0FBUTtDQUN2QyxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLDBCQUNFLFNBQ0EsT0FBTyxrQkFDUCxPQUFPLFNBQ1AsT0FBTyxlQUNQLFNBQ0EsT0FBTyxFQUFFO0FBRVgsMEJBQ0UsU0FDQSxPQUFPLGlCQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1AscUJBQ0EsT0FBTyxFQUFFO0FBRWIsQ0FBQztBQUVJLElBQU0sNEJBQTRCLGlCQUN0QyxPQUFPO0VBQ04sSUFBSTtFQUNKLFNBQVM7RUFDVCxTQUFTO0VBQ1QsZUFBZTtFQUNmLGdCQUFnQjtFQUNoQixrQkFBa0I7RUFDbEIsZ0JBQWdCO0VBQ2hCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsV0FBVztFQUNYLGNBQWMsZ0JBQWdCLFNBQVE7Q0FDdkMsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFFBQVEsWUFBVztBQUMvQiwwQkFDRSxTQUNBLE9BQU8sa0JBQ1AsT0FBTyxTQUNQLE9BQU8sZUFDUCxRQUNBLE9BQU8sSUFDUCxPQUFPLE9BQU87QUFFaEIsMEJBQ0UsU0FDQSxPQUFPLGdCQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1Asb0JBQ0EsT0FBTyxJQUNQLE9BQU8sT0FBTztBQUVsQixDQUFDO0FBRUksSUFBTSxrQ0FBa0MsaUJBQzVDLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsZUFBZTtFQUNmLHNCQUFzQjtFQUN0QixtQkFBbUI7RUFDbkIsWUFBWSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVEsRUFBRyxJQUFJLHFCQUFxQjtFQUNqRSxnQkFBZ0I7RUFDaEIsV0FBVztFQUNYLFdBQVc7RUFDWCxjQUFjLGdCQUFnQixTQUFRO0NBQ3ZDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsMEJBQ0UsU0FDQSxPQUFPLG1CQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1AsY0FDQSxPQUFPLElBQ1AsT0FBTyxTQUNQLE9BQU8sTUFBTTtBQUVmLDBCQUNFLFNBQ0EsT0FBTyxzQkFDUCxPQUFPLFNBQ1AsT0FBTyxlQUNQLDBCQUNBLE9BQU8sSUFDUCxPQUFPLFNBQ1AsT0FBTyxNQUFNO0FBRWYsTUFDRSxPQUFPLHFCQUFxQixlQUFlLE9BQU8sa0JBQWtCLFlBQ3BFO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyx3QkFBd0IsWUFBWTtNQUMzQyxTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLDZCQUE2QixpQkFDdkMsT0FBTztFQUNOLElBQUk7RUFDSixTQUFTO0VBQ1QsZUFBZTtFQUNmLGtCQUFrQjtFQUNsQixnQkFBZ0I7RUFDaEIsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsMEJBQ0UsU0FDQSxPQUFPLGtCQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1AsZUFDQSxPQUFPLEVBQUU7QUFFYixDQUFDO0FBRUksSUFBTSwrQkFBK0IsaUJBQ3pDLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsZUFBZTtFQUNmLGtCQUFrQjtFQUNsQixvQkFBb0I7RUFDcEIsZ0JBQWdCO0VBQ2hCLFdBQVc7Q0FDWixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLDBCQUNFLFNBQ0EsT0FBTyxrQkFDUCxPQUFPLFNBQ1AsT0FBTyxlQUNQLFdBQ0EsT0FBTyxJQUNQLE9BQU8sU0FDUCxPQUFPLE1BQU07QUFFakIsQ0FBQztBQUVJLElBQU0sd0JBQXdCLGlCQUFFLE1BQU07RUFDM0M7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRUQsU0FBUyx3QkFDUCxTQUNBLFVBQ0EsU0FDQSxlQUNBLFlBQ0EsVUFDQSxTQUNBLFVBQWlCO0FBRWpCLE1BQ0UsU0FBUyxJQUFJLFlBQVksV0FDekIsU0FBUyxJQUFJLGtCQUFrQixpQkFDL0IsU0FBUyxJQUFJLGVBQWUsY0FDNUIsU0FBUyxJQUFJLGFBQWEsWUFDMUIsU0FBUyxJQUFJLFlBQVksV0FDekIsU0FBUyxJQUFJLGFBQWEsVUFDMUI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxLQUFLO0tBQ2I7RUFDSDtBQUNGOzs7QUNqeEJBLFNBQVMsWUFBWSx1QkFBdUI7QUFpQjVDLElBQU0sK0JBQStCLE9BQU8sS0FDMUMsbUNBQ0EsTUFBTTtBQTZERixTQUFVLGNBQWMsT0FBYztBQUMxQyxNQUFJLFVBQVU7QUFBTSxXQUFPO0FBQzNCLE1BQUksT0FBTyxVQUFVLFlBQVksT0FBTyxVQUFVLFdBQVc7QUFDM0QsV0FBTyxLQUFLLFVBQVUsS0FBSztFQUM3QjtBQUNBLE1BQUksT0FBTyxVQUFVLFVBQVU7QUFDN0IsUUFBSSxDQUFDLE9BQU8sU0FBUyxLQUFLLEdBQUc7QUFDM0IsWUFBTSxJQUFJLFVBQVUsNENBQTRDO0lBQ2xFO0FBQ0EsV0FBTyxLQUFLLFVBQVUsS0FBSztFQUM3QjtBQUNBLE1BQUksTUFBTSxRQUFRLEtBQUssR0FBRztBQUN4QixXQUFPLElBQUksTUFBTSxJQUFJLENBQUMsVUFBVSxjQUFjLEtBQUssQ0FBQyxFQUFFLEtBQUssR0FBRyxDQUFDO0VBQ2pFO0FBQ0EsTUFBSSxPQUFPLFVBQVUsVUFBVTtBQUM3QixVQUFNLElBQUksVUFBVSwwQ0FBMEM7RUFDaEU7QUFFQSxRQUFNLFlBQVksT0FBTyxlQUFlLEtBQUs7QUFDN0MsTUFBSSxjQUFjLE9BQU8sYUFBYSxjQUFjLE1BQU07QUFDeEQsVUFBTSxJQUFJLFVBQVUsMkNBQTJDO0VBQ2pFO0FBQ0EsUUFBTSxTQUFTO0FBQ2YsU0FBTyxJQUFJLE9BQU8sS0FBSyxNQUFNLEVBQzFCLEtBQUksRUFDSixPQUFPLENBQUMsUUFBUSxPQUFPLEdBQUcsTUFBTSxNQUFTLEVBQ3pDLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxVQUFVLEdBQUcsQ0FBQyxJQUFJLGNBQWMsT0FBTyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQ25FLEtBQUssR0FBRyxDQUFDO0FBQ2Q7QUF3Qk0sU0FBVSw0QkFDZCxRQUF1QztBQUV2QyxTQUFPLG1CQUFtQixNQUN4QixXQUFXLFFBQVEsRUFDaEIsT0FBTyxjQUFjLE9BQU8sTUFBTSxHQUFHLE1BQU0sRUFDM0MsT0FBTyxXQUFXLENBQUM7QUFFMUI7OztBQzNITyxJQUFNLGtCQUFrQixpQkFBRSxLQUFLO0VBQ3BDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQUVELElBQU0sc0JBQXNCLG9CQUFJLElBQXFDO0VBQ25FO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFSyxTQUFVLHFCQUNkLFdBQTBDO0FBRTFDLFNBQU8sb0JBQW9CLElBQUksU0FBUztBQUMxQztBQUVPLElBQU0sbUJBQW1CLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFdBQVcsU0FBUyxDQUFDO0FBQy9ELElBQU0scUJBQXFCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFNBQVMsU0FBUyxDQUFDO0FBQy9ELElBQU0sK0JBQStCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLGNBQWMsUUFBUSxDQUFDO0FBQzdFLElBQU0scUJBQXFCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLGtCQUFrQixTQUFTLENBQUM7QUFHeEUsSUFBTSx3QkFBd0IsaUJBQUUsS0FBSztFQUMxQztFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQUVNLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPO0VBQ04sV0FBVyxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO0VBQ2xELFdBQVcsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxPQUFTLEVBQUUsU0FBUTtFQUM5RCxpQkFBaUIsc0JBQXNCLFNBQVE7RUFDL0MsS0FBSyxpQkFBRSxPQUFNLEVBQUcsU0FBUTtFQUN4QixLQUFLLGlCQUFFLE9BQU0sRUFBRyxTQUFRO0VBQ3hCLGdCQUFnQixpQkFBRSxNQUFNLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxFQUFFLElBQUksRUFBRSxFQUFFLFNBQVE7Q0FDcEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixNQUNFLE1BQU0sY0FBYyxVQUNwQixNQUFNLGNBQWMsVUFDcEIsTUFBTSxZQUFZLE1BQU0sV0FDeEI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLE1BQU0sUUFBUSxVQUFhLE1BQU0sUUFBUSxVQUFhLE1BQU0sTUFBTSxNQUFNLEtBQUs7QUFDL0UsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsS0FBSztLQUNiO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSxxQkFBcUIsaUJBQy9CLE9BQU87RUFDTixPQUFPLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUc7RUFDaEMsT0FBTztDQUNSLEVBQ0EsT0FBTTtBQUVULElBQU0sMkJBQTJCLGlCQUM5QixPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFBTSxpQ0FBaUMsOEJBQThCO0FBRWpFLElBQU0sNEJBQ1gseUJBQXlCLE1BQUs7QUFFaEMsSUFBTSwwQkFBMEIsb0JBQW9CLE9BQ2xELENBQUMsVUFBVSxNQUFNLFNBQVMsR0FDMUIsRUFBRSxPQUFPLHNDQUFxQyxDQUFFO0FBRWxELElBQU0sNEJBQTRCLGtCQUFrQixPQUNsRCxDQUFDLFVBQVUsTUFBTSxTQUFTLEdBQzFCLEVBQUUsT0FBTyx3Q0FBdUMsQ0FBRTtBQUc3QyxJQUFNLHlCQUF5QixpQkFBRSxtQkFBbUIsUUFBUTtFQUNqRSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLE1BQU0sR0FBRyxPQUFPLHdCQUF1QixDQUFFLEVBQUUsT0FBTTtFQUM1RSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFFBQVEsR0FBRyxPQUFPLDBCQUF5QixDQUFFLEVBQUUsT0FBTTtFQUNoRixpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFFBQVEsR0FBRyxPQUFPLGlCQUFFLE9BQU0sRUFBRSxDQUFFLEVBQUUsT0FBTTtFQUNqRSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFNBQVMsR0FBRyxPQUFPLGlCQUFFLFFBQU8sRUFBRSxDQUFFLEVBQUUsT0FBTTtFQUNuRSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLGdCQUFnQixHQUFHLFFBQVEsYUFBWSxDQUFFLEVBQUUsT0FBTTtFQUM1RSxpQkFDRyxPQUFPO0lBQ04sTUFBTSxpQkFBRSxRQUFRLHNCQUFzQjtJQUN0QyxjQUFjO0dBQ2YsRUFDQSxPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxtQkFBbUI7SUFDbkMsS0FBSyxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO0lBQzlCLE9BQU8saUJBQUUsbUJBQW1CLGtCQUFrQjtNQUM1QyxpQkFDRyxPQUFPO1FBQ04sZ0JBQWdCLGlCQUFFLFFBQVEsTUFBTTtRQUNoQyxPQUFPO09BQ1IsRUFDQSxPQUFNO01BQ1QsaUJBQ0csT0FBTztRQUNOLGdCQUFnQixpQkFBRSxRQUFRLFFBQVE7UUFDbEMsT0FBTztPQUNSLEVBQ0EsT0FBTTtLQUNWO0dBQ0YsRUFDQSxPQUFNO0NBQ1Y7QUFFTSxJQUFNLG1DQUFtQyxpQkFBRSxtQkFBbUIsVUFBVTtFQUM3RSxpQkFDRyxPQUFPO0lBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7SUFDcEIsUUFBUSxpQkFBRSxRQUFRLFdBQVc7SUFDN0IsUUFBUSxpQkFBRSxVQUFTLEVBQUcsU0FBUTtHQUMvQixFQUNBLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7SUFDcEIsUUFBUSxpQkFBRSxRQUFRLE1BQU07SUFDeEIsUUFBUTtHQUNULEVBQ0EsT0FBTTtDQUNWO0FBRU0sSUFBTSwwQkFBMEIsaUJBQ3BDLE9BQU87RUFDTixJQUFJO0VBQ0osT0FBTztFQUNQLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLDBCQUEwQixpQkFDcEMsbUJBQW1CLGVBQWU7RUFDakMsaUJBQ0csT0FBTztJQUNOLGFBQWEsaUJBQUUsUUFBUSxRQUFRO0lBQy9CLE9BQU87R0FDUixFQUNBLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sYUFBYSxpQkFBRSxRQUFRLFVBQVU7SUFDakMsVUFBVSxpQkFBRSxNQUFNLHVCQUF1QixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksR0FBTTtHQUM3RCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsU0FBUyxZQUFXO0FBQ2hDLFVBQU0sTUFBTSxvQkFBSSxJQUFHO0FBQ25CLFVBQU0sa0JBQWtCLG9CQUFJLElBQUc7QUFDL0IsZUFBVyxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsU0FBUyxRQUFPLEdBQUk7QUFDekQsVUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLEdBQUc7QUFDdkIsZ0JBQVEsU0FBUztVQUNmLE1BQU07VUFDTixTQUFTO1VBQ1QsTUFBTSxDQUFDLFlBQVksT0FBTyxJQUFJO1NBQy9CO01BQ0g7QUFDQSxVQUFJLElBQUksUUFBUSxFQUFFO0FBQ2xCLFVBQUksUUFBUSxNQUFNLFNBQVMscUJBQXFCO0FBQzlDLFlBQUksZ0JBQWdCLElBQUksUUFBUSxNQUFNLEdBQUcsR0FBRztBQUMxQyxrQkFBUSxTQUFTO1lBQ2YsTUFBTTtZQUNOLFNBQVM7WUFDVCxNQUFNLENBQUMsWUFBWSxPQUFPLFNBQVMsS0FBSztXQUN6QztRQUNIO0FBQ0Esd0JBQWdCLElBQUksUUFBUSxNQUFNLEdBQUc7TUFDdkM7SUFDRjtFQUNGLENBQUM7Q0FDSixFQUNBLE9BQ0MsQ0FBQyxVQUFVLElBQUksWUFBVyxFQUFHLE9BQU8sS0FBSyxVQUFVLEtBQUssQ0FBQyxFQUFFLGNBQWMsU0FDekUsRUFBRSxPQUFPLHVEQUFzRCxDQUFFO0FBRzlELElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPLEVBQUUsU0FBUyxpQkFBRSxRQUFRLENBQUMsR0FBRyxPQUFPLGlCQUFFLFFBQVEsU0FBUyxFQUFDLENBQUUsRUFDN0QsT0FBTTtBQUNGLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPLEVBQUUsU0FBUyxpQkFBRSxRQUFRLENBQUMsR0FBRyxPQUFPLGlCQUFFLFFBQVEsT0FBTyxFQUFDLENBQUUsRUFDM0QsT0FBTTtBQUNGLElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsT0FBTyxpQkFBRSxRQUFRLGNBQWM7RUFDL0IsUUFBUSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRyxFQUFFLFNBQVE7Q0FDbkQsRUFDQSxPQUFNO0FBQ0YsSUFBTSw2QkFBNkIsaUJBQ3ZDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixPQUFPLGlCQUFFLFFBQVEsWUFBWTtFQUM3QixRQUFRLGlCQUFFLEtBQUs7SUFDYjtJQUNBO0lBQ0E7SUFDQTtHQUNEO0NBQ0YsRUFDQSxPQUFNO0FBQ0YsSUFBTSwwQkFBMEIsaUJBQ3BDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixPQUFPLGlCQUFFLFFBQVEsU0FBUztFQUMxQixTQUFTO0NBQ1YsRUFDQSxPQUFNO0FBQ0YsSUFBTSx5QkFBeUIsaUJBQUUsbUJBQW1CLFNBQVM7RUFDbEU7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBQ00sSUFBTSwyQkFBMkIsaUJBQ3JDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixPQUFPLGlCQUFFLFFBQVEsVUFBVTtFQUMzQixlQUFlO0NBQ2hCLEVBQ0EsT0FBTTtBQUVGLElBQU0sbUJBQW1CLGlCQUM3QixtQkFBbUIsU0FBUztFQUMzQjtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRCxFQUNBLE9BQ0MsQ0FBQyxVQUFVLElBQUksWUFBVyxFQUFHLE9BQU8sS0FBSyxVQUFVLEtBQUssQ0FBQyxFQUFFLGNBQWMsU0FDekUsRUFBRSxPQUFPLCtDQUE4QyxDQUFFO0FBR3RELElBQU0sdUJBQXVCLGlCQUNqQyxPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFBTSx1Q0FBdUMsMEJBQTBCO0FBRW5FLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPO0VBQ04sSUFBSTtFQUNKLFdBQVc7RUFDWCxPQUFPO0VBQ1AsYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDbEQsTUFBTTtFQUNOLFVBQVUsaUJBQUUsUUFBTztFQUNuQixXQUFXLGlCQUFFLFFBQU87RUFDcEIsWUFBWSxpQkFBRSxRQUFPO0VBQ3JCLFVBQVUsaUJBQUUsUUFBTztFQUNuQixtQkFBbUIsaUJBQUUsUUFBTztFQUM1QixlQUFlLGlCQUFFLFFBQU87RUFDeEIsY0FBYyx3QkFBd0IsU0FBUTtFQUM5QyxhQUFhLGlCQUFFLE9BQU0sRUFBRyxJQUFJLEdBQUcsRUFBRSxTQUFRO0VBQ3pDLGlCQUFpQixzQkFBc0IsU0FBUTtFQUMvQyxlQUFlLGlCQUFFLE1BQU0sa0JBQWtCLEVBQUUsSUFBSSxHQUFLLEVBQUUsU0FBUTtFQUM5RCx5QkFBeUIsaUJBQ3RCLE9BQU0sRUFDTixNQUFNLDBCQUEwQixFQUNoQyxJQUFJLEdBQUcsRUFDUCxTQUFRO0VBQ1gsWUFBWTtFQUNaLGNBQWM7RUFDZCx3QkFBd0I7RUFDeEIsY0FBYztFQUNkLFdBQVc7RUFDWCxXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsTUFBSSxNQUFNLGNBQWMsTUFBTSxlQUFlLFVBQVU7QUFDckQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsWUFBWTtLQUNwQjtFQUNIO0FBQ0EsTUFBSSxNQUFNLGFBQWEsTUFBTSxpQkFBaUIsUUFBVztBQUN2RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxjQUFjO0tBQ3RCO0VBQ0g7QUFDQSxNQUFJLHFCQUFxQixNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sV0FBVztBQUN4RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLE1BQU0sYUFBYSxNQUFNLGVBQWU7QUFDMUMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZUFBZTtLQUN2QjtFQUNIO0FBQ0EsTUFBSSxNQUFNLGFBQWEsTUFBTSwyQkFBMkIsU0FBUztBQUMvRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyx3QkFBd0I7S0FDaEM7RUFDSDtBQUNBLE1BQUksQ0FBQyxNQUFNLGFBQWEsTUFBTSxpQkFBaUIsU0FBUztBQUN0RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxjQUFjO0tBQ3RCO0VBQ0g7QUFDQSxRQUFNLFdBQVcsTUFBTSxTQUFTLFlBQVksTUFBTSxTQUFTO0FBQzNELE1BQUksYUFBYSxDQUFDLE1BQU0saUJBQWlCLE1BQU0sY0FBYyxXQUFXLElBQUk7QUFDMUUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZUFBZTtLQUN2QjtFQUNIO0FBQ0EsTUFBSSxDQUFDLFlBQVksTUFBTSxrQkFBa0IsUUFBVztBQUNsRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxNQUNFLE1BQU0saUJBQWlCLFVBQ3ZCLENBQUMsNEJBQTRCLE9BQU8sTUFBTSxZQUFZLEdBQ3REO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsY0FBYztLQUN0QjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0seUJBQXlCLGlCQUNuQyxPQUFPO0VBQ04sU0FBUztFQUNULFdBQVc7RUFDWCxPQUFPO0VBQ1AsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQVVGLElBQU0saUNBQWlDLGlCQUFFLEtBQUs7RUFDbkQ7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLFlBQVk7RUFDWixPQUFPO0VBQ1Asa0JBQWtCO0VBQ2xCLHVCQUF1QjtFQUN2QixZQUFZO0VBQ1osUUFBUTtDQUNULEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxVQUFVLFlBQVc7QUFDakMsTUFDRSxDQUFDLDRCQUE0QixTQUFTLFlBQVksU0FBUyxNQUFNLGFBQWEsR0FDOUU7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxTQUFTLGVBQWU7S0FDaEM7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHNCQUFzQixpQkFDaEMsT0FBTztFQUNOLFFBQVE7RUFDUixjQUFjLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO0NBQy9DLEVBQ0EsT0FBTTtBQUVULElBQU0sdUJBQXVCLG9CQUFJLElBQWU7RUFDOUM7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQVFLLFNBQVUsMkJBQTJCLE9BQXNCO0FBQy9ELFNBQU8sTUFBTSxjQUFjLHFCQUFxQixJQUFJLE1BQU0sSUFBSTtBQUNoRTtBQUVNLFNBQVUsNEJBQ2QsT0FDQSxPQUFpQjtBQUVqQixNQUFJLE1BQU0sVUFBVTtBQUFZLFdBQU87QUFDdkMsTUFBSSxNQUFNLFVBQVU7QUFBVyxXQUFPLENBQUMsTUFBTTtBQUU3QyxRQUFNLGtCQUFrQiwyQkFBMkIsS0FBSztBQUN4RCxNQUFJLHFCQUFxQixNQUFNLFFBQVEsZ0JBQWdCO0FBQWEsV0FBTztBQUMzRSxRQUFNLFdBQ0osTUFBTSxRQUFRLGdCQUFnQixhQUFhLE1BQU0sUUFBUSxXQUFXO0FBQ3RFLE1BQ0UsTUFBTSxTQUFTLHdCQUNmLFVBQVUsS0FBSyxDQUFDLEVBQUUsVUFBUyxNQUFPLFVBQVUsV0FBVyxNQUFNLE1BQU0sTUFDbkU7QUFDQSxXQUFPO0VBQ1Q7QUFDQSxRQUFNLGFBQ0osTUFBTSxRQUFRLGdCQUFnQixhQUMxQixNQUFNLFFBQVEsU0FBUyxJQUFJLENBQUMsRUFBRSxPQUFPLFVBQVMsTUFBTyxTQUFTLElBQzlELENBQUMsTUFBTSxRQUFRLEtBQUs7QUFDMUIsU0FBTyxXQUFXLE1BQ2hCLENBQUMsY0FDQyx1QkFBdUIsT0FBTyxTQUFTLEtBQUssa0JBQWtCLE9BQU8sU0FBUyxDQUFDO0FBRXJGO0FBRUEsU0FBUyx1QkFDUCxPQUNBLE9BQXVCO0FBRXZCLFVBQVEsTUFBTSxNQUFNO0lBQ2xCLEtBQUs7QUFDSCxhQUFPLE1BQU0sU0FBUztJQUN4QixLQUFLO0FBQ0gsYUFDRSxNQUFNLFNBQVMsWUFDZixPQUFPLFVBQVUsTUFBTSxLQUFLLEtBQzVCLE1BQU0sU0FBUyxLQUNmLE1BQU0sU0FBUztJQUVuQixLQUFLO0FBQ0gsYUFBTyxNQUFNLFNBQVM7SUFDeEIsS0FBSztBQUNILGFBQU8sTUFBTSxTQUFTO0lBQ3hCLEtBQUs7QUFDSCxhQUFPLE1BQU0sU0FBUztJQUN4QixLQUFLO0FBQ0gsYUFDRSxNQUFNLFNBQVMsdUJBQ2YsTUFBTSxNQUFNLG9CQUFvQixNQUFNLFlBQVksV0FBVztJQUVqRSxLQUFLO0FBQ0gsVUFBSSxDQUFDLG1CQUFtQixPQUFPLEtBQUs7QUFBRyxlQUFPO0FBQzlDLFVBQUk7QUFDRixhQUFLLE1BQU0sTUFBTSxLQUFLO0FBQ3RCLGVBQU87TUFDVCxRQUFRO0FBQ04sZUFBTztNQUNUO0lBQ0YsS0FBSztJQUNMLEtBQUs7QUFDSCxhQUFPLG1CQUFtQixPQUFPLEtBQUssS0FBSyxrQkFBa0IsT0FBTyxNQUFNLEtBQUs7SUFDakYsS0FBSztBQUNILGFBQU8sbUJBQW1CLE9BQU8sS0FBSyxLQUFLLGNBQWMsTUFBTSxLQUFLO0lBQ3RFLEtBQUs7QUFDSCxVQUFJLENBQUMsbUJBQW1CLE9BQU8sS0FBSztBQUFHLGVBQU87QUFDOUMsVUFBSTtBQUNGLGNBQU0sU0FBUyxJQUFJLElBQUksTUFBTSxLQUFLO0FBQ2xDLGNBQU0sVUFBVSxNQUFNLGlCQUFpQjtBQUN2QyxlQUFPLFlBQVksVUFBYSxRQUFRLFNBQVMsT0FBTyxTQUFTLE1BQU0sR0FBRyxFQUFFLENBQUM7TUFDL0UsUUFBUTtBQUNOLGVBQU87TUFDVDtJQUNGO0FBQ0UsYUFBTyxtQkFBbUIsT0FBTyxLQUFLO0VBQzFDO0FBQ0Y7QUFFQSxTQUFTLG1CQUNQLE9BQ0EsT0FBdUI7QUFFdkIsU0FBTyxNQUFNLFlBQVksTUFBTSxTQUFTLFdBQVcsTUFBTSxTQUFTO0FBQ3BFO0FBRUEsU0FBUyxrQkFBa0IsT0FBd0IsT0FBdUI7QUFDeEUsUUFBTSxRQUFRLE1BQU07QUFDcEIsTUFBSSxVQUFVO0FBQVcsV0FBTztBQUNoQyxNQUFJLE1BQU0sU0FBUyxVQUFVLE1BQU0sU0FBUyxVQUFVO0FBQ3BELFFBQUksTUFBTSxjQUFjLFVBQWEsTUFBTSxNQUFNLFNBQVMsTUFBTTtBQUM5RCxhQUFPO0FBQ1QsUUFBSSxNQUFNLGNBQWMsVUFBYSxNQUFNLE1BQU0sU0FBUyxNQUFNO0FBQzlELGFBQU87QUFDVCxRQUNFLE1BQU0sb0JBQW9CLFVBQzFCLENBQUMsdUJBQXVCLE1BQU0saUJBQWlCLE1BQU0sS0FBSztBQUUxRCxhQUFPO0VBQ1g7QUFDQSxNQUFJLE1BQU0sU0FBUyxVQUFVO0FBQzNCLFFBQUksTUFBTSxRQUFRLFVBQWEsTUFBTSxRQUFRLE1BQU07QUFBSyxhQUFPO0FBQy9ELFFBQUksTUFBTSxRQUFRLFVBQWEsTUFBTSxRQUFRLE1BQU07QUFBSyxhQUFPO0VBQ2pFO0FBQ0EsU0FBTztBQUNUO0FBRU0sU0FBVSx1QkFDZCxZQUNBLE9BQWE7QUFFYixVQUFRLFlBQVk7SUFDbEIsS0FBSztBQUNILGFBQU8sY0FBYyxPQUFPLENBQUMsU0FBUyxRQUFRLEdBQUk7SUFDcEQsS0FBSztBQUNILGFBQU8sY0FDTCxPQUNBLENBQUMsU0FDRSxRQUFRLE1BQVEsUUFBUSxPQUN4QixRQUFRLE1BQVEsUUFBUSxNQUN6QixTQUFTLE1BQ1QsU0FBUyxFQUFJO0lBRW5CLEtBQUs7QUFDSCxhQUFPLGNBQ0wsT0FDQSxDQUFDLFNBQ0UsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsR0FBSztJQUVwQyxLQUFLO0FBQ0gsYUFBTyxXQUFXLEtBQUs7SUFDekIsS0FBSztBQUNILGFBQU8sT0FBTyxLQUFLO0lBQ3JCLEtBQUs7QUFDSCxhQUFPLGNBQ0wsT0FDQSxDQUFDLFNBQ0UsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsT0FDekIsU0FBUyxNQUNULFNBQVMsRUFBSTtFQUVyQjtBQUNGO0FBRUEsU0FBUyxjQUFjLE9BQWUsV0FBb0M7QUFDeEUsTUFBSSxNQUFNLFdBQVc7QUFBRyxXQUFPO0FBQy9CLFdBQVMsUUFBUSxHQUFHLFFBQVEsTUFBTSxRQUFRLFNBQVMsR0FBRztBQUNwRCxRQUFJLENBQUMsVUFBVSxNQUFNLFdBQVcsS0FBSyxDQUFDO0FBQUcsYUFBTztFQUNsRDtBQUNBLFNBQU87QUFDVDtBQUVBLFNBQVMsV0FBVyxPQUFhO0FBQy9CLE1BQUksTUFBTSxXQUFXLEtBQUssTUFBTSxTQUFTO0FBQUssV0FBTztBQUNyRCxRQUFNLFNBQVMsTUFBTSxNQUFNLEdBQUc7QUFDOUIsU0FBTyxPQUFPLE1BQU0sQ0FBQyxVQUFTO0FBQzVCLFFBQUksTUFBTSxXQUFXLEtBQUssTUFBTSxTQUFTO0FBQUksYUFBTztBQUNwRCxRQUFJLE1BQU0sV0FBVyxHQUFHLEtBQUssTUFBTSxTQUFTLEdBQUc7QUFBRyxhQUFPO0FBQ3pELFdBQU8sY0FDTCxPQUNBLENBQUMsU0FDRSxRQUFRLE1BQVEsUUFBUSxNQUN4QixRQUFRLE1BQVEsUUFBUSxNQUN4QixRQUFRLE1BQVEsUUFBUSxPQUN6QixTQUFTLEVBQUk7RUFFbkIsQ0FBQztBQUNIO0FBRUEsU0FBUyxPQUFPLE9BQWE7QUFDM0IsUUFBTSxRQUFRLE1BQU0sTUFBTSxHQUFHO0FBQzdCLE1BQUksTUFBTSxXQUFXO0FBQUcsV0FBTztBQUMvQixTQUFPLE1BQU0sTUFBTSxDQUFDLFNBQVE7QUFDMUIsUUFBSSxLQUFLLFdBQVcsS0FBSyxLQUFLLFNBQVM7QUFBRyxhQUFPO0FBQ2pELFFBQUksS0FBSyxTQUFTLEtBQUssS0FBSyxXQUFXLEdBQUc7QUFBRyxhQUFPO0FBQ3BELFFBQUksQ0FBQyxjQUFjLE1BQU0sQ0FBQyxTQUFTLFFBQVEsTUFBUSxRQUFRLEVBQUk7QUFBRyxhQUFPO0FBQ3pFLFVBQU0sUUFBUSxPQUFPLElBQUk7QUFDekIsV0FBTyxTQUFTLEtBQUssU0FBUztFQUNoQyxDQUFDO0FBQ0g7QUFFQSxTQUFTLGNBQWMsT0FBYTtBQUNsQyxRQUFNLEtBQUssTUFBTSxRQUFRLEdBQUc7QUFDNUIsTUFBSSxNQUFNLEtBQUssT0FBTyxNQUFNLFlBQVksR0FBRztBQUFHLFdBQU87QUFDckQsUUFBTSxTQUFTLE1BQU0sTUFBTSxLQUFLLENBQUM7QUFDakMsU0FBTyxPQUFPLFNBQVMsR0FBRyxLQUFLLENBQUMsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLE1BQU0sU0FBUyxHQUFJO0FBQzdFO0FBRUEsU0FBUyxrQkFBa0IsT0FBd0IsT0FBYTtBQUM5RCxTQUFPLE1BQU0sZUFBZSxLQUFLLENBQUMsV0FBVyxPQUFPLFVBQVUsS0FBSyxNQUFNO0FBQzNFOzs7QUM3cEJPLElBQU0sYUFBYSxpQkFDdkIsT0FBTztFQUNOLElBQUk7RUFDSixPQUFPO0VBQ1AsU0FBUztFQUNULGFBQWEsaUJBQUUsUUFBTztFQUN0QixVQUFVLGlCQUFFLFFBQU87RUFDbkIsTUFBTSxpQkFBRSxNQUFNLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHLENBQUMsRUFBRSxJQUFJLEdBQUc7RUFDeEQsV0FBVztFQUNYLFdBQVc7RUFDWCxXQUFXO0VBQ1gsWUFBWSxnQkFBZ0IsU0FBUTtDQUNyQyxFQUNBLE9BQU07QUFFRixJQUFNLHVCQUF1QixpQkFDakMsTUFBTSxVQUFVLEVBQ2hCLElBQUksR0FBTSxFQUNWLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxNQUFNLG9CQUFJLElBQUc7QUFDbkIsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLE1BQU0sUUFBTyxHQUFJO0FBQzNDLFFBQUksSUFBSSxJQUFJLEtBQUssRUFBRSxHQUFHO0FBQ3BCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLE9BQU8sSUFBSTtPQUNuQjtJQUNIO0FBQ0EsUUFBSSxJQUFJLEtBQUssRUFBRTtFQUNqQjtBQUNGLENBQUM7OztBQ3RCSSxJQUFNLDJCQUEyQixpQkFBRSxLQUFLO0VBQzdDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLHNCQUFzQixpQkFDaEMsT0FBTztFQUNOLElBQUk7RUFDSixNQUFNO0VBQ04sYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDbEQsWUFBWSx5QkFBeUIsU0FBUTtFQUM3QyxTQUFTO0VBQ1QsUUFBUSxpQkFBRSxNQUFNLHFCQUFxQixFQUFFLElBQUksR0FBSztFQUNoRCxXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxVQUFVLFlBQVc7QUFDakMsUUFBTSxNQUFNLG9CQUFJLElBQUc7QUFDbkIsUUFBTSxPQUFPLG9CQUFJLElBQUc7QUFDcEIsUUFBTSxTQUFTLG9CQUFJLElBQUc7QUFDdEIsYUFBVyxDQUFDLE9BQU8sS0FBSyxLQUFLLFNBQVMsT0FBTyxRQUFPLEdBQUk7QUFDdEQsUUFBSSxJQUFJLElBQUksTUFBTSxFQUFFLEdBQUc7QUFDckIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsVUFBVSxPQUFPLElBQUk7T0FDN0I7SUFDSDtBQUNBLFFBQUksS0FBSyxJQUFJLE1BQU0sU0FBUyxHQUFHO0FBQzdCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFVBQVUsT0FBTyxXQUFXO09BQ3BDO0lBQ0g7QUFDQSxRQUFJLE9BQU8sSUFBSSxNQUFNLFNBQVMsR0FBRztBQUMvQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxVQUFVLE9BQU8sV0FBVztPQUNwQztJQUNIO0FBQ0EsUUFBSSxJQUFJLE1BQU0sRUFBRTtBQUNoQixTQUFLLElBQUksTUFBTSxTQUFTO0FBQ3hCLFdBQU8sSUFBSSxNQUFNLFNBQVM7RUFDNUI7QUFDRixDQUFDO0FBRUgsSUFBTSwwQkFBMEIsaUJBQUUsT0FBTztFQUN2QyxtQkFBbUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQy9DLHNCQUFzQixpQkFBRSxRQUFPO0NBQ2hDO0FBRU0sSUFBTSw4QkFBOEIsaUJBQUUsbUJBQW1CLFFBQVE7RUFDdEUsd0JBQXdCLE9BQU87SUFDN0IsTUFBTSxpQkFBRSxRQUFRLFdBQVc7SUFDM0IsT0FBTztHQUNSO0VBQ0Qsd0JBQXdCLE9BQU87SUFDN0IsTUFBTSxpQkFBRSxRQUFRLGVBQWU7SUFDL0IsT0FBTztHQUNSO0VBQ0Qsd0JBQXdCLE9BQU87SUFDN0IsTUFBTSxpQkFBRSxRQUFRLGNBQWM7SUFDOUIsU0FBUztJQUNULFdBQVc7SUFDWCxTQUFTO0dBQ1Y7RUFDRCx3QkFBd0IsT0FBTztJQUM3QixNQUFNLGlCQUFFLFFBQVEsZUFBZTtJQUMvQixTQUFTO0lBQ1QsZUFBZTtJQUNmLGFBQWE7R0FDZDtFQUNELHdCQUF3QixPQUFPO0lBQzdCLE1BQU0saUJBQUUsUUFBUSxpQkFBaUI7SUFDakMsU0FBUztJQUNULGNBQWMsaUJBQUUsUUFBTztJQUN2QixZQUFZLGlCQUFFLFFBQU87SUFDckIsbUJBQW1CLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVztHQUNoRDtFQUNELHdCQUF3QixPQUFPO0lBQzdCLE1BQU0saUJBQUUsUUFBUSxxQkFBcUI7SUFDckMsU0FBUztJQUNULFdBQVc7SUFDWCxTQUFTO0dBQ1Y7RUFDRCx3QkFBd0IsT0FBTztJQUM3QixNQUFNLGlCQUFFLFFBQVEsY0FBYztJQUM5QixTQUFTO0lBQ1QsV0FBVztJQUNYLFNBQVM7SUFDVCxVQUFVO0lBQ1YsUUFBUTtJQUNSLFVBQVUsaUJBQUUsS0FBSztNQUNmO01BQ0E7TUFDQTtNQUNBO01BQ0E7TUFDQTtLQUNEO0lBQ0Qsd0JBQXdCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVztHQUNyRDtFQUNELHdCQUF3QixPQUFPO0lBQzdCLE1BQU0saUJBQUUsUUFBUSxlQUFlO0lBQy9CLE9BQU87R0FDUjtDQUNGO0FBRU0sSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixJQUFJO0VBQ0osYUFBYTtFQUNiLFdBQVc7RUFDWCxnQkFBZ0I7RUFDaEIsZ0JBQWdCO0VBQ2hCLGVBQWUsaUJBQ1osTUFDQyxpQkFDRyxPQUFPO0lBQ04sUUFBUTtJQUNSLFVBQVU7R0FDWCxFQUNBLE9BQU0sQ0FBRSxFQUVaLElBQUksR0FBUztFQUNoQixPQUFPLGlCQUFFLE1BQU0sMkJBQTJCLEVBQUUsSUFBSSxHQUFLO0VBQ3JELFFBQVEsaUJBQUUsS0FBSyxDQUFDLFdBQVcsV0FBVyxXQUFXLENBQUM7RUFDbEQsZUFBZSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVc7RUFDM0MsWUFBWSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVc7RUFDeEMsY0FBYztFQUNkLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixNQUFJLEtBQUssYUFBYSxLQUFLLGFBQWE7QUFDdEMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsV0FBVztLQUNuQjtFQUNIO0FBQ0EsTUFBSSxLQUFLLGVBQWUsWUFBWSxLQUFLLFdBQVc7QUFDbEQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsa0JBQWtCLFNBQVM7S0FDbkM7RUFDSDtBQUNBLE1BQUksS0FBSyxlQUFlLFlBQVksS0FBSyxhQUFhO0FBQ3BELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGtCQUFrQixTQUFTO0tBQ25DO0VBQ0g7QUFDQSxNQUFJLEtBQUssZUFBZSxPQUFPLEtBQUssZUFBZSxJQUFJO0FBQ3JELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGtCQUFrQixJQUFJO0tBQzlCO0VBQ0g7QUFDQSxNQUFJLEtBQUssY0FBYyxXQUFXLEtBQUssWUFBWTtBQUNqRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxRQUFNLGNBQWMsb0JBQUksSUFBRztBQUMzQixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssS0FBSyxjQUFjLFFBQU8sR0FBSTtBQUM1RCxRQUFJLFlBQVksSUFBSSxTQUFTLE1BQU0sR0FBRztBQUNwQyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxRQUFRO09BQ3hDO0lBQ0g7QUFDQSxnQkFBWSxJQUFJLFNBQVMsTUFBTTtFQUNqQztBQUNBLE1BQUksS0FBSyxnQkFBZ0IsS0FBSyxZQUFZO0FBQ3hDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGVBQWU7S0FDdkI7RUFDSDtBQUNBLE1BQUksS0FBSyxXQUFXLGVBQWUsS0FBSyxrQkFBa0IsS0FBSyxZQUFZO0FBQ3pFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFFBQVE7S0FDaEI7RUFDSDtBQUNGLENBQUM7OztBQ3BNSCxJQUFNLGdCQUFnQixpQkFBRSxNQUFNLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHLENBQUMsRUFBRSxJQUFJLEdBQUc7QUFDeEUsSUFBTSxhQUFhLGlCQUFFLE1BQU0saUJBQUUsT0FBTSxFQUFHLEtBQUksRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxFQUFFLElBQUksR0FBRztBQUNyRSxJQUFNLHVCQUF1QixpQkFDMUIsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksR0FBRyxFQUNQLE1BQU0sK0JBQStCLEVBQ3JDLE1BQUs7QUFFRCxJQUFNLHFCQUFxQixpQkFDL0IsT0FBTztFQUNOLElBQUk7RUFDSixNQUFNO0VBQ04sV0FBVyxpQkFBRSxNQUFNLG9CQUFvQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztDQUN4RCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLFFBQU0sT0FBTyxvQkFBSSxJQUFHO0FBQ3BCLGFBQVcsQ0FBQyxPQUFPLEdBQUcsS0FBSyxTQUFTLFVBQVUsUUFBTyxHQUFJO0FBQ3ZELFFBQUksS0FBSyxJQUFJLEdBQUcsR0FBRztBQUNqQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxhQUFhLEtBQUs7T0FDMUI7SUFDSDtBQUNBLFNBQUssSUFBSSxHQUFHO0VBQ2Q7QUFDRixDQUFDO0FBRUksSUFBTSxxQkFBcUIsaUJBQy9CLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULE1BQU07RUFDTixNQUFNLFdBQVcsU0FBUTtFQUN6QixTQUFTO0VBQ1QsYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDbEQsTUFBTSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxFQUFFLEVBQUUsU0FBUTtFQUNqQyxZQUFZLGlCQUFFLE9BQU0sRUFBRyxJQUFJLEVBQUUsRUFBRSxTQUFRO0VBQ3ZDLE1BQU07RUFDTixPQUFPO0VBQ1AsVUFBVTtFQUNWLFdBQVc7RUFDWCxVQUFVO0VBQ1YsV0FBVztFQUNYLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEMsRUFDQSxPQUFNO0FBRUYsSUFBTSxzQkFBc0IsaUJBQ2hDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixJQUFJO0VBQ0osU0FBUztFQUNULFNBQVM7RUFDVCxZQUFZO0VBQ1osT0FBTztFQUNQLE1BQU0sV0FBVyxTQUFRO0VBQ3pCLFNBQVM7RUFDVCxVQUFVLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxHQUFHLEVBQUUsU0FBUTtFQUM3QyxpQkFBaUI7RUFDakIsZ0JBQWdCLGlCQUFFLE1BQU0sc0JBQXNCLEVBQUUsSUFBSSxHQUFLO0VBQ3pELFlBQVksaUJBQUUsTUFBTSxxQkFBcUIsRUFBRSxJQUFJLEdBQUs7RUFDcEQsWUFBWSxpQkFBRSxNQUFNLHNCQUFzQixFQUFFLElBQUksR0FBSztFQUNyRCxxQkFBcUIsaUJBQUUsTUFBTSx3QkFBd0IsRUFBRSxJQUFJLEdBQU07RUFDakUsT0FBTztFQUNQLE1BQU07RUFDTixVQUFVLGlCQUFFLFFBQU87RUFDbkIsYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksR0FBRyxFQUFFLFNBQVE7RUFDaEQsT0FBTyxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRyxFQUFFLFNBQVE7RUFDakQsU0FBUyxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDckQscUJBQXFCLGlCQUFFLFFBQU87RUFDOUIsV0FBVyxnQkFBZ0IsU0FBUTtFQUNuQyxzQkFBc0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxLQUFNLEVBQUUsU0FBUTtFQUN0RSxlQUFlLGdCQUFnQixTQUFRO0VBQ3ZDLGdCQUFnQixnQkFBZ0IsU0FBUTtFQUN4QyxnQkFBZ0IsaUJBQUUsTUFBTSxZQUFZLEVBQUUsSUFBSSxHQUFLO0VBQy9DLGVBQWUsaUJBQUUsTUFBTSxrQkFBa0IsRUFBRSxJQUFJLEdBQUs7RUFDcEQsZUFBZSxpQkFBRSxNQUFNLGtCQUFrQixFQUFFLElBQUksR0FBRztFQUNsRCxVQUFVO0VBQ1YsV0FBVztFQUNYLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEMsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixRQUFNLFdBQVcsb0JBQUksSUFBRztBQUN4QixRQUFNLGFBQWEsb0JBQUksSUFBRztBQUMxQixRQUFNLG1CQUFtQixvQkFBSSxJQUFHO0FBQ2hDLFFBQU0scUJBQXFCLG9CQUFJLElBQUc7QUFDbEMsYUFBVyxDQUFDLE9BQU8sS0FBSyxLQUFLO0lBQzNCLEdBQUcsS0FBSztJQUNSLEdBQUcsS0FBSztJQUNSLFFBQU8sR0FBSTtBQUNYLFFBQUksU0FBUyxJQUFJLE1BQU0sT0FBTyxLQUFLLFdBQVcsSUFBSSxNQUFNLFNBQVMsR0FBRztBQUNsRSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxrQkFBa0IsS0FBSztPQUMvQjtJQUNIO0FBQ0EsYUFBUyxJQUFJLE1BQU0sT0FBTztBQUMxQixlQUFXLElBQUksTUFBTSxTQUFTO0FBQzlCLFFBQUksUUFBUSxLQUFLLGVBQWUsUUFBUTtBQUN0Qyx1QkFBaUIsSUFBSSxNQUFNLE9BQU87QUFDbEMseUJBQW1CLElBQUksTUFBTSxTQUFTO0lBQ3hDO0VBQ0Y7QUFFQSxRQUFNLHNCQUFzQixvQkFBSSxJQUFHO0FBQ25DLFFBQU0scUJBQXFCLG9CQUFJLElBQUc7QUFDbEMsYUFBVyxDQUFDLE9BQU8sVUFBVSxLQUFLLEtBQUssV0FBVyxRQUFPLEdBQUk7QUFDM0QsUUFDRSxvQkFBb0IsSUFBSSxXQUFXLEVBQUUsS0FDckMsbUJBQW1CLElBQUksV0FBVyxTQUFTLEtBQzNDLGlCQUFpQixJQUFJLFdBQVcsRUFBRSxLQUNsQyxtQkFBbUIsSUFBSSxXQUFXLFNBQVMsR0FDM0M7QUFDQSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FDRTtRQUNGLE1BQU0sQ0FBQyxjQUFjLEtBQUs7T0FDM0I7SUFDSDtBQUNBLHdCQUFvQixJQUFJLFdBQVcsSUFBSSxVQUFVO0FBQ2pELHVCQUFtQixJQUFJLFdBQVcsU0FBUztFQUM3QztBQUNBLFFBQU0sZUFBZSxvQkFBSSxJQUFHO0FBQzVCLGFBQVcsQ0FBQyxPQUFPLEtBQUssS0FBSyxLQUFLLFdBQVcsUUFBTyxHQUFJO0FBQ3RELFVBQU0sYUFBYSxvQkFBb0IsSUFBSSxNQUFNLE9BQU87QUFDeEQsVUFBTSxvQkFDSixZQUFZLGNBQWMsTUFBTSxhQUNoQyw0QkFBNEIsWUFBWSxNQUFNLEtBQUs7QUFDckQsUUFBSSxhQUFhLElBQUksTUFBTSxPQUFPLEtBQUssQ0FBQyxtQkFBbUI7QUFDekQsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsY0FBYyxLQUFLO09BQzNCO0lBQ0g7QUFDQSxpQkFBYSxJQUFJLE1BQU0sT0FBTztFQUNoQztBQUNBLGFBQVcsQ0FBQyxPQUFPLFVBQVUsS0FBSyxLQUFLLFdBQVcsUUFBTyxHQUFJO0FBQzNELFVBQU0sU0FBUyxLQUFLLFdBQVcsS0FBSyxDQUFDLFVBQVUsTUFBTSxZQUFZLFdBQVcsRUFBRTtBQUM5RSxRQUNFLFdBQVcsYUFDVixXQUFXLFVBQWEsQ0FBQyw0QkFBNEIsWUFBWSxPQUFPLEtBQUssSUFDOUU7QUFDQSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxjQUFjLEtBQUs7T0FDM0I7SUFDSDtFQUNGO0FBRUEsUUFBTSxzQkFBc0Isb0JBQUksSUFBSTtJQUNsQyxHQUFHLEtBQUssZUFBZSxJQUFJLENBQUMsRUFBRSxRQUFPLE1BQU8sT0FBTztJQUNuRCxHQUFHLEtBQUssV0FBVyxJQUFJLENBQUMsRUFBRSxHQUFFLE1BQU8sRUFBRTtHQUN0QztBQUNELFFBQU0sdUJBQXVCLG9CQUFJLElBQUk7SUFDbkMsR0FBRyxLQUFLLGVBQWUsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7SUFDdkQsR0FBRyxLQUFLLFdBQVcsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7R0FDcEQ7QUFDRCxRQUFNLGNBQWMsb0JBQUksSUFBRztBQUMzQixRQUFNLGVBQWUsb0JBQUksSUFBRztBQUM1QixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssS0FBSyxvQkFBb0IsUUFBTyxHQUFJO0FBQ2xFLFFBQ0UsWUFBWSxJQUFJLFNBQVMsV0FBVyxFQUFFLEtBQ3RDLGFBQWEsSUFBSSxTQUFTLFdBQVcsU0FBUyxLQUM5QyxvQkFBb0IsSUFBSSxTQUFTLFdBQVcsRUFBRSxLQUM5QyxxQkFBcUIsSUFBSSxTQUFTLFdBQVcsU0FBUyxHQUN0RDtBQUNBLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUNFO1FBQ0YsTUFBTSxDQUFDLHVCQUF1QixLQUFLO09BQ3BDO0lBQ0g7QUFDQSxnQkFBWSxJQUFJLFNBQVMsV0FBVyxFQUFFO0FBQ3RDLGlCQUFhLElBQUksU0FBUyxXQUFXLFNBQVM7RUFDaEQ7QUFFQSxRQUFNLGlCQUFpQixvQkFBSSxJQUFHO0FBQzlCLGFBQVcsQ0FBQyxPQUFPLGFBQWEsS0FBSyxLQUFLLGVBQWUsUUFBTyxHQUFJO0FBQ2xFLFFBQUksa0JBQWtCLEtBQUssTUFBTSxlQUFlLElBQUksYUFBYSxHQUFHO0FBQ2xFLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUNFO1FBQ0YsTUFBTSxDQUFDLGtCQUFrQixLQUFLO09BQy9CO0lBQ0g7QUFDQSxtQkFBZSxJQUFJLGFBQWE7RUFDbEM7QUFDQSxRQUFNLGdCQUFnQixvQkFBSSxJQUFHO0FBQzdCLGFBQVcsQ0FBQyxPQUFPLFlBQVksS0FBSyxLQUFLLGNBQWMsUUFBTyxHQUFJO0FBQ2hFLFFBQUksY0FBYyxJQUFJLFlBQVksR0FBRztBQUNuQyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsS0FBSztPQUM5QjtJQUNIO0FBQ0Esa0JBQWMsSUFBSSxZQUFZO0VBQ2hDO0FBRUEsYUFBVyxDQUFDLGdCQUFnQixNQUFNLEtBQUs7SUFDckMsQ0FBQyxrQkFBa0IsS0FBSyxjQUFjO0lBQ3RDLENBQUMsY0FBYyxLQUFLLFVBQVU7S0FDcEI7QUFDVixlQUFXLENBQUMsWUFBWSxNQUFNLEtBQUssT0FBTyxRQUFPLEdBQUk7QUFDbkQsaUJBQVcsYUFBYSxtQkFBbUIsT0FBTyxLQUFLLEdBQUc7QUFDeEQsY0FBTSxRQUNKLFVBQVUsU0FBUyxtQkFDZixlQUFlLElBQUksVUFBVSxNQUFNLElBQ25DLGNBQWMsSUFBSSxVQUFVLFlBQVk7QUFDOUMsWUFBSSxDQUFDLE9BQU87QUFDVixrQkFBUSxTQUFTO1lBQ2YsTUFBTTtZQUNOLFNBQVM7WUFDVCxNQUFNLENBQUMsZ0JBQWdCLFlBQVksT0FBTztXQUMzQztRQUNIO01BQ0Y7SUFDRjtFQUNGO0FBRUEsUUFBTSxhQUFhLG9CQUFJLElBQUk7SUFDekIsR0FBRyxLQUFLLGVBQWUsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7SUFDdkQsR0FBRyxLQUFLLFdBQVcsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7R0FDcEQ7QUFDRCxRQUFNLGNBQWMsb0JBQUksSUFBRztBQUMzQixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssS0FBSyxjQUFjLFFBQU8sR0FBSTtBQUM1RCxRQUFJLFlBQVksSUFBSSxTQUFTLEVBQUUsR0FBRztBQUNoQyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxJQUFJO09BQ3BDO0lBQ0g7QUFDQSxnQkFBWSxJQUFJLFNBQVMsRUFBRTtBQUMzQixRQUFJLFNBQVMsVUFBVSxLQUFLLENBQUMsUUFBUSxDQUFDLFdBQVcsSUFBSSxHQUFHLENBQUMsR0FBRztBQUMxRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxXQUFXO09BQzNDO0lBQ0g7RUFDRjtBQUNGLENBQUM7QUFFSSxJQUFNLG9CQUFvQjtBQUVqQyxTQUFTLG1CQUNQLE9BQXVCO0FBS3ZCLE1BQUksTUFBTSxVQUFVO0FBQVcsV0FBTyxDQUFBO0FBQ3RDLFFBQU0sVUFDSixNQUFNLFFBQVEsZ0JBQWdCLFdBQzFCLENBQUMsTUFBTSxRQUFRLEtBQUssSUFDcEIsTUFBTSxRQUFRLFNBQVMsSUFBSSxDQUFDLEVBQUUsT0FBTyxPQUFNLE1BQU8sTUFBTTtBQUM5RCxRQUFNLGFBR0EsQ0FBQTtBQUNOLGFBQVcsVUFBVSxTQUFTO0FBQzVCLFFBQUksT0FBTyxTQUFTO0FBQWtCLGlCQUFXLEtBQUssTUFBTTtBQUM1RCxRQUFJLE9BQU8sU0FBUztBQUF3QixpQkFBVyxLQUFLLE1BQU07RUFDcEU7QUFDQSxTQUFPO0FBQ1Q7QUFFTyxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLGNBQWM7RUFDZCxnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksRUFBRSxFQUNOLE1BQU0sa0JBQWtCO0VBQzNCLHVCQUF1QixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksSUFBSztFQUN4RCxtQkFBbUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLElBQUs7RUFDcEQsc0JBQXNCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxLQUFNO0VBQ3hELGtCQUFrQixpQkFBRSxRQUFRLEtBQUs7Q0FDbEMsRUFDQSxPQUFNOzs7QUNwVEYsSUFBTSx5QkFBeUIsaUJBQUUsUUFBUSxvQkFBb0I7QUFDN0QsSUFBTSw4QkFBOEI7QUFDcEMsSUFBTSwwQkFBMEIsaUJBQUUsUUFBUSwyQkFBMkI7QUFDckUsSUFBTSwyQkFBMkI7QUFFakMsSUFBTSw2QkFBNkIsY0FBYyxPQUN0RCxDQUFDLFNBQVMsS0FBSyxTQUFTLGdCQUN4QixFQUFFLE9BQU8scURBQW9ELENBQUU7QUFHMUQsSUFBTSx3QkFBd0IsaUJBQ2xDLE9BQU87RUFDTixPQUFPO0VBQ1AsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQUVGLElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxPQUFPLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUcsR0FBRyxxQkFBcUI7Q0FDcEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFNBQVMsWUFBVztBQUNoQyxNQUFJLE9BQU8sS0FBSyxRQUFRLE9BQU8sRUFBRSxTQUFTLEtBQVE7QUFDaEQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsU0FBUztLQUNqQjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sMkJBQTJCLGlCQUNyQyxPQUFPO0VBQ04sUUFBUTtFQUNSLFNBQVM7RUFDVCxJQUFJO0VBQ0osZUFBZTtFQUNmLHNCQUFzQjtFQUN0QixtQkFBbUI7RUFDbkIsU0FBUztFQUNULGVBQWUsaUJBQ1osTUFBTSwwQkFBMEIsRUFDaEMsSUFBSSx3QkFBd0IsRUFDNUIsUUFBUSxDQUFBLENBQUU7RUFDYixVQUFVO0VBQ1Ysa0JBQWtCO0VBQ2xCLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFVBQVUsWUFBVztBQUNqQyxNQUFJLFNBQVMsa0JBQWtCLHdCQUF3QjtBQUNyRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxNQUFJLFNBQVMseUJBQXlCLCtCQUErQjtBQUNuRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxzQkFBc0I7S0FDOUI7RUFDSDtBQUVBLE1BQUksU0FBUyxRQUFRLFNBQVMsZ0JBQWdCO0FBQzVDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFdBQVcsTUFBTTtLQUN6QjtFQUNILE9BQU87QUFDTCxRQUFJLFNBQVMsUUFBUSxVQUFVLFVBQVU7QUFDdkMsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsV0FBVyxPQUFPO09BQzFCO0lBQ0g7QUFDQSxRQUFJLFNBQVMsUUFBUSxlQUFlLFNBQVMsbUJBQW1CO0FBQzlELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFdBQVcsWUFBWTtPQUMvQjtJQUNIO0FBQ0EsUUFBSSxTQUFTLFFBQVEsZUFBZSxJQUFJLFlBQVksU0FBUyxJQUFJO0FBQy9ELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFdBQVcsa0JBQWtCLE9BQU8sU0FBUztPQUNyRDtJQUNIO0VBQ0Y7QUFFQSxRQUFNLFVBQVUsb0JBQUksSUFBSSxDQUFDLFNBQVMsUUFBUSxFQUFFLENBQUM7QUFDN0MsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLFNBQVMsY0FBYyxRQUFPLEdBQUk7QUFDNUQsUUFBSSxRQUFRLElBQUksS0FBSyxFQUFFLEdBQUc7QUFDeEIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsaUJBQWlCLE9BQU8sSUFBSTtPQUNwQztJQUNIO0FBQ0EsWUFBUSxJQUFJLEtBQUssRUFBRTtBQUNuQixRQUFJLEtBQUssZUFBZSxTQUFTLG1CQUFtQjtBQUNsRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxZQUFZO09BQzVDO0lBQ0g7QUFDQSxRQUFJLEtBQUssZUFBZSxJQUFJLFlBQVksU0FBUyxJQUFJO0FBQ25ELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLGlCQUFpQixPQUFPLGtCQUFrQixPQUFPLFNBQVM7T0FDbEU7SUFDSDtBQUNBLFFBQUksS0FBSyxlQUFlLElBQUksa0JBQWtCLFNBQVMsZUFBZTtBQUNwRSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxrQkFBa0IsT0FBTyxlQUFlO09BQ3hFO0lBQ0g7QUFDQSxRQUFJLEtBQUssVUFBVSxZQUFZLEtBQUssVUFBVSxXQUFXO0FBQ3ZELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLGlCQUFpQixPQUFPLE9BQU87T0FDdkM7SUFDSDtFQUNGO0FBRUEsUUFBTSxNQUFNLFNBQVMsaUJBQWlCO0FBQ3RDLE1BQ0UsSUFBSSxhQUFhLFVBQ2pCLElBQUksbUJBQW1CLFVBQ3ZCLElBQUksYUFBYSxTQUFTLFVBQzFCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsb0JBQW9CLEtBQUs7S0FDakM7RUFDSDtBQUNBLE1BQ0UsSUFBSSxZQUFZLFNBQVMsTUFDekIsSUFBSSxhQUFhLFNBQVMsTUFDMUIsSUFBSSxrQkFBa0IsU0FBUyxpQkFDL0IsSUFBSSxlQUFlLFNBQVMsbUJBQzVCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsb0JBQW9CLEtBQUs7S0FDakM7RUFDSDtBQUNGLENBQUM7OztBQzlLSSxJQUFNLG1CQUFtQixPQUFPLE9BQU87RUFDNUM7RUFDQTtFQUNBO0NBQ1E7QUFDSCxJQUFNLGlCQUFpQjtBQUN2QixJQUFNLGlCQUFpQixpQkFBaUI7QUFFeEMsSUFBTSxpQkFBaUIsaUJBQUUsS0FBSyxnQkFBZ0I7QUFDOUMsSUFBTSxrQkFBa0IsaUJBQzVCLE1BQU0sY0FBYyxFQUNwQixJQUFJLGNBQWMsRUFDbEIsSUFBSSxjQUFjLEVBQ2xCLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsTUFBSSxJQUFJLElBQUksTUFBTSxFQUFFLFNBQVMsT0FBTyxRQUFRO0FBQzFDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7OztBQ2FJLElBQU0sNEJBQTRCO0FBQ2xDLElBQU0sNEJBQTRCO0FBRWxDLElBQU0sdUJBQXVCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFNBQVMsUUFBUSxZQUFZLENBQUM7QUFDNUUsSUFBTSxzQkFBc0IsaUJBQUUsS0FBSyxDQUFDLFVBQVUsYUFBYSxXQUFXLE9BQU8sQ0FBQztBQUVyRixJQUFNLHlCQUF5QixpQkFDNUIsT0FBTztFQUNOLElBQUk7RUFDSixTQUFTO0VBQ1QsZ0JBQWdCO0VBQ2hCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsZ0JBQWdCLG1CQUFtQixTQUFRO0VBQzNDLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLHFCQUFxQixpQkFDL0IsbUJBQW1CLGNBQWM7RUFDaEMsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLE9BQU87SUFDN0IsVUFBVTtHQUNYO0VBQ0QsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLE9BQU87SUFDN0IsVUFBVTtHQUNYO0VBQ0QsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLE1BQU07SUFDNUIsVUFBVTtHQUNYO0VBQ0QsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLFlBQVk7SUFDbEMsVUFBVTtHQUNYO0NBQ0YsRUFDQSxZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLE1BQUksT0FBTyxtQkFBbUIsR0FBRztBQUMvQixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxnQkFBZ0I7S0FDeEI7RUFDSDtBQUNBLE1BQUksT0FBTyxjQUFjLFdBQVcsT0FBTyxtQkFBbUIsUUFBVztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxnQkFBZ0I7S0FDeEI7RUFDSDtBQUNBLE1BQUksT0FBTyxlQUFlLFdBQVcsT0FBTyxhQUFhLE9BQU8sU0FBUztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxVQUFVO0tBQ2xCO0VBQ0g7QUFDRixDQUFDO0FBRUgsSUFBTSxpQ0FBaUMsaUJBQ3BDLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULGVBQWU7RUFDZixjQUFjO0VBQ2QsZ0JBQWdCLDJCQUEyQixTQUFRO0VBQ25ELFFBQVE7RUFDUixXQUFXO0VBQ1gsWUFBWSxnQkFBZ0IsU0FBUTtFQUNwQyxXQUFXLGdCQUFnQixTQUFRO0NBQ3BDLEVBQ0EsT0FBTTtBQUVULFNBQVMsc0JBQ1AsUUFDQSxTQUF3QjtBQUV4QixNQUNFLE9BQU8sbUJBQW1CLFdBQ3pCLE9BQU8sZUFBZSxJQUFJLFlBQVksT0FBTyxXQUM1QyxPQUFPLGVBQWUsSUFBSSxrQkFBa0IsT0FBTyxpQkFDbkQsT0FBTyxlQUFlLElBQUksZUFBZSxrQkFDekMsT0FBTyxlQUFlLElBQUksYUFBYSxPQUFPLEtBQ2hEO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsa0JBQWtCLEtBQUs7S0FDL0I7RUFDSDtBQUNGO0FBR08sSUFBTSwyQkFDWCwrQkFBK0IsWUFBWSxxQkFBcUI7QUFHM0QsSUFBTSxxQkFBcUIsK0JBQy9CLE9BQU8sRUFBRSxXQUFXLG1CQUFrQixDQUFFLEVBQ3hDLFlBQVkscUJBQXFCO0FBRTdCLElBQU0sZ0NBQWdDLGlCQUFFLEtBQUs7RUFDbEQ7RUFDQTtDQUNEO0FBRUQsSUFBTSx5Q0FBeUMsaUJBQzVDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixNQUFNO0VBQ04scUJBQXFCLGlCQUNsQixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsYUFBYTtFQUNiLGNBQWM7RUFDZCx1QkFBdUI7RUFDdkIsMEJBQTBCO0VBQzFCLCtCQUErQjtDQUNoQyxFQUNBLE9BQU07QUFFVCxTQUFTLDRCQUNQLGFBQ0EsU0FBd0I7QUFFeEIsTUFDRSxZQUFZLGdDQUFnQyxZQUFZLDBCQUN4RDtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLCtCQUErQjtLQUN2QztFQUNIO0FBQ0Y7QUFFTyxJQUFNLG1DQUNYLHVDQUF1QyxZQUFZLDJCQUEyQjtBQUV6RSxJQUFNLDRCQUE0Qix1Q0FDdEMsT0FBTyxFQUFFLGVBQWUsbUJBQWtCLENBQUUsRUFDNUMsT0FBTSxFQUNOLFlBQVksMkJBQTJCO0FBRW5DLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUztFQUNULFVBQVU7RUFDViwwQkFBMEI7RUFDMUIsV0FBVztFQUNYLHFCQUFxQiwwQkFBMEIsU0FBUTtFQUN2RCw0QkFBNEIsbUJBQW1CLFNBQVE7Q0FDeEQsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixNQUNFLE1BQU0sd0JBQXdCLFVBQzlCLE1BQU0sb0JBQW9CLHdCQUF3QixNQUFNLDBCQUN4RDtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLDBCQUEwQjtLQUNsQztFQUNIO0FBQ0YsQ0FBQztBQUVILElBQU0sNEJBQTRCLGlCQUMvQixPQUFPO0VBQ04sU0FBUztFQUNULE9BQU8saUJBQUUsS0FBSyxDQUFDLFdBQVcsVUFBVSxDQUFDO0VBQ3JDLG1CQUFtQjtFQUNuQixvQkFBb0I7RUFDcEIsb0JBQW9CO0VBQ3BCLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFlBQVksZ0JBQWdCLFNBQVE7Q0FDckMsRUFDQSxPQUFNO0FBRUYsSUFBTSx3QkFBd0IsaUJBQ2xDLG1CQUFtQixjQUFjO0VBQ2hDLDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxPQUFPO0lBQzdCLFVBQVU7R0FDWDtFQUNELDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxPQUFPO0lBQzdCLFVBQVU7R0FDWDtFQUNELDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxNQUFNO0lBQzVCLFVBQVU7R0FDWDtFQUNELDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxZQUFZO0lBQ2xDLFVBQVU7R0FDWDtDQUNGLEVBQ0EsWUFBWSxDQUFDLFdBQVcsWUFBVztBQUNsQyxNQUFJLFVBQVUscUJBQXFCLFVBQVUsb0JBQW9CO0FBQy9ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLG1CQUFtQjtLQUMzQjtFQUNIO0FBQ0EsTUFBSSxVQUFVLGVBQWUsV0FBVyxVQUFVLGFBQWEsVUFBVSxTQUFTO0FBQ2hGLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVU7S0FDbEI7RUFDSDtBQUNBLE1BQUksVUFBVSxVQUFVLGNBQWMsVUFBVSxlQUFlLFFBQVc7QUFDeEUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsWUFBWTtLQUNwQjtFQUNIO0FBQ0EsTUFBSSxVQUFVLFVBQVUsYUFBYSxVQUFVLGVBQWUsUUFBVztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxZQUFZO0tBQ3BCO0VBQ0g7QUFDQSxNQUFJLFVBQVUsVUFBVSxjQUFjLFVBQVUsZUFBZSxRQUFXO0FBQ3hFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHVCQUF1QixpQkFBRSxtQkFBbUIsY0FBYztFQUNyRSxpQkFDRyxPQUFPO0lBQ04sWUFBWSxpQkFBRSxRQUFRLE9BQU87SUFDN0IsdUJBQXVCLG9CQUFvQixTQUFRO0lBQ25ELGdCQUFnQixpQkFDYixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7SUFDaEMsUUFBUTtHQUNULEVBQ0EsT0FBTTtFQUNULGlCQUNHLE9BQU87SUFDTixZQUFZLGlCQUFFLFFBQVEsT0FBTztJQUM3Qix3QkFBd0IscUJBQXFCLFNBQVE7SUFDckQsZ0JBQWdCLGlCQUNiLE9BQU0sRUFDTixJQUFJLHlCQUF5QixFQUM3QixJQUFJLHlCQUF5QjtJQUNoQyxRQUFRO0dBQ1QsRUFDQSxPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLFlBQVksaUJBQUUsUUFBUSxNQUFNO0lBQzVCLHdCQUF3QixxQkFBcUIsU0FBUTtJQUNyRCxnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0lBQ2hDLFFBQVE7R0FDVCxFQUNBLE9BQU07Q0FDVjtBQUVNLElBQU0sbUNBQW1DLGlCQUM3QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsZ0JBQWdCLGlCQUNiLE9BQU0sRUFDTixJQUFJLHlCQUF5QixFQUM3QixJQUFJLHlCQUF5QjtFQUNoQyw0QkFBNEIscUJBQXFCLFNBQVE7RUFDekQsUUFBUTtDQUNULEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxzQkFDSixNQUFNLCtCQUErQixPQUNqQyxJQUNBLE1BQU0sNkJBQTZCO0FBQ3pDLE1BQUksTUFBTSxPQUFPLG1CQUFtQixxQkFBcUI7QUFDdkQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQ0U7TUFDRixNQUFNLENBQUMsVUFBVSxnQkFBZ0I7S0FDbEM7RUFDSDtBQUNBLE1BQUksNEJBQTRCLE1BQU0sTUFBTSxNQUFNLE1BQU0sT0FBTyxhQUFhO0FBQzFFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVUsYUFBYTtLQUMvQjtFQUNIO0FBQ0YsQ0FBQztBQUVILElBQU0seUNBQXlDLGlCQUFFLE9BQU87RUFDdEQsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsZ0JBQWdCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVyxFQUFHLElBQUkscUJBQXFCO0VBQ3hFLHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxxQ0FBcUM7RUFDNUMsc0JBQXNCLGlCQUNuQixPQUFNLEVBQ04sSUFBRyxFQUNILFlBQVcsRUFDWCxJQUFJLHNDQUFzQztDQUM5QztBQUVNLElBQU0saUNBQWlDLGlCQUMzQyxtQkFBbUIsU0FBUztFQUMzQix1Q0FDRyxPQUFPO0lBQ04sT0FBTyxpQkFBRSxRQUFRLE9BQU87SUFDeEIsZ0JBQWdCLGlCQUFFLFFBQVEsQ0FBQztJQUMzQixxQkFBcUIsaUJBQUUsUUFBUSxDQUFDO0lBQ2hDLHNCQUFzQixpQkFBRSxRQUFRLENBQUM7R0FDbEMsRUFDQSxPQUFNO0VBQ1QsdUNBQ0csT0FBTztJQUNOLE9BQU8saUJBQUUsUUFBUSxTQUFTO0lBQzFCLGdCQUFnQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVEsRUFBRyxJQUFJLHFCQUFxQjtJQUNyRSxnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSx3QkFBd0IsQ0FBQztJQUNoQyx5QkFBeUI7SUFDekIseUJBQXlCLGlCQUN0QixPQUFNLEVBQ04sSUFBRyxFQUNILFlBQVcsRUFDWCxJQUFJLG9DQUFvQztHQUM1QyxFQUNBLE9BQU07RUFDVCx1Q0FDRyxPQUFPO0lBQ04sT0FBTyxpQkFBRSxRQUFRLG1CQUFtQjtJQUNwQyxnQkFBZ0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxxQkFBcUI7SUFDckUsZ0JBQWdCLGlCQUNiLE9BQU0sRUFDTixJQUFHLEVBQ0gsWUFBVyxFQUNYLElBQUksd0JBQXdCLENBQUM7SUFDaEMseUJBQXlCO0lBQ3pCLHlCQUF5QixpQkFDdEIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxvQ0FBb0M7R0FDNUMsRUFDQSxPQUFNO0NBQ1YsRUFDQSxZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLE1BQUksU0FBUyxVQUFVO0FBQVM7QUFDaEMsTUFDRSxTQUFTLFVBQVUsYUFDbkIsU0FBUyxtQkFBbUIsdUJBQzVCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsT0FBTztLQUNmO0VBQ0g7QUFDQSxNQUFJLFNBQVMsbUJBQW1CLFNBQVMsaUJBQWlCLEdBQUc7QUFDM0QsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZ0JBQWdCO0tBQ3hCO0VBQ0g7QUFDQSxNQUNFLFNBQVMseUJBQ1QsU0FBUyxzQkFDUCxTQUFTLGlCQUFpQixtQ0FDNUI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxzQkFBc0I7S0FDOUI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHNDQUFzQyxpQkFDaEQsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFFRixJQUFNLG1CQUFtQixpQkFDN0IsT0FBTztFQUNOLFNBQVM7RUFDVCxnQkFBZ0I7RUFDaEIsMEJBQTBCO0NBQzNCLEVBQ0EsT0FBTTtBQUVGLElBQU0sa0JBQWtCLGlCQUFFLEtBQUs7RUFDcEM7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRU0sSUFBTSx1Q0FBdUMsaUJBQUUsS0FBSztFQUN6RDtFQUNBO0NBQ0Q7QUFFTSxJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFVBQVU7RUFDVixpQkFBaUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXLEVBQUcsSUFBSSxPQUFPLGdCQUFnQjtFQUMzRSwyQkFBMkIsaUJBQUUsT0FBTSxFQUFHLFNBQVE7RUFDOUMsWUFBWTtDQUNiLEVBQ0EsT0FBTTs7O0FDN2FGLElBQU0sdUJBQXVCLGlCQUFFLE9BQU8sRUFBRSxRQUFRLGlCQUFFLFFBQVEsSUFBSSxFQUFDLENBQUUsRUFBRSxPQUFNO0FBQ3pFLElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPLEVBQUUsUUFBUSxpQkFBRSxLQUFLLENBQUMsU0FBUyxXQUFXLENBQUMsRUFBQyxDQUFFLEVBQ2pELE9BQU07QUFFRixJQUFNLDhCQUE4QjtBQUNwQyxJQUFNLGlDQUFpQztBQUN2QyxJQUFNLDZCQUE2QjtBQUNuQyxJQUFNLGdDQUFnQztBQUN0QyxJQUFNLDBCQUEwQjtBQUNoQyxJQUFNLGlDQUFpQztBQUN2QyxJQUFNLDZCQUE2QjtBQUcxQyxJQUFNLHFDQUFxQyxpQkFDeEMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSwyQkFBMkI7RUFDOUMsU0FBUztFQUNULFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLGlDQUFpQyxpQkFBRSxtQkFBbUIsWUFBWTtFQUM3RSxtQ0FDRyxPQUFPO0lBQ04sVUFBVSxpQkFBRSxRQUFRLFNBQVM7SUFDN0IsSUFBSTtHQUNMLEVBQ0EsT0FBTTtFQUNULG1DQUNHLE9BQU87SUFDTixVQUFVLGlCQUFFLFFBQVEsU0FBUztJQUM3QixJQUFJO0dBQ0wsRUFDQSxPQUFNO0NBQ1Y7QUFFRCxJQUFNLGlDQUFpQyxpQkFDcEMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksNkJBQTZCLEVBQ2pDLEtBQUssZUFBZSxFQUNwQixNQUFLO0FBRUYsU0FBVSx3QkFDZCxTQUF1RDtBQUV2RCxRQUFNLGdCQUFnQiwrQkFBK0IsTUFBTSxPQUFPO0FBQ2xFLFNBQU8sK0JBQStCLE1BQ3BDLE9BQU8sS0FBSyxjQUFjLGFBQWEsR0FBRyxNQUFNLEVBQUUsU0FBUyxXQUFXLENBQUM7QUFFM0U7QUFFQSxTQUFTLGlDQUNQLFFBQWU7QUFFZixNQUFJO0FBQ0YsVUFBTSxlQUFlLCtCQUErQixNQUFNLE1BQU07QUFDaEUsVUFBTSxPQUFPLElBQUksWUFBWSxTQUFTLEVBQUUsT0FBTyxLQUFJLENBQUUsRUFBRSxPQUNyRCxPQUFPLEtBQUssY0FBYyxXQUFXLENBQUM7QUFFeEMsVUFBTSxVQUFVLCtCQUErQixNQUFNLEtBQUssTUFBTSxJQUFJLENBQVk7QUFDaEYsUUFBSSx3QkFBd0IsT0FBTyxNQUFNLGNBQWM7QUFDckQsWUFBTSxJQUFJLFVBQVUsa0NBQWtDO0lBQ3hEO0FBQ0EsV0FBTztFQUNULFFBQVE7QUFDTixVQUFNLElBQUksVUFBVSw2QkFBNkI7RUFDbkQ7QUFDRjtBQUVNLFNBQVUsd0JBQ2QsUUFBYztBQUVkLFNBQU8saUNBQWlDLE1BQU07QUFDaEQ7QUFFTyxJQUFNLDBCQUEwQiwrQkFBK0IsWUFDcEUsQ0FBQyxRQUFRLFlBQVc7QUFDbEIsTUFBSTtBQUNGLHFDQUFpQyxNQUFNO0VBQ3pDLFFBQVE7QUFDTixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBR0ksSUFBTSx1QkFBdUIsaUJBQ2pDLE9BQU0sRUFDTixPQUFPLEVBQUUsRUFDVCxNQUFNLG9CQUFvQixnREFBZ0QsRUFDMUUsT0FBTyxDQUFDLFVBQVUsT0FBTyxLQUFLLE9BQU8sV0FBVyxFQUFFLFNBQVMsV0FBVyxNQUFNLE9BQU87RUFDbEYsT0FBTztDQUNSLEVBQ0EsTUFBSztBQUVELElBQU0seUJBQXlCLGlCQUNuQyxPQUFPO0VBQ04sT0FBTyxpQkFDSixPQUFPO0lBQ04sTUFBTSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFO0lBQzlCLFNBQVMsaUJBQUUsT0FBTSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztJQUNsQyxVQUFVLGlCQUNQLE9BQU87TUFDTixZQUFZLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFNBQVMsUUFBUSxZQUFZLENBQUM7TUFDM0QsVUFBVSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO01BQ25DLGtCQUFrQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO01BQ3pELGlCQUFpQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO0tBQ3pELEVBQ0EsT0FBTSxFQUNOLFNBQVE7R0FDWixFQUNBLE9BQU07Q0FDVixFQUNBLE9BQU07QUFFRixJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLFFBQVE7RUFDUixrQkFBa0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLEVBQUUsRUFBRSxJQUFJLEtBQU07Q0FDdEQsRUFDQSxPQUFNO0FBRUYsSUFBTSw0QkFBNEIsaUJBQ3RDLE9BQU87RUFDTixVQUFVO0VBQ1YsYUFBYTtFQUNiLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLElBQUk7RUFDSixTQUFTO0VBQ1Qsa0JBQWtCO0VBQ2xCLFFBQVE7RUFDUixPQUFPLGlCQUFFLEtBQUssQ0FBQyxVQUFVLFlBQVksV0FBVyxTQUFTLENBQUM7RUFDMUQsV0FBVztFQUNYLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEMsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFFBQVEsWUFBVztBQUMvQixNQUFLLE9BQU8sVUFBVSxnQkFBaUIsT0FBTyxlQUFlLFNBQVk7QUFDdkUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxZQUFZO01BQ25CLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSyxPQUFPLFVBQVUsZUFBZ0IsT0FBTyxjQUFjLFNBQVk7QUFDckUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxXQUFXO01BQ2xCLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxNQUFNLHdCQUF3QixFQUFFLElBQUksMEJBQTBCO0VBQ3pFLFlBQVksd0JBQXdCLFNBQVE7Q0FDN0MsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QiwwQkFBd0IsV0FBVyxLQUFLLFNBQVMsS0FBSyxZQUFZLE9BQU87QUFDM0UsQ0FBQztBQUVJLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPLEVBQUUsU0FBUyxlQUFlLFVBQVUsZUFBYyxDQUFFLEVBQzNELE9BQU07QUFFRixJQUFNLDZCQUE2QixpQkFDdkMsT0FBTztFQUNOLFNBQVM7RUFDVCxXQUFXO0VBQ1gsT0FBTztDQUNSLEVBQ0EsT0FBTSxFQUNOLE9BQU8sQ0FBQyxhQUFhLFNBQVMsTUFBTSxPQUFPLFNBQVMsU0FBUztFQUM1RCxNQUFNLENBQUMsU0FBUyxJQUFJO0VBQ3BCLE9BQU87Q0FDUjtBQUVJLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sU0FBUztFQUNULFVBQVU7RUFDVixlQUFlO0VBQ2YsZ0JBQWdCLDJCQUEyQixTQUFRO0NBQ3BELEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsNkJBQ0UsUUFBUSxnQkFDUixRQUFRLFNBQ1IsUUFBUSxVQUNSLFFBQVEsZUFDUixTQUNBLENBQUMsa0JBQWtCLEtBQUssQ0FBQztBQUU3QixDQUFDO0FBRUksSUFBTSxtQ0FBbUMsaUJBQzdDLE9BQU87RUFDTixTQUFTO0VBQ1QsVUFBVTtDQUNYLEVBQ0EsT0FBTTtBQUVGLElBQU0sMkJBQTJCLGlCQUNyQyxPQUFPO0VBQ04sU0FBUztFQUNULFVBQVU7RUFDVixRQUFRO0NBQ1QsRUFDQSxPQUFNO0FBT0YsSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixPQUFPO0VBQ1AsUUFBUSxpQkFDTCxPQUFPO0lBQ04sSUFBSTtJQUNKLGVBQWU7SUFDZixnQkFBZ0IsMkJBQTJCLFNBQVE7R0FDcEQsRUFDQSxPQUFNO0NBQ1YsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFNBQVMsWUFBVztBQUNoQyxNQUFJLFFBQVEsTUFBTSxhQUFhLEdBQUc7QUFDaEMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxTQUFTLFVBQVU7TUFDMUIsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLFFBQVEsTUFBTSxjQUFjLFFBQVEsTUFBTSxXQUFXO0FBQ3ZELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsU0FBUyxXQUFXO01BQzNCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxRQUFRLE9BQU8sa0JBQWtCLFFBQVEsTUFBTSxlQUFlO0FBQ2hFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsVUFBVSxlQUFlO01BQ2hDLFNBQVM7S0FDVjtFQUNIO0FBQ0EsNkJBQ0UsUUFBUSxPQUFPLGdCQUNmLFFBQVEsTUFBTSxJQUNkLFFBQVEsT0FBTyxJQUNmLFFBQVEsT0FBTyxlQUNmLFNBQ0EsQ0FBQyxVQUFVLGtCQUFrQixLQUFLLENBQUM7QUFFdkMsQ0FBQztBQUVJLElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUztFQUNULFVBQVU7Q0FDWCxFQUNBLE9BQU07QUFJRixJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLFNBQVMsaUJBQUUsTUFBTSx3QkFBd0IsRUFBRSxJQUFJLDBCQUEwQjtFQUN6RSxZQUFZLHdCQUF3QixTQUFRO0NBQzdDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxNQUFNLFlBQVc7QUFDN0IsMEJBQXdCLFdBQVcsS0FBSyxTQUFTLEtBQUssWUFBWSxPQUFPO0FBQzNFLENBQUM7QUFFSSxJQUFNLGtCQUFrQixpQkFBRSxPQUFPLEVBQUUsU0FBUyxjQUFhLENBQUUsRUFBRSxPQUFNO0FBQ25FLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPLEVBQUUsU0FBUyxlQUFlLFVBQVUsZUFBYyxDQUFFLEVBQzNELE9BQU07QUFDRixJQUFNLHlCQUF5QixpQkFDbkMsT0FBTyxFQUFFLFNBQVMsZUFBZSxRQUFRLGdCQUFlLENBQUUsRUFDMUQsT0FBTTtBQUVGLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sdUJBQXVCO0VBQ3ZCLGdCQUFnQixpQkFDYixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsUUFBUTs7RUFFUixPQUFPLDJCQUEyQixTQUFRO0NBQzNDLEVBQ0EsT0FBTSxFQUNOLE9BQU8sQ0FBQyxVQUFVLE1BQU0sT0FBTyxhQUFhLE1BQU0sd0JBQXdCLEdBQUc7RUFDNUUsTUFBTSxDQUFDLFVBQVUsVUFBVTtFQUMzQixPQUFPO0NBQ1I7QUFFSCxJQUFNLDRCQUE0QixpQkFDL0IsT0FBTSxFQUNOLE1BQU0sdUJBQXVCLHlDQUF5QyxFQUN0RSxVQUFVLENBQUMsT0FBTyxZQUFXO0FBQzVCLFFBQU0sU0FBUyxPQUFPLEtBQUs7QUFDM0IsTUFBSSxDQUFDLE9BQU8sY0FBYyxNQUFNLEdBQUc7QUFDakMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7S0FDVjtBQUNELFdBQU8saUJBQUU7RUFDWDtBQUNBLFNBQU87QUFDVCxDQUFDO0FBRUgsSUFBTSxvQ0FBb0MsaUJBQ3ZDLE9BQU0sRUFDTixJQUFHLEVBQ0gsSUFBSSxDQUFDLEVBQ0wsSUFBSSwwQkFBMEI7QUFFMUIsSUFBTSwrQkFBK0IsaUJBQ3pDLE9BQU87RUFDTixPQUFPLGtDQUFrQyxRQUFRLDhCQUE4QjtFQUMvRSxRQUFRLHdCQUF3QixTQUFRO0NBQ3pDLEVBQ0EsT0FBTTtBQUVULElBQU0sa0NBQWtDLDBCQUEwQixLQUNoRSxpQ0FBaUM7QUFHNUIsSUFBTSw2QkFBNkIsaUJBQ3ZDLE9BQU87RUFDTixPQUFPLGdDQUFnQyxTQUFRO0VBQy9DLFFBQVEsd0JBQXdCLFNBQVE7Q0FDekMsRUFDQSxPQUFNLEVBQ04sVUFBVSxDQUFDLFVBQVUsNkJBQTZCLE1BQU0sS0FBSyxDQUFDO0FBRTFELElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsY0FBYztDQUNmLEVBQ0EsT0FBTTtBQUVGLElBQU0sNEJBQTRCLDZCQUN0QyxPQUFPLEVBQUUsWUFBWSwwQkFBeUIsQ0FBRSxFQUNoRCxPQUFNLEVBQ04sT0FBTyxDQUFDLFNBQVMsS0FBSyxhQUFhLHVCQUF1QjtFQUN6RCxNQUFNLENBQUMsWUFBWTtFQUNuQixPQUFPO0NBQ1I7QUFFSSxJQUFNLG9DQUFvQyxpQkFDOUMsT0FBTztFQUNOLE9BQU87RUFDUCxPQUFPO0NBQ1IsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFNBQVMsWUFBVztBQUNoQyxzQ0FDRSxRQUFRLE9BQ1IsUUFBUSxNQUFNLFFBQ2QsUUFBUSxNQUFNLGdCQUNkLFNBQ0EsQ0FBQyxPQUFPLENBQUM7QUFFYixDQUFDO0FBRUksSUFBTSxrQ0FBa0MsaUJBQzVDLE9BQU87RUFDTixPQUFPO0VBQ1AsVUFBVTtDQUNYLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsc0NBQ0UsUUFBUSxPQUNSLFFBQVEsU0FBUyxRQUNqQixRQUFRLFNBQVMsT0FBTyxnQkFDeEIsU0FDQSxDQUFDLFlBQVksUUFBUSxDQUFDO0FBRTFCLENBQUM7QUFJSSxJQUFNLHNCQUFzQixpQkFDaEMsT0FBTztFQUNOLGdCQUFnQiwwQkFBMEIsUUFBUSxDQUFDO0VBQ25ELDBCQUEwQjtFQUMxQixPQUFPLDBCQUEwQixRQUFRLEdBQUc7Q0FDN0MsRUFDQSxPQUFNLEVBQ04sVUFBVSxDQUFDLFdBQVc7RUFDckIsZ0JBQWdCLHFCQUFxQixNQUFNLE1BQU0sY0FBYztFQUMvRCwwQkFBMEIsb0JBQW9CLE1BQU0sTUFBTSx3QkFBd0I7RUFDbEYsT0FBTyxNQUFNO0VBQ2IsRUFDRCxPQUFPLENBQUMsVUFBVSxNQUFNLFNBQVMsS0FBSyxNQUFNLFNBQVMsNEJBQTRCO0VBQ2hGLE1BQU0sQ0FBQyxPQUFPO0VBQ2QsT0FBTztDQUNSO0FBRUksSUFBTSx5QkFBeUIsaUJBQUUsTUFBTTtFQUM1QztFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLFFBQVE7RUFDUixRQUFRLHVCQUF1QixTQUFRO0NBQ3hDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsUUFBTSxFQUFFLFFBQVEsT0FBTSxJQUFLO0FBQzNCLE1BQUksT0FBTyxjQUFjLFNBQVM7QUFDaEMsUUFBSSxXQUFXLE1BQU07QUFDbkIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxRQUFRO1FBQ2YsU0FBUztPQUNWO0lBQ0g7QUFDQTtFQUNGO0FBQ0EsTUFDRSxXQUFXLFFBQ1gsa0JBQWtCLE1BQU0sTUFBTSxPQUFPLFdBQ3JDLHFCQUFxQixNQUFNLE1BQU0sT0FBTyxjQUN4QyxhQUFhLE1BQU0sTUFBTSxPQUFPLFlBQ2hDLG1CQUFtQixNQUFNLE1BQU0sT0FBTyxnQkFDdEM7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7QUFDRDtFQUNGO0FBQ0EsTUFDRSxPQUFPLGNBQWMsZ0JBQ3BCLENBQUMsa0JBQWtCLE1BQU0sS0FBSyxPQUFPLFVBQVUsWUFDaEQ7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE9BQ0csT0FBTyxjQUFjLFlBQVksT0FBTyxjQUFjLGNBQ3ZELENBQUMsc0JBQXNCLE1BQU0sR0FDN0I7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLFNBQVM7RUFDVCxxQkFBcUI7RUFDckIsU0FBUyxpQkFBRSxNQUFNLHNCQUFzQixFQUFFLElBQUksMEJBQTBCO0VBQ3ZFLFlBQVk7RUFDWixTQUFTLGlCQUFFLFFBQU87Q0FDbkIsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixNQUNFLEtBQUssV0FBVyxZQUFZLEtBQUssV0FDakMsS0FBSyxXQUFXLDZCQUE2QixLQUFLLHFCQUNsRDtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsWUFBWTtNQUNuQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksS0FBSyxRQUFRLEtBQUssQ0FBQyxFQUFFLE9BQU0sTUFBTyxPQUFPLFlBQVksS0FBSyxPQUFPLEdBQUc7QUFDdEUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxTQUFTO01BQ2hCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxLQUFLLFdBQVcsS0FBSyxRQUFRLFdBQVcsR0FBRztBQUM3QyxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFNBQVM7TUFDaEIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSx3QkFBd0IsaUJBQ2xDLE9BQU87RUFDTixTQUFTO0VBQ1QscUJBQXFCLGlCQUNsQixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsV0FBVyxpQkFBRSxNQUFNLG9CQUFvQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksdUJBQXVCO0NBQzVFLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxPQUFPLG9CQUFJLElBQUc7QUFDcEIsYUFBVyxDQUFDLE9BQU8sUUFBUSxLQUFLLE1BQU0sVUFBVSxRQUFPLEdBQUk7QUFDekQsUUFBSSxvQkFBb0IsUUFBUSxNQUFNLE1BQU0sU0FBUztBQUNuRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGFBQWEsS0FBSztRQUN6QixTQUFTO09BQ1Y7SUFDSDtBQUNBLFFBQUksS0FBSyxJQUFJLFNBQVMsY0FBYyxHQUFHO0FBQ3JDLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixNQUFNLENBQUMsYUFBYSxPQUFPLGdCQUFnQjtRQUMzQyxTQUFTO09BQ1Y7SUFDSDtBQUNBLFNBQUssSUFBSSxTQUFTLGNBQWM7QUFDaEMsVUFBTSxXQUNKLFNBQVMsZUFBZSxVQUNwQixTQUFTLHdCQUNULFNBQVM7QUFDZixVQUFNLFdBQ0osU0FBUyxlQUFlLFVBQ3BCLFNBQVMsT0FBTyxXQUNoQixTQUFTLE9BQU87QUFDdEIsUUFBSSxjQUFjLGFBQWEsT0FBTyxJQUFJLFdBQVcsSUFBSTtBQUN2RCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGFBQWEsT0FBTyxRQUFRO1FBQ25DLFNBQVM7T0FDVjtJQUNIO0VBQ0Y7QUFDRixDQUFDO0FBRUksSUFBTSwrQkFBK0IsaUJBQ3pDLE9BQU87RUFDTixRQUFRLGlCQUFFLFFBQVEsVUFBVTtFQUM1QixnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0VBQ2hDLGFBQWEsaUJBQUUsS0FBSyxDQUFDLGFBQWEsV0FBVyxDQUFDO0VBQzlDLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFFRixJQUFNLGtDQUFrQyxpQkFDNUMsT0FBTztFQUNOLFFBQVEsaUJBQUUsUUFBUSxVQUFVO0VBQzVCLGdCQUFnQixpQkFDYixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsaUJBQWlCLGlCQUFFLE1BQU0sQ0FBQyxxQkFBcUIsb0JBQW9CLENBQUM7RUFDcEUsU0FBUyx1QkFBdUIsU0FBUTtDQUN6QyxFQUNBLE9BQU07QUFFRixJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLFNBQVM7RUFDVCxxQkFBcUI7RUFDckIscUJBQXFCLGlCQUNsQixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsU0FBUyxpQkFDTixNQUNDLGlCQUFFLG1CQUFtQixVQUFVO0lBQzdCO0lBQ0E7R0FDRCxDQUFDLEVBRUgsSUFBSSxDQUFDLEVBQ0wsSUFBSSx1QkFBdUI7Q0FDL0IsRUFDQSxPQUFNO0FBTUYsSUFBTSw0Q0FDWCxzQkFBc0IsWUFBWSxDQUFDLE9BQU8sWUFBVztBQUNuRCxRQUFNLFlBQVksb0JBQUksSUFBRztBQUN6QixRQUFNLFVBQW9CLENBQUE7QUFDMUIsTUFBSTtBQUlKLGFBQVcsQ0FBQyxPQUFPLFFBQVEsS0FBSyxNQUFNLFVBQVUsUUFBTyxHQUFJO0FBQ3pELFFBQUksU0FBUyxlQUFlLFdBQVcsU0FBUyxlQUFlLFFBQVE7QUFDckUsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxhQUFhLE9BQU8sWUFBWTtRQUN2QyxTQUFTO09BQ1Y7QUFDRDtJQUNGO0FBQ0EsUUFDRSxTQUFTLDJCQUEyQixRQUNwQyxTQUFTLE9BQU8saUJBQWlCLFFBQ2pDO0FBQ0EsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxhQUFhLEtBQUs7UUFDekIsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLFVBQVUsSUFBSSxTQUFTLE9BQU8sRUFBRSxHQUFHO0FBQ3JDLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixNQUFNLENBQUMsYUFBYSxPQUFPLFVBQVUsSUFBSTtRQUN6QyxTQUFTO09BQ1Y7SUFDSDtBQUNBLGNBQVUsSUFBSSxTQUFTLE9BQU8sRUFBRTtBQUNoQyxRQUFJLFNBQVMsZUFBZSxTQUFTO0FBQ25DLFVBQUksa0JBQWtCLFFBQVc7QUFDL0IsZ0JBQVEsU0FBUztVQUNmLE1BQU07VUFDTixNQUFNLENBQUMsYUFBYSxLQUFLO1VBQ3pCLFNBQVM7U0FDVjtNQUNIO0FBQ0Esc0JBQWdCO0lBQ2xCLE9BQU87QUFDTCxjQUFRLEtBQUssU0FBUyxPQUFPLEVBQUU7SUFDakM7RUFDRjtBQUVBLE1BQUksa0JBQWtCLFFBQVc7QUFDL0IsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxXQUFXO01BQ2xCLFNBQVM7S0FDVjtBQUNEO0VBQ0Y7QUFDQSxNQUFJLE1BQU0sVUFBVSxHQUFHLEVBQUUsTUFBTSxlQUFlO0FBQzVDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVztNQUNsQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLGFBQVcsQ0FBQyxPQUFPLFFBQVEsS0FBSyxNQUFNLFVBQVUsUUFBTyxHQUFJO0FBQ3pELFFBQ0UsU0FBUyxlQUFlLFVBQ3hCLFNBQVMsT0FBTyxZQUFZLGNBQWMsT0FBTyxJQUNqRDtBQUNBLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixNQUFNLENBQUMsYUFBYSxPQUFPLFVBQVUsU0FBUztRQUM5QyxTQUFTO09BQ1Y7SUFDSDtFQUNGO0FBQ0EsUUFBTSxnQkFBZ0IsQ0FBQyxHQUFHLE9BQU8sRUFBRSxLQUFJO0FBQ3ZDLE1BQUksUUFBUSxLQUFLLENBQUMsUUFBUSxVQUFVLFdBQVcsY0FBYyxLQUFLLENBQUMsR0FBRztBQUNwRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFdBQVc7TUFDbEIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSwyQ0FBMkMsaUJBQ3JELE9BQU87RUFDTixnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0VBQ2hDLFFBQVE7Q0FDVCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLE1BQ0csT0FBTyxPQUFPLGVBQWUsV0FBVyxPQUFPLE9BQU8sZUFBZSxVQUN0RSxPQUFPLE9BQU8sY0FBYyxVQUM1QjtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsUUFBUTtNQUNmLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sNkNBQTZDLGlCQUN2RCxPQUFPO0VBQ04sU0FBUztFQUNULHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0VBQ2hDLHFCQUFxQjtFQUNyQixTQUFTLGlCQUNOLE1BQU0sd0NBQXdDLEVBQzlDLElBQUksQ0FBQyxFQUNMLElBQUksOEJBQThCO0NBQ3RDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxVQUFVLFlBQVc7QUFDakMsUUFBTSxVQUFvQixDQUFBO0FBQzFCLE1BQUksYUFBYTtBQUNqQixhQUFXLENBQUMsT0FBTyxNQUFNLEtBQUssU0FBUyxRQUFRLFFBQU8sR0FBSTtBQUN4RCxRQUFJLE9BQU8sT0FBTyxZQUFZLFNBQVMsU0FBUztBQUM5QyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLFdBQVcsT0FBTyxVQUFVLFNBQVM7UUFDNUMsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLFFBQVEsR0FBRztBQUNiLFlBQU0sV0FBVyxTQUFTLFFBQVEsUUFBUSxDQUFDO0FBQzNDLFVBQ0UsYUFBYSxVQUNiLE9BQU8sT0FBTyxtQkFBbUIsU0FBUyxPQUFPLGlCQUFpQixHQUNsRTtBQUNBLGdCQUFRLFNBQVM7VUFDZixNQUFNO1VBQ04sTUFBTSxDQUFDLFdBQVcsT0FBTyxVQUFVLGdCQUFnQjtVQUNuRCxTQUFTO1NBQ1Y7TUFDSDtJQUNGO0FBQ0EsUUFBSSxPQUFPLE9BQU8sZUFBZTtBQUFTLG9CQUFjO0FBQ3hELFFBQUksT0FBTyxPQUFPLGVBQWU7QUFBUSxjQUFRLEtBQUssT0FBTyxPQUFPLFFBQVE7RUFDOUU7QUFDQSxNQUFJLGVBQWUsS0FBSyxTQUFTLFFBQVEsR0FBRyxFQUFFLEdBQUcsT0FBTyxlQUFlLFNBQVM7QUFDOUUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxTQUFTO01BQ2hCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsUUFBTSxnQkFBZ0IsQ0FBQyxHQUFHLE9BQU8sRUFBRSxLQUFJO0FBQ3ZDLE1BQUksUUFBUSxLQUFLLENBQUMsUUFBUSxVQUFVLFdBQVcsY0FBYyxLQUFLLENBQUMsR0FBRztBQUNwRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFNBQVM7TUFDaEIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBNENILFNBQVMsMkJBQ1AsZ0JBQ0EsU0FDQSxVQUNBLGVBQ0EsU0FDQSxNQUFtQjtBQUVuQixNQUNFLG1CQUFtQixXQUNsQixlQUFlLElBQUksWUFBWSxXQUM5QixlQUFlLElBQUksYUFBYSxZQUNoQyxlQUFlLElBQUksa0JBQWtCLGdCQUN2QztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTjtNQUNBLFNBQVM7S0FDVjtFQUNIO0FBQ0Y7QUFJQSxTQUFTLHdCQUNQLFVBQ0EsTUFDQSxZQUNBLFNBQThCO0FBRTlCLFFBQU0sV0FBVyxLQUFLLENBQUM7QUFDdkIsTUFBSSxhQUFhLFVBQWEsS0FBSyxLQUFLLENBQUMsUUFBUSxJQUFJLFlBQVksU0FBUyxPQUFPLEdBQUc7QUFDbEYsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsUUFBUTtLQUNoQjtFQUNIO0FBQ0EsTUFBSSxlQUFlO0FBQU07QUFFekIsUUFBTSxXQUFXLEtBQUssR0FBRyxFQUFFO0FBQzNCLE1BQUksYUFBYSxRQUFXO0FBQzFCLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7QUFDRDtFQUNGO0FBRUEsTUFBSTtBQUNKLE1BQUk7QUFDRixvQkFBZ0Isd0JBQXdCLFVBQVU7RUFDcEQsUUFBUTtBQUNOLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7QUFDRDtFQUNGO0FBQ0EsTUFDRSxjQUFjLGFBQWEsWUFDM0IsY0FBYyxZQUFZLFNBQVMsV0FDbkMsY0FBYyxjQUFjLFNBQVMsYUFDckMsY0FBYyxPQUFPLFNBQVMsSUFDOUI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxZQUFZO0tBQ3BCO0VBQ0g7QUFDRjtBQUVBLFNBQVMsb0NBQ1AsT0FDQSxRQUdBLGdCQUNBLFNBQ0EsTUFBbUI7QUFFbkIsUUFBTSxTQUFTLE1BQU07QUFDckIsUUFBTSxlQUFlLFFBQVEsU0FBUyxPQUFPLEtBQUssT0FBTztBQUN6RCxRQUFNLGNBQ0osUUFBUSxTQUNKLENBQUMsT0FBTyxxQkFBcUIsWUFBWSxPQUFPLGtCQUFrQixVQUFVLElBQzVFLENBQUMsT0FBTyxVQUFVO0FBQ3hCLE1BQ0UsT0FBTyxZQUFZLE9BQU8sT0FBTyxXQUNqQyxPQUFPLFlBQVksT0FBTyxPQUFPLFdBQ2pDLE9BQU8sV0FBVyxPQUFPLE9BQU8sVUFDaEMsaUJBQWlCLE9BQU8sT0FBTyxnQkFDL0IsT0FBTyxrQkFBa0IsT0FBTyxPQUFPLGlCQUN2QyxZQUFZLEtBQUssQ0FBQyxlQUFlLGVBQWUsT0FBTyxPQUFPLFVBQVUsS0FDeEUsbUJBQW1CLE9BQU8sZ0JBQzFCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOO01BQ0EsU0FBUztLQUNWO0VBQ0g7QUFDRjtBQUVBLFNBQVMsa0JBQ1AsUUFBd0I7QUFFeEIsU0FBTyxXQUFXO0FBQ3BCO0FBRUEsU0FBUyxzQkFBc0IsUUFBd0I7QUFDckQsU0FDRSxDQUFDLGtCQUFrQixNQUFNLE1BQ3hCLEVBQUUsa0JBQWtCLFdBQVcsT0FBTyxpQkFBaUI7QUFFNUQ7QUFFQSxTQUFTLGtCQUFrQixRQUF3QjtBQUNqRCxTQUFPLGFBQWEsU0FBUyxPQUFPLFVBQVUsT0FBTztBQUN2RDtBQUVBLFNBQVMsYUFBYSxRQUF3QjtBQUM1QyxTQUFPLGtCQUFrQixNQUFNLElBQUksT0FBTyxXQUFXLE9BQU87QUFDOUQ7QUFFQSxTQUFTLHFCQUNQLFFBQXdCO0FBRXhCLE1BQUksa0JBQWtCLE1BQU07QUFBRyxXQUFPLE9BQU87QUFDN0MsTUFBSSxjQUFjO0FBQVEsV0FBTztBQUNqQyxNQUFJLFlBQVk7QUFBUSxXQUFPO0FBQy9CLE1BQUksYUFBYTtBQUFRLFdBQU87QUFDaEMsU0FBTztBQUNUO0FBRUEsU0FBUyxtQkFBbUIsUUFBd0I7QUFDbEQsTUFBSSxrQkFBa0IsTUFBTTtBQUFHLFdBQU8sT0FBTztBQUM3QyxTQUFPLGNBQWMsU0FBUyxPQUFPLFdBQVcsT0FBTztBQUN6RDtBQUVBLFNBQVMsb0JBQ1AsVUFBOEM7QUFFOUMsU0FBTyxTQUFTLGVBQWUsVUFBVSxTQUFTLE9BQU8sS0FBSyxTQUFTLE9BQU87QUFDaEY7OztBQ2wvQk8sSUFBTSw0QkFBNEIsaUJBQ3RDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixRQUFRLGlCQUFFLEtBQUssQ0FBQyxVQUFVLFFBQVEsQ0FBQztFQUNuQyxRQUFRO0VBQ1IsVUFBVSxpQkFBRSxLQUFLLENBQUMsZ0JBQWdCLGNBQWMsZ0JBQWdCLFlBQVksQ0FBQztFQUM3RSxnQkFBZ0IsaUJBQUUsS0FBSyxDQUFDLFVBQVUsU0FBUyxDQUFDO0VBQzVDLFlBQVk7RUFDWixlQUFlO0VBQ2YsWUFBWTtDQUNiLEVBQ0EsT0FBTTtBQVNGLElBQU0sd0JBQXdCLGlCQUFFLEtBQUs7RUFDMUM7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBR00sSUFBTSx5QkFBeUIsaUJBQUUsS0FBSztFQUMzQztFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBR00sSUFBTSx3QkFBd0IsaUJBQUUsS0FBSztFQUMxQztFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRUQsSUFBTSx3QkFBd0IsRUFBRSxLQUFLLEdBQUcsS0FBSyxJQUFHO0FBQ2hELElBQU0sNkJBQTZCLEVBQUUsS0FBSyxHQUFHLEtBQUssSUFBRztBQVM5QyxJQUFNLDZCQUE2QixpQkFDdkMsT0FBTSxFQUNOLElBQUksc0JBQXNCLEdBQUcsRUFDN0IsSUFBSSxzQkFBc0IsR0FBRyxFQUM3QixNQUFNLG1DQUFtQztFQUN4QyxTQUFTO0NBQ1Y7QUFHSSxJQUFNLDBCQUEwQixpQkFDcEMsT0FBTSxFQUNOLElBQUksMkJBQTJCLEdBQUcsRUFDbEMsSUFBSSwyQkFBMkIsR0FBRyxFQUNsQyxNQUFNLG1DQUFtQztFQUN4QyxTQUFTO0NBQ1Y7QUFPSSxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFNBQVM7RUFDVCxZQUFZO0VBQ1osUUFBUTtFQUNSLFNBQVM7RUFDVCxZQUFZO0VBQ1osWUFBWSxpQkFBaUIsU0FBUTtFQUNyQyxPQUFPLHNCQUFzQixTQUFRO0VBQ3JDLFVBQVUsZUFBZSxTQUFRO0VBQ2pDLGdCQUFnQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO0NBQ3hELEVBQ0EsT0FBTTs7O0FDeEVGLElBQU0sNkJBQTZCO0FBQ25DLElBQU0sNkJBQTZCLEtBQUssT0FBTyxPQUFPO0FBRTdELElBQU0sNkJBQTZCLGdCQUNoQyxPQUFPLEVBQUUsRUFDVCxPQUFPLENBQUMsVUFBVSxPQUFPLEtBQUssT0FBTyxXQUFXLEVBQUUsZUFBZSxJQUFJO0VBQ3BFLE9BQU87Q0FDUjtBQUVJLElBQU0saUNBQ1gsMkJBQTJCLE1BQUs7QUFDM0IsSUFBTSxnQ0FDWCwyQkFBMkIsTUFBSztBQUVsQyxJQUFNLDZCQUE2QixpQkFDaEMsT0FBTztFQUNOLFdBQVcsaUJBQUUsUUFBUSx5QkFBeUI7RUFDOUMsTUFBTTtDQUNQLEVBQ0EsT0FBTTtBQUVGLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLFFBQVE7RUFDeEIsUUFBUSxpQkFBRSxRQUFRLHlCQUF5QjtFQUMzQyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixTQUFTO0VBQ1QsZUFBZTtFQUNmLFdBQVc7RUFDWCxnQkFBZ0I7Q0FDakIsRUFDQSxPQUFNO0FBRUYsSUFBTSw2QkFBNkIsaUJBQUUsbUJBQW1CLFFBQVE7RUFDckUsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxPQUFPLEdBQUcsUUFBUSxrQkFBaUIsQ0FBRSxFQUFFLE9BQU07RUFDeEUsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxPQUFPLEdBQUcsUUFBUSwyQkFBMEIsQ0FBRSxFQUFFLE9BQU07RUFDakYsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxNQUFNLEdBQUcsUUFBUSwwQkFBeUIsQ0FBRSxFQUFFLE9BQU07RUFDL0UsaUJBQ0csT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxZQUFZLEdBQUcsUUFBUSxnQ0FBK0IsQ0FBRSxFQUNqRixPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxtQkFBbUI7SUFDbkMsUUFBUTtHQUNULEVBQ0EsT0FBTTtFQUNULGlCQUNHLE9BQU87SUFDTixNQUFNLGlCQUFFLFFBQVEsa0JBQWtCO0lBQ2xDLFFBQVE7R0FDVCxFQUNBLE9BQU07RUFDVCxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLE9BQU8sR0FBRyxRQUFRLDJCQUEwQixDQUFFLEVBQUUsT0FBTTtFQUNqRixpQkFDRyxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFNBQVMsR0FBRyxRQUFRLDZCQUE0QixDQUFFLEVBQzNFLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sTUFBTSxpQkFBRSxRQUFRLHVCQUF1QjtJQUN2QyxZQUFZLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFFBQVEsWUFBWSxDQUFDO0lBQ2xELFFBQVEsaUJBQUUsTUFBTTtNQUNkO01BQ0E7TUFDQTtLQUNEO0dBQ0YsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixVQUFNLGFBQ0osWUFBWSxNQUFNLFNBQ2QsZUFDQSxhQUFhLE1BQU0sU0FDakIsU0FDQTtBQUNSLFFBQUksTUFBTSxlQUFlLFlBQVk7QUFDbkMsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxZQUFZO1FBQ25CLFNBQVM7T0FDVjtJQUNIO0FBQ0EsUUFBSSxNQUFNLE9BQU8saUJBQWlCLFFBQVc7QUFDM0MsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxVQUFVLGNBQWM7UUFDL0IsU0FBUztPQUNWO0lBQ0g7RUFDRixDQUFDO0VBQ0gsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxXQUFXLEdBQUcsUUFBUSxzQkFBcUIsQ0FBRSxFQUFFLE9BQU07Q0FDakY7QUFFTSxJQUFNLDhCQUE4QixpQkFDeEMsT0FBTztFQUNOLE1BQU0saUJBQUUsUUFBUSxRQUFRO0VBQ3hCLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLGFBQWEsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxHQUFVO0VBQ3ZELGtCQUFrQjtFQUNsQixtQkFBbUI7Q0FDcEIsRUFDQSxPQUFNO0FBa0JULElBQU0sMEJBQTBCLGlCQUM3QixPQUFNLEVBQ04sSUFBRyxFQUNILFNBQVEsRUFDUixJQUFJLDBCQUEwQjtBQUNqQyxJQUFNLHVCQUF1QixpQkFDMUIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSwwQkFBMEI7QUFFMUIsSUFBTSwyQkFBMkIsaUJBQ3JDLE9BQU87RUFDTixRQUFRO0VBQ1Isa0JBQWtCO0VBQ2xCLGFBQWE7RUFDYixrQkFBa0I7RUFDbEIsd0JBQXdCO0NBQ3pCLEVBQ0EsT0FBTTtBQUVULElBQU0sNEJBQTRCLGlCQUMvQixPQUFPO0VBQ04sSUFBSTtFQUNKLE1BQU0saUJBQUUsS0FBSyxDQUFDLGdCQUFnQixjQUFjLGNBQWMsQ0FBQztFQUMzRCxZQUFZO0NBQ2IsRUFDQSxPQUFNO0FBRVQsSUFBTSw4QkFBOEIsaUJBQ2pDLE9BQU87RUFDTixRQUFRLGlCQUFFLFFBQVEsQ0FBQztFQUNuQixRQUFRO0VBQ1IsT0FBTztFQUNQLGFBQWE7RUFDYixtQkFBbUI7RUFDbkIsa0JBQWtCO0VBQ2xCLHVCQUF1QixpQkFDcEIsT0FBTztJQUNOLFFBQVE7SUFDUixPQUFPO0lBQ1AsYUFBYTtHQUNkLEVBQ0EsT0FBTTtFQUNULFlBQVk7RUFDWixXQUFXO0VBQ1gsUUFBUTtDQUNULEVBQ0EsT0FBTTtBQUVGLElBQU0sMENBQTBDLGlCQUNwRCxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsT0FBTyxpQkFBRSxRQUFRLGtCQUFrQjtFQUNuQyxTQUFTO0VBQ1QsZUFBZTtFQUNmLGtCQUFrQjtFQUNsQixrQkFBa0I7RUFDbEIsd0JBQXdCO0VBQ3hCLGFBQWE7RUFDYixjQUFjO0VBQ2QsVUFBVTtDQUNYLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsUUFBTSxlQUFlLFFBQVEsU0FBUztBQUN0QyxRQUFNLG1CQUNKLGFBQWEsU0FBUyxhQUFhLFFBQVEsYUFBYTtBQUMxRCxRQUFNLGdCQUNKLFFBQVEsU0FBUyxTQUNqQixRQUFRLFNBQVMsU0FDakIsUUFBUSxTQUFTLFFBQ2pCLFFBQVEsU0FBUyxjQUNqQixRQUFRLFNBQVMsb0JBQ2pCLFFBQVEsU0FBUyxtQkFDakIsbUJBQ0EsUUFBUSxTQUFTLGFBQ2pCLFFBQVEsU0FBUyxZQUNqQixRQUFRLFNBQVM7QUFFbkIsTUFBSSxrQkFBa0IsUUFBUSxhQUFhO0FBQ3pDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsYUFBYTtNQUNwQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksUUFBUSxTQUFTLHNCQUFzQixRQUFRLFNBQVMsYUFBYTtBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFlBQVksbUJBQW1CO01BQ3RDLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxRQUFRLFNBQVMsbUJBQW1CLFFBQVEsU0FBUyxhQUFhO0FBQ3BFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsWUFBWSxrQkFBa0I7TUFDckMsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLFFBQVEsU0FBUyxhQUFhLGtCQUFrQjtBQUNsRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFlBQVksWUFBWTtNQUMvQixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFFSCxJQUFNLDhCQUE4QixpQkFBRSxPQUFPO0VBQzNDLGlCQUFpQixpQkFBRSxRQUFRLENBQUM7RUFDNUIsa0JBQWtCO0VBQ2xCLGNBQWMsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSwwQkFBMEI7RUFDeEUsZ0JBQWdCO0VBQ2hCLGFBQWEsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXLEVBQUcsSUFBSSwwQkFBMEI7RUFDMUUsZUFBZTtFQUNmLFdBQVc7RUFDWCxXQUFXO0NBQ1o7QUFFRCxJQUFNLDZCQUE2Qiw0QkFDaEMsT0FBTztFQUNOLE9BQU8saUJBQUUsUUFBUSxTQUFTO0VBQzFCLFNBQVMsY0FBYyxTQUFRO0NBQ2hDLEVBQ0EsT0FBTTtBQUVULElBQU0sNEJBQTRCLDRCQUMvQixPQUFPO0VBQ04sT0FBTyxpQkFBRSxRQUFRLFFBQVE7RUFDekIsU0FBUztFQUNULFNBQVM7RUFDVCxVQUFVO0NBQ1gsRUFDQSxPQUFNO0FBRVQsSUFBTSwrQkFBK0IsNEJBQ2xDLE9BQU87RUFDTixPQUFPLGlCQUFFLFFBQVEsV0FBVztFQUM1QixTQUFTO0VBQ1QsU0FBUztFQUNULFVBQVU7RUFDVixhQUFhO0NBQ2QsRUFDQSxPQUFNO0FBRVQsSUFBTSwrQkFBK0IsaUJBQ2xDLE9BQU87RUFDTixPQUFPLGlCQUFFLFFBQVEsV0FBVztFQUM1QixpQkFBaUIsaUJBQUUsUUFBUSxDQUFDO0VBQzVCLGtCQUFrQjtFQUNsQixTQUFTO0VBQ1QsYUFBYTtDQUNkLEVBQ0EsT0FBTTtBQUVULElBQU0sNkJBQTZCLGlCQUNoQyxPQUFPO0VBQ04sT0FBTyxpQkFBRSxRQUFRLFNBQVM7RUFDMUIsaUJBQWlCLGlCQUFFLFFBQVEsQ0FBQztFQUM1QixrQkFBa0I7RUFDbEIsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQUVGLElBQU0sNEJBQTRCLGlCQUN0QyxtQkFBbUIsU0FBUztFQUMzQjtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0QsRUFDQSxZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLE1BQUksaUJBQWlCLFVBQVUsT0FBTyxjQUFjLE9BQU8sY0FBYztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLGFBQWE7TUFDcEIsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLG1CQUFtQixVQUFVLE9BQU8sZ0JBQWdCLE9BQU8sZ0JBQWdCO0FBQzdFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsZUFBZTtNQUN0QixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksbUJBQW1CLFFBQVE7QUFDN0IsVUFBTSxtQkFBbUIsT0FBTyxnQkFBZ0I7QUFDaEQsVUFBTSxpQkFBaUIsT0FBTyxjQUFjO0FBQzVDLFFBQUkscUJBQXFCLGdCQUFnQjtBQUN2QyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGVBQWU7UUFDdEIsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUNFLE9BQU8sVUFBVSxhQUNoQixPQUFPLFlBQVksV0FBZSxrQkFDbkM7QUFDQSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLFNBQVM7UUFDaEIsU0FBUztPQUNWO0lBQ0g7RUFDRjtBQUNBLE1BQUksT0FBTyxVQUFVLGFBQWEsT0FBTyxVQUFVO0FBQVc7QUFFOUQsTUFBSSxPQUFPLHFCQUFxQixPQUFPLFFBQVEsa0JBQWtCO0FBQy9ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsa0JBQWtCO01BQ3pCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxPQUFPLFVBQVU7QUFBYTtBQUVsQyxNQUFJLE9BQU8sWUFBWSxPQUFPLFFBQVEsT0FBTyxTQUFTO0FBQ3BELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsU0FBUztNQUNoQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQ0UsT0FBTyxrQkFBa0IsT0FBTyxRQUFRLGVBQ3hDLE9BQU8sUUFBUSxjQUFjLE9BQU8sZ0JBQ3BDO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxlQUFlO01BQ3RCLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQzs7O0FDclhJLElBQU0saUJBQWlCLE9BQU8sT0FBTztFQUMxQyxJQUFJO0VBQ0oscUJBQXFCO0VBQ3JCLFlBQVk7RUFDWixzQkFBc0I7RUFDdEIsbUJBQW1CO0VBQ25CLHFCQUFxQjtFQUNyQixjQUFjO0VBQ2Qsc0JBQXNCO0VBQ3RCLGtCQUFrQjtFQUNsQiwwQkFBMEI7RUFDMUIsc0JBQXNCO0NBQ2Q7QUFJSCxJQUFNLGtCQUFrQjtFQUM3QjtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBOztBQUdLLElBQU0scUJBQXFCLGlCQUFFLEtBQUssZUFBZTtBQUl4RCxJQUFNLHVCQUErRCxPQUFPLE9BQU87RUFDakYsSUFBSSxlQUFlO0VBQ25CLHNCQUFzQixlQUFlO0VBQ3JDLGFBQWEsZUFBZTtFQUM1Qix1QkFBdUIsZUFBZTtFQUN0QyxvQkFBb0IsZUFBZTtFQUNuQyxzQkFBc0IsZUFBZTtFQUNyQyxlQUFlLGVBQWU7RUFDOUIsdUJBQXVCLGVBQWU7RUFDdEMsbUJBQW1CLGVBQWU7RUFDbEMsNEJBQTRCLGVBQWU7RUFDM0MsdUJBQXVCLGVBQWU7Q0FDdkM7QUFHSyxTQUFVLG9CQUFvQixNQUFrQjtBQUNwRCxTQUFPLHFCQUFxQixJQUFJO0FBQ2xDO0FBRU8sSUFBTSx5QkFBeUIsaUJBQ25DLE9BQU87RUFDTixPQUFPLGlCQUNKLE9BQU87SUFDTixNQUFNO0lBQ04sVUFBVSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztJQUN6QyxTQUFTLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLElBQUk7R0FDcEMsRUFDQSxPQUFNO0NBQ1YsRUFDQSxPQUFNOzs7QUNqREYsSUFBTSw0QkFBNEI7QUFDbEMsSUFBTSxpQ0FBaUM7QUFDdkMsSUFBTSxxQ0FBcUM7QUFDM0MsSUFBTSw4QkFBOEI7QUFDcEMsSUFBTSxzQkFBc0I7QUFFNUIsSUFBTSx5QkFBeUIsaUJBQ25DLE9BQU0sRUFDTixJQUFHLEVBQ0gsWUFBVyxFQUNYLElBQUksT0FBTyxnQkFBZ0IsRUFDM0IsTUFBSztBQUVSLElBQU0sK0JBQStCLGlCQUFFLE1BQU07RUFDM0M7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFlBQVk7RUFDWixZQUFZLGlCQUFFLEtBQUs7SUFDakI7SUFDQTtJQUNBO0dBQ0Q7RUFDRCxVQUFVO0VBQ1YsU0FBUyxpQkFBRSxLQUFLLENBQUMsV0FBVyxpQkFBaUIsWUFBWSxDQUFDO0VBQzFELGVBQWU7RUFDZixZQUFZO0VBQ1osVUFBVTtFQUNWLFNBQVMsY0FBYyxTQUFRO0VBQy9CLGdCQUFnQjtDQUNqQixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsZ0JBQWdCLFlBQVc7QUFDdkMsUUFBTSxrQkFDSCxlQUFlLGVBQWUsdUJBQzVCLGVBQWUsWUFBWSxhQUMxQixlQUFlLGFBQWEsZUFBZSxjQUMzQyxlQUFlLFlBQVksV0FDOUIsZUFBZSxlQUFlLDRCQUM1QixlQUFlLFlBQVksbUJBQzFCLENBQUMsZ0JBQWdCLFVBQVUsZUFBZSxRQUFRLEVBQUUsV0FDcEQsZUFBZSxZQUFZLFdBQzlCLGVBQWUsZUFBZSx5QkFDNUIsZUFBZSxZQUFZLGdCQUMxQixDQUFDLGNBQWMsVUFBVSxlQUFlLFFBQVEsRUFBRSxXQUNsRCxlQUFlLFlBQVksVUFDM0IsZUFBZSxhQUFhLGVBQWU7QUFFakQsTUFBSSxpQkFBaUI7QUFDbkIsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQ0U7S0FDSDtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sU0FBUztFQUNULFdBQVcsaUJBQUUsUUFBUSx5QkFBeUI7RUFDOUMsT0FBTztFQUNQLFlBQVk7RUFDWixtQkFBbUI7RUFDbkIsS0FBSztFQUNMLFlBQVk7Q0FDYixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLE1BQUksU0FBUyxNQUFNLFdBQVcsNEJBQTRCO0FBQ3hELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLE9BQU87S0FDZjtFQUNIO0FBQ0EsTUFBSSxTQUFTLGtCQUFrQixXQUFXLHlDQUF5QztBQUNqRixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxtQkFBbUI7S0FDM0I7RUFDSDtBQUNBLE1BQUksU0FBUyxlQUFlLFNBQVMsSUFBSSxZQUFZO0FBQ25ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7RUFDSDtBQUNGLENBQUM7QUFFSCxJQUFNLDZCQUE2QixpQkFDaEMsT0FBTztFQUNOLElBQUk7RUFDSixPQUFPLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO0VBQ3ZDLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLE9BQU8saUJBQUUsT0FBTSxFQUFHLEtBQUksRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUc7RUFDdkMsUUFBUSxpQkFBRSxNQUFNLDBCQUEwQixFQUFFLElBQUksbUJBQW1CO0NBQ3BFLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsUUFBTSxXQUFXLG9CQUFJLElBQUc7QUFDeEIsYUFBVyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsT0FBTyxRQUFPLEdBQUk7QUFDckQsUUFBSSxTQUFTLElBQUksTUFBTSxFQUFFLEdBQUc7QUFDMUIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxVQUFVLE9BQU8sSUFBSTtRQUM1QixTQUFTO09BQ1Y7SUFDSDtBQUNBLGFBQVMsSUFBSSxNQUFNLEVBQUU7RUFDdkI7QUFDRixDQUFDO0FBRUgsSUFBTSxzQ0FBc0MsaUJBQ3pDLE9BQU87RUFDTixXQUFXLGlCQUFFLFFBQVEsYUFBYTtFQUNsQyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixNQUFNLGdCQUFnQixPQUFPLEVBQUU7RUFDL0IsU0FBUyxpQkFBRSxRQUFRLDhCQUE4QjtFQUNqRCxjQUFjLGlCQUFFLFFBQVEsRUFBRTtDQUMzQixFQUNBLE9BQU07QUFFVCxJQUFNLHNDQUFzQyxpQkFDekMsT0FBTztFQUNOLFdBQVcsaUJBQUUsUUFBUSxhQUFhO0VBQ2xDLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLE1BQU0sZ0JBQWdCLE9BQU8sRUFBRTtFQUMvQixTQUFTLGlCQUFFLFFBQVEsa0NBQWtDO0VBQ3JELGNBQWMsaUJBQUUsUUFBUSxFQUFFO0NBQzNCLEVBQ0EsT0FBTTtBQUVULElBQU0sNEJBQTRCLGlCQUFFLE9BQU87RUFDekMsYUFBYTtFQUNiLElBQUk7RUFDSixPQUFPLGlCQUFFLEtBQUssQ0FBQyxVQUFVLFNBQVMsQ0FBQztFQUNuQyxZQUFZO0VBQ1oscUJBQXFCO0VBQ3JCLFdBQVc7RUFDWCxXQUFXLGdCQUFnQixTQUFRO0NBQ3BDO0FBRU0sSUFBTSxnQ0FBZ0MsMEJBQzFDLE9BQU87RUFDTixNQUFNLGlCQUFFLFFBQVEsY0FBYztFQUM5QixPQUFPLGlCQUFFLFFBQVEsUUFBUTtFQUN6QixZQUFZO0NBQ2IsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixNQUFJLEtBQUssY0FBYyxRQUFXO0FBQ2hDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVztNQUNsQixTQUNFO0tBQ0g7RUFDSDtBQUNBLGtDQUFnQyxNQUFNLE9BQU87QUFDL0MsQ0FBQztBQUVJLElBQU0sNkJBQTZCLDBCQUN2QyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLGNBQWM7RUFDOUIsWUFBWTtDQUNiLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxNQUFNLFlBQVc7QUFDN0IsTUFBSSxLQUFLLFVBQVUsYUFBYSxLQUFLLGNBQWMsUUFBVztBQUM1RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFdBQVc7TUFDbEIsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLEtBQUssVUFBVSxZQUFZLEtBQUssY0FBYyxRQUFXO0FBQzNELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVztNQUNsQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLGtDQUFnQyxNQUFNLE9BQU87QUFDL0MsQ0FBQztBQUVJLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sUUFBUSxpQkFBRSxRQUFRLHlCQUF5QjtFQUMzQyxTQUFTLGlCQUFFLFFBQVEsa0NBQWtDO0VBQ3JELElBQUk7RUFDSixlQUFlO0VBQ2Ysc0JBQXNCO0VBQ3RCLG1CQUFtQjtFQUNuQixTQUFTO0VBQ1QsZUFBZSxpQkFBRSxNQUFNLDBCQUEwQixFQUFFLElBQUksMkJBQTJCO0VBQ2xGLFVBQVU7RUFDVixrQkFBa0I7RUFDbEIsdUJBQXVCO0VBQ3ZCLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFVBQVUsWUFBVztBQUNqQyxNQUFJLFNBQVMsUUFBUSxlQUFlLFNBQVMsbUJBQW1CO0FBQzlELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVyxZQUFZO01BQzlCLFNBQ0U7S0FDSDtFQUNIO0FBQ0EsTUFBSSxTQUFTLFFBQVEsb0JBQW9CLElBQUksZUFBZSxTQUFTLElBQUk7QUFDdkUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxXQUFXLHVCQUF1QixPQUFPLFlBQVk7TUFDNUQsU0FBUztLQUNWO0VBQ0g7QUFFQSxRQUFNLGFBQWEsb0JBQUksSUFBWSxDQUFDLFNBQVMsUUFBUSxFQUFFLENBQUM7QUFDeEQsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLFNBQVMsY0FBYyxRQUFPLEdBQUk7QUFDNUQsUUFBSSxXQUFXLElBQUksS0FBSyxFQUFFLEdBQUc7QUFDM0IsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxJQUFJO1FBQ25DLFNBQVM7T0FDVjtJQUNIO0FBQ0EsZUFBVyxJQUFJLEtBQUssRUFBRTtBQUN0QixRQUFJLEtBQUssZUFBZSxTQUFTLG1CQUFtQjtBQUNsRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGlCQUFpQixPQUFPLFlBQVk7UUFDM0MsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLEtBQUssb0JBQW9CLElBQUksZUFBZSxTQUFTLElBQUk7QUFDM0QsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyx1QkFBdUIsT0FBTyxZQUFZO1FBQ3pFLFNBQVM7T0FDVjtJQUNIO0VBQ0Y7QUFFQSxRQUFNLFVBQVUsU0FBUztBQUN6QixNQUNFLFFBQVEsSUFBSSxlQUFlLFNBQVMsTUFDcEMsUUFBUSxJQUFJLGtCQUFrQixTQUFTLGlCQUN2QyxRQUFRLElBQUksZUFBZSxTQUFTLHFCQUNwQyxRQUFRLElBQUksYUFBYSxTQUFTLFlBQ2xDLFFBQVEsSUFBSSxtQkFBbUIsU0FBUyx1QkFDeEM7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLG9CQUFvQixLQUFLO01BQ2hDLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sWUFBWTtFQUNaLElBQUk7RUFDSixlQUFlO0VBQ2Ysc0JBQXNCO0VBQ3RCLG1CQUFtQjtFQUNuQixrQkFBa0I7RUFDbEIsVUFBVTtFQUNWLGtCQUFrQjtFQUNsQixrQkFBa0I7RUFDbEIsdUJBQXVCO0VBQ3ZCLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixRQUFNLGNBQWMsTUFBTTtBQUMxQixNQUNFLFlBQVksSUFBSSxlQUFlLE1BQU0sY0FDckMsWUFBWSxJQUFJLFlBQVksTUFBTSxNQUNsQyxZQUFZLElBQUksa0JBQWtCLE1BQU0saUJBQ3hDLFlBQVksSUFBSSxlQUFlLE1BQU0scUJBQ3JDLFlBQVksSUFBSSxhQUFhLE1BQU0sa0JBQ25DO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxvQkFBb0IsS0FBSztNQUNoQyxTQUFTO0tBQ1Y7RUFDSDtBQUNBLFFBQU0sVUFBVSxNQUFNO0FBQ3RCLE1BQ0UsUUFBUSxJQUFJLFlBQVksTUFBTSxNQUM5QixDQUFDLGdDQUFnQyxRQUFRLEdBQUcsS0FDNUMsUUFBUSxJQUFJLGFBQWEsTUFBTSxNQUMvQixRQUFRLElBQUksa0JBQWtCLE1BQU0saUJBQ3BDLFFBQVEsSUFBSSxlQUFlLE1BQU0scUJBQ2pDLFFBQVEsSUFBSSxhQUFhLE1BQU0sWUFDL0IsUUFBUSxJQUFJLG1CQUFtQixNQUFNLHVCQUNyQztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsb0JBQW9CLEtBQUs7TUFDaEMsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUgsU0FBUyxnQ0FDUCxPQUF3RDtBQUV4RCxTQUNFLE1BQU0sZUFBZSx1QkFBdUIsTUFBTSxZQUFZO0FBRWxFO0FBRU8sSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixRQUFRLGlCQUFFLFFBQVEsOEJBQThCO0VBQ2hELFNBQVMsaUJBQUUsUUFBUSxrQ0FBa0M7RUFDckQsVUFBVTtFQUNWLFFBQVEsaUJBQUUsT0FBTyxlQUFlLDJCQUEyQjtDQUM1RCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsV0FBVyxZQUFXO0FBQ2xDLFFBQU0sVUFBVSxPQUFPLFFBQVEsVUFBVSxNQUFNO0FBQy9DLE1BQUksUUFBUSxTQUFTLHFCQUFxQjtBQUN4QyxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7RUFDSDtBQUNBLGFBQVcsQ0FBQyxTQUFTLEtBQUssS0FBSyxTQUFTO0FBQ3RDLFFBQUksWUFBWSxNQUFNLElBQUk7QUFDeEIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxVQUFVLE9BQU87UUFDeEIsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLE1BQU0sZUFBZSxVQUFVLFNBQVMsSUFBSTtBQUM5QyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLFVBQVUsU0FBUyxZQUFZO1FBQ3RDLFNBQVM7T0FDVjtJQUNIO0VBQ0Y7QUFDRixDQUFDO0FBRUgsU0FBUyxnQ0FDUCxNQUtBLFNBQThCO0FBRTlCLFFBQU0sV0FBVyxLQUFLO0FBQ3RCLE1BQUksU0FBUyxJQUFJLGFBQWEsS0FBSyxJQUFJO0FBQ3JDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsdUJBQXVCLE9BQU8sVUFBVTtNQUMvQyxTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksU0FBUyxlQUFlLEtBQUssWUFBWTtBQUMzQyxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLHVCQUF1QixZQUFZO01BQzFDLFNBQVM7S0FDVjtFQUNIO0FBQ0Y7OztBQ3JaTyxJQUFNLDJCQUEyQixpQkFDckMsV0FBVyxVQUFVLEVBQ3JCLE9BQU8sQ0FBQyxVQUFVLE1BQU0sZUFBZSxJQUFJO0VBQzFDLE9BQU87Q0FDUixFQUNBLE1BQUs7QUFFRCxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFNBQVM7RUFDVCxVQUFVO0VBQ1YsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQUdGLElBQU0sZ0NBQWdDLGlCQUMxQyxXQUFXLFVBQVUsRUFDckIsT0FBTyxDQUFDLFVBQVUsTUFBTSxlQUFlLElBQUk7RUFDMUMsT0FBTztDQUNSLEVBQ0EsTUFBSztBQUdELElBQU0saUNBQWlDLGlCQUMzQyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUztFQUNULFVBQVU7RUFDVixTQUFTLGlCQUFFLFFBQVEsYUFBYTtDQUNqQyxFQUNBLE9BQU07OztBQ3JCRixJQUFNLGlDQUFpQztBQUN2QyxJQUFNLHlCQUF5QjtBQUUvQixJQUFNLHNCQUFzQjtBQUM1QixJQUFNLG9CQUFvQjtBQUMxQixJQUFNLDJCQUEyQjtBQUNqQyxJQUFNLHVCQUF1QjtBQUM3QixJQUFNLDJCQUEyQjtBQUNqQyxJQUFNLDhCQUE4QjtBQUNwQyxJQUFNLHFCQUFxQjtBQUMzQixJQUFNLDRCQUE0QjtBQUNsQyxJQUFNLDBCQUEwQjtBQUNoQyxJQUFNLDJCQUEyQjtBQUNqQyxJQUFNLHlCQUF5QjtBQUMvQixJQUFNLHlCQUF5QixLQUFLLEtBQUssS0FBSyxLQUFLO0FBQ25ELElBQU0sZ0NBQWdDLE1BQU07QUFFbkQsSUFBTSxpQ0FBaUMsb0JBQUksSUFBSTtFQUM3QztFQUNBO0VBQ0E7Q0FDRDtBQUdNLElBQU0sNEJBQTRCLGlCQUN0QyxPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSw4QkFBOEIsRUFHbEMsT0FBTyxDQUFDLFVBQVUsQ0FBQyx5QkFBeUIsS0FBSyxLQUFLLEdBQUc7RUFDeEQsU0FBUztDQUNWLEVBQ0EsT0FBTyxDQUFDLFVBQVUsTUFBTSxLQUFJLE1BQU8sT0FBTztFQUN6QyxTQUFTO0NBQ1YsRUFDQSxPQUFPLENBQUMsVUFBVSxDQUFDLCtCQUErQixJQUFJLEtBQUssR0FBRztFQUM3RCxTQUFTO0NBQ1Y7QUFHSSxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksRUFBRSxFQUNOLE1BQU0saUNBQWlDLDBCQUEwQjtBQUU3RCxJQUFNLDJDQUNYO0FBR0ssSUFBTSxnQ0FBZ0MsaUJBQzFDLE9BQU0sRUFDTixNQUNDLElBQUksT0FBTyx3Q0FBd0MsR0FDbkQsbUNBQW1DO0FBUWhDLElBQU0sb0JBQW9CLGlCQUM5QixPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFDQyxrQ0FDQSw2Q0FBNkM7QUFJMUMsSUFBTSxxQkFBcUIsaUJBQy9CLE9BQU0sRUFDTixJQUFJLENBQUMsRUFDTCxJQUFJLEVBQUUsRUFDTixNQUFNLG1DQUFtQyx1QkFBdUI7QUFFbkUsSUFBTSxnQkFBZ0IsSUFBSSxPQUFPLHdCQUF3QjtBQUdsRCxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksR0FBRyxFQUNQLE1BQU0sZUFBZSw4QkFBOEI7QUFHL0MsSUFBTSx3QkFBd0IsaUJBQ2xDLE9BQU0sRUFDTixNQUFNLG1CQUFtQix3Q0FBd0M7QUFFN0QsSUFBTSwwQkFBMEI7QUFFdkMsSUFBTSxrQkFBa0IsSUFBSSxPQUFPLHVCQUF1QjtBQUduRCxJQUFNLGlCQUFpQixpQkFBRSxPQUFNLEVBQUcsTUFBTSxpQkFBaUIsa0JBQWtCO0FBTzVFLFNBQVUsa0JBQWtCLE9BQWE7QUFDN0MsTUFBSSxDQUFDLGdCQUFnQixLQUFLLEtBQUs7QUFBRyxXQUFPO0FBQ3pDLFFBQU0sUUFBUSxnQkFBZ0IsS0FBSyxLQUFLO0FBQ3hDLFFBQU0sYUFBYSxRQUFRLENBQUM7QUFDNUIsUUFBTSxPQUFPLFFBQVEsQ0FBQztBQUN0QixNQUFJLGVBQWUsVUFBYSxTQUFTO0FBQVcsV0FBTztBQUMzRCxRQUFNLFNBQVMsT0FBTyxVQUFVO0FBQ2hDLE1BQUksQ0FBQyxPQUFPLGNBQWMsTUFBTSxLQUFLLFVBQVU7QUFBRyxXQUFPO0FBQ3pELFFBQU0sYUFBYSxpQkFBaUIsSUFBSTtBQUN4QyxNQUFJLGVBQWU7QUFBVyxXQUFPO0FBQ3JDLFFBQU0sVUFBVSxTQUFTO0FBQ3pCLFNBQU8sV0FBVyx5QkFBeUIsVUFBVTtBQUN2RDtBQUVBLElBQU0sbUJBQXFELE9BQU8sT0FBTztFQUN2RSxHQUFHO0VBQ0gsR0FBRztFQUNILEdBQUc7RUFDSCxHQUFHO0NBQ0o7QUFNTSxJQUFNLGdDQUFnQyxpQkFBRSxNQUFNO0VBQ25ELGlCQUFFLFFBQU87RUFDVCxpQkFBRSxNQUFNLGtCQUFrQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksdUJBQXVCO0NBQy9EO0FBRU0sSUFBTSx3QkFBd0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQVM7QUFHbkUsSUFBTSx5QkFBeUIsaUJBQ25DLE9BQU0sRUFDTixJQUFJLENBQUMsRUFDTCxJQUFJLElBQUssRUFHVCxPQUFPLENBQUMsVUFBVSxDQUFDLHlCQUF5QixLQUFLLEtBQUssR0FBRztFQUN4RCxTQUFTO0NBQ1Y7QUFPSSxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTztFQUNOLFFBQVEsMEJBQTBCLFNBQVE7RUFDMUMsVUFBVSxpQkFBRSxNQUFNLGlCQUFpQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksc0JBQXNCLEVBQUUsU0FBUTtFQUNoRixRQUFRLGlCQUFFLE9BQU8sbUJBQW1CLHFCQUFxQixFQUFFLFNBQVE7RUFDbkUsS0FBSyw4QkFBOEIsU0FBUTtFQUMzQyxRQUFRLGlCQUFFLFFBQU8sRUFBRyxTQUFRO0VBQzVCLEtBQUssZUFBZSxTQUFRO0VBQzVCLFNBQVMsc0JBQXNCLFNBQVE7RUFDdkMscUJBQXFCLDhCQUE4QixTQUFROztFQUUzRCxrQkFBa0IsdUJBQXVCLFNBQVE7RUFDakQsTUFBTSxpQkFBRSxRQUFPLEVBQUcsU0FBUTtDQUMzQixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsT0FBTyxZQUFXO0FBQzlCLFFBQU0sT0FBTyxNQUFNLFNBQVM7QUFDNUIsTUFBSSxDQUFDLE1BQU07QUFDVCxRQUFJLE1BQU0sV0FBVyxRQUFXO0FBQzlCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFFBQVE7T0FDaEI7SUFDSDtBQUNBLFFBQUksTUFBTSxhQUFhLFFBQVc7QUFDaEMsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsVUFBVTtPQUNsQjtJQUNIO0VBQ0YsT0FBTztBQUNMLGVBQVcsU0FBUztNQUNsQjtNQUNBO01BQ0E7TUFDQTtNQUNBO01BQ0E7T0FDVTtBQUNWLFVBQUksTUFBTSxLQUFLLE1BQU0sUUFBVztBQUM5QixnQkFBUSxTQUFTO1VBQ2YsTUFBTTtVQUNOLFNBQVM7VUFDVCxNQUFNLENBQUMsS0FBSztTQUNiO01BQ0g7SUFDRjtFQUNGO0FBQ0EsTUFBSSxNQUFNLFdBQVcsVUFBYSxNQUFNLGFBQWE7QUFBVztBQUNoRSxRQUFNLFdBQVcsSUFBSSxJQUFJLE1BQU0sUUFBUTtBQUN2QyxhQUFXLFVBQVUsT0FBTyxLQUFLLE1BQU0sTUFBTSxHQUFHO0FBQzlDLFFBQUksQ0FBQyxTQUFTLElBQUksTUFBTSxHQUFHO0FBQ3pCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFFBQVE7T0FDaEI7QUFDRDtJQUNGO0VBQ0Y7QUFDRixDQUFDO0FBU0csU0FBVSxnQ0FBZ0MsT0FBYztBQUM1RCxNQUFJLENBQUMsY0FBYyxLQUFLO0FBQUcsV0FBTztBQUNsQyxNQUFJLFVBQVU7QUFDZCxRQUFNLFNBQWtDLENBQUE7QUFDeEMsYUFBVyxDQUFDLEtBQUssVUFBVSxLQUFLLE9BQU8sUUFBUSxLQUFLLEdBQUc7QUFDckQsUUFBSSxRQUFRLHdCQUF3QjtBQUNsQyxhQUFPLHFCQUFxQixNQUFNO0FBQ2xDLGdCQUFVO0FBQ1Y7SUFDRjtBQUNBLFFBQUksUUFBUSxZQUFZO0FBQ3RCLGFBQU8sU0FBUyxNQUFNO0FBQ3RCLGdCQUFVO0FBQ1Y7SUFDRjtBQUNBLFdBQU8sR0FBRyxJQUFJO0VBQ2hCO0FBQ0EsU0FBTyxVQUFVLFNBQVM7QUFDNUI7QUFFQSxTQUFTLGNBQWMsT0FBYztBQUNuQyxTQUFPLE9BQU8sVUFBVSxZQUFZLFVBQVUsUUFBUSxDQUFDLE1BQU0sUUFBUSxLQUFLO0FBQzVFO0FBTU0sU0FBVSw4QkFBOEIsT0FBYztBQUMxRCxNQUFJLENBQUMsY0FBYyxLQUFLO0FBQUcsV0FBTztBQUNsQyxNQUFJLFdBQW9DO0FBQ3hDLE1BQUksVUFBVTtBQUVkLFFBQU0sV0FBVyxjQUFjLFNBQVMsVUFBVSxDQUFDO0FBQ25ELE1BQUksU0FBUyxTQUFTO0FBQ3BCLGVBQVcsRUFBRSxHQUFHLFVBQVUsVUFBVSxTQUFTLElBQUc7QUFDaEQsY0FBVTtFQUNaO0FBRUEsTUFBSSxjQUFjLFNBQVMsUUFBUSxDQUFDLEdBQUc7QUFDckMsVUFBTSxTQUFrQyxDQUFBO0FBQ3hDLFFBQUksZ0JBQWdCO0FBQ3BCLGVBQVcsQ0FBQyxTQUFTLEtBQUssS0FBSyxPQUFPLFFBQVEsU0FBUyxRQUFRLENBQUMsR0FBRztBQUNqRSxVQUFJLENBQUMsY0FBYyxLQUFLLEdBQUc7QUFDekIsZUFBTyxPQUFPLElBQUk7QUFDbEI7TUFDRjtBQUNBLFlBQU0sY0FBYyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQ3RELFVBQUksWUFBWSxTQUFTO0FBQ3ZCLGVBQU8sT0FBTyxJQUFJLEVBQUUsR0FBRyxPQUFPLENBQUMsYUFBYSxHQUFHLFlBQVksSUFBRztBQUM5RCx3QkFBZ0I7QUFDaEI7TUFDRjtBQUNBLGFBQU8sT0FBTyxJQUFJO0lBQ3BCO0FBQ0EsUUFBSSxlQUFlO0FBQ2pCLGlCQUFXLEVBQUUsR0FBRyxVQUFVLE9BQU07QUFDaEMsZ0JBQVU7SUFDWjtFQUNGO0FBRUEsTUFBSSxjQUFjLFNBQVMsY0FBYyxDQUFDLEdBQUc7QUFDM0MsVUFBTSxlQUF3QyxDQUFBO0FBQzlDLFFBQUksc0JBQXNCO0FBQzFCLGVBQVcsQ0FBQyxlQUFlLFdBQVcsS0FBSyxPQUFPLFFBQ2hELFNBQVMsY0FBYyxDQUFDLEdBQ3ZCO0FBQ0QsVUFBSSxDQUFDLGNBQWMsV0FBVyxHQUFHO0FBQy9CLHFCQUFhLGFBQWEsSUFBSTtBQUM5QjtNQUNGO0FBQ0EsWUFBTUEsWUFBVyxjQUFjLFlBQVksVUFBVSxDQUFDO0FBQ3RELFVBQUlBLFVBQVMsU0FBUztBQUNwQixxQkFBYSxhQUFhLElBQUksRUFBRSxHQUFHLGFBQWEsQ0FBQyxVQUFVLEdBQUdBLFVBQVMsSUFBRztBQUMxRSw4QkFBc0I7QUFDdEI7TUFDRjtBQUNBLG1CQUFhLGFBQWEsSUFBSTtJQUNoQztBQUNBLFFBQUkscUJBQXFCO0FBQ3ZCLGlCQUFXLEVBQUUsR0FBRyxVQUFVLGFBQVk7QUFDdEMsZ0JBQVU7SUFDWjtFQUNGO0FBRUEsU0FBTyxVQUFVLFdBQVc7QUFDOUI7QUFFQSxTQUFTLGNBQ1AsVUFBaUI7QUFFakIsTUFBSSxDQUFDLGNBQWMsUUFBUTtBQUFHLFdBQU8sRUFBRSxTQUFTLE9BQU8sS0FBSyxTQUFRO0FBQ3BFLFFBQU0sT0FBZ0MsQ0FBQTtBQUN0QyxNQUFJLFVBQVU7QUFDZCxhQUFXLENBQUMsS0FBSyxLQUFLLEtBQUssT0FBTyxRQUFRLFFBQVEsR0FBRztBQUNuRCxVQUFNLGFBQWEsZ0NBQWdDLEtBQUs7QUFDeEQsUUFBSSxlQUFlO0FBQU8sZ0JBQVU7QUFDcEMsU0FBSyxHQUFHLElBQUk7RUFDZDtBQUNBLFNBQU8sVUFBVSxFQUFFLFNBQVMsTUFBTSxLQUFLLEtBQUksSUFBSyxFQUFFLFNBQVMsT0FBTyxLQUFLLFNBQVE7QUFDakY7QUFFTyxJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLFNBQVMsaUJBQ04sT0FBTywrQkFBK0IseUJBQXlCLEVBQy9ELFNBQVE7RUFDWCxVQUFVLGlCQUFFLE9BQU8sd0JBQXdCLHFCQUFxQixFQUFFLFNBQVE7Q0FDM0UsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLGFBQWEsWUFBVztBQUNwQyxPQUNHLFlBQVksWUFBWSxTQUNyQixJQUNBLE9BQU8sS0FBSyxZQUFZLE9BQU8sRUFBRSxVQUFVLDZCQUMvQztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFNBQVM7S0FDakI7RUFDSDtBQUNBLE9BQ0csWUFBWSxhQUFhLFNBQ3RCLElBQ0EsT0FBTyxLQUFLLFlBQVksUUFBUSxFQUFFLFVBQVUsMkJBQ2hEO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsVUFBVTtLQUNsQjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0scUJBQXFCLGlCQUMvQixPQUFPO0VBQ04sYUFBYSxpQkFBRSxPQUFPLHdCQUF3QixxQkFBcUI7Q0FDcEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixNQUFJLE9BQU8sS0FBSyxNQUFNLFdBQVcsRUFBRSxTQUFTLEdBQUc7QUFDN0MsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsYUFBYTtLQUNyQjtFQUNIO0FBQ0EsTUFBSSxPQUFPLEtBQUssTUFBTSxXQUFXLEVBQUUsU0FBUywyQkFBMkI7QUFDckUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsYUFBYTtLQUNyQjtFQUNIO0FBQ0YsQ0FBQztBQVFJLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUyxXQUFXLFNBQVE7RUFDNUIsY0FBYyxpQkFBRSxPQUFPLHVCQUF1Qix3QkFBd0IsRUFBRSxTQUFRO0VBQ2hGLFVBQVUsaUJBQUUsT0FBTyx3QkFBd0IscUJBQXFCLEVBQUUsU0FBUTtFQUMxRSxRQUFRLGlCQUFFLE9BQU8sd0JBQXdCLGtCQUFrQixFQUFFLFNBQVE7Q0FDdEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFVBQVUsWUFBVztBQUNqQyxPQUNHLFNBQVMsaUJBQWlCLFNBQ3ZCLElBQ0EsT0FBTyxLQUFLLFNBQVMsWUFBWSxFQUFFLFVBQVUsMEJBQ2pEO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsY0FBYztLQUN0QjtFQUNIO0FBQ0EsT0FDRyxTQUFTLFdBQVcsU0FBWSxJQUFJLE9BQU8sS0FBSyxTQUFTLE1BQU0sRUFBRSxVQUNsRSxvQkFDQTtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFFBQVE7S0FDaEI7RUFDSDtBQUNBLFFBQU0sZUFDSCxTQUFTLGFBQWEsU0FBWSxJQUFJLE9BQU8sS0FBSyxTQUFTLFFBQVEsRUFBRSxVQUN0RSxPQUFPLE9BQU8sU0FBUyxnQkFBZ0IsQ0FBQSxDQUFFLEVBQUUsT0FDekMsQ0FBQyxPQUFPLGdCQUNOLFNBQ0MsWUFBWSxhQUFhLFNBQ3RCLElBQ0EsT0FBTyxLQUFLLFlBQVksUUFBUSxFQUFFLFNBQ3hDLENBQUM7QUFFTCxNQUFJLGNBQWMsc0JBQXNCO0FBQ3RDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVU7S0FDbEI7RUFDSDtBQUNGLENBQUM7QUFNSSxJQUFNLG1CQUFtQixpQkFBRSxLQUFLLENBQUMsUUFBUSxPQUFPLENBQUM7QUFHakQsSUFBTSxvQkFBb0IsaUJBQzlCLE9BQU87RUFDTixTQUFTO0VBQ1QsUUFBUTtFQUNSLE9BQU87RUFDUCxVQUFVLGlCQUFFLE1BQU0saUJBQWlCLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxzQkFBc0I7RUFDdEUsUUFBUSxpQkFBRSxPQUFPLG1CQUFtQixxQkFBcUIsRUFBRSxTQUFRO0VBQ25FLEtBQUssOEJBQThCLFNBQVE7RUFDM0MsbUJBQW1CLHVCQUF1QixTQUFRO0VBQ2xELG9CQUFvQix1QkFBdUIsU0FBUTtFQUNuRCxXQUFXO0VBQ1gsV0FBVyxnQkFBZ0IsU0FBUTtFQUNuQyxTQUFTLHNCQUFzQixTQUFRO0VBQ3ZDLFdBQVcsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQ3ZDLFlBQVksZ0JBQWdCLFNBQVE7RUFDcEMsV0FBVyxnQkFBZ0IsU0FBUTtDQUNwQyxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsT0FBTyxZQUFXO0FBQzlCLE1BQUksTUFBTSxZQUFZLFVBQWEsTUFBTSxZQUFZLE1BQU0sU0FBUztBQUNsRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLE1BQU0sY0FBYyxVQUFhLE1BQU0sYUFBYSxNQUFNLFdBQVc7QUFDdkUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsV0FBVztLQUNuQjtFQUNIO0FBQ0EsTUFBSSxNQUFNLGNBQWMsVUFBYSxNQUFNLFlBQVksTUFBTSxXQUFXO0FBQ3RFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFdBQVc7S0FDbkI7RUFDSDtBQUNBLE1BQUksTUFBTSxXQUFXO0FBQVc7QUFDaEMsUUFBTSxXQUFXLElBQUksSUFBSSxNQUFNLFFBQVE7QUFDdkMsYUFBVyxVQUFVLE9BQU8sS0FBSyxNQUFNLE1BQU0sR0FBRztBQUM5QyxRQUFJLENBQUMsU0FBUyxJQUFJLE1BQU0sR0FBRztBQUN6QixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxRQUFRO09BQ2hCO0FBQ0Q7SUFDRjtFQUNGO0FBQ0YsQ0FBQztBQUtJLElBQU0sMkJBQTJCLGlCQUNyQyxPQUFPO0VBQ04sWUFBWTtFQUNaLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFJRixJQUFNLHlCQUF5QixPQUFPLE9BQU87RUFDbEQ7RUFDQTtFQUNBO0NBQ1E7QUFFSCxJQUFNLDJCQUEyQixPQUFPLE9BQU87RUFDcEQ7Q0FDUTtBQUVILElBQU0sd0JBQXdCLE9BQU8sT0FBTztFQUNqRDtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNRO0FBRUgsSUFBTSw0QkFBNEIsaUJBQUUsS0FBSztFQUM5QyxHQUFHO0VBQ0gsR0FBRztFQUNILEdBQUc7Q0FDSjtBQUtNLElBQU0sOEJBQThCLGlCQUFFLG1CQUFtQixXQUFXO0VBQ3pFLGlCQUNHLE9BQU87SUFDTixTQUFTLGlCQUFFLFFBQVEsT0FBTztJQUMxQixRQUFRLGlCQUFFLEtBQUssc0JBQXNCO0lBQ3JDLFVBQVUsdUJBQXVCLFNBQVE7SUFDekMsU0FBUyx1QkFBdUIsU0FBUTtJQUN4QyxRQUFRLDBCQUEwQixTQUFRO0dBQzNDLEVBQ0EsT0FBTTtFQUNULGlCQUNHLE9BQU87SUFDTixTQUFTLGlCQUFFLFFBQVEsU0FBUztJQUM1QixRQUFRLGlCQUFFLEtBQUssd0JBQXdCO0lBQ3ZDLFVBQVUsdUJBQXVCLFNBQVE7SUFDekMsUUFBUSwwQkFBMEIsU0FBUTtHQUMzQyxFQUNBLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sU0FBUyxpQkFBRSxRQUFRLE1BQU07SUFDekIsUUFBUSxpQkFBRSxLQUFLLHFCQUFxQjtJQUNwQyxVQUFVLHVCQUF1QixTQUFRO0lBQ3pDLFNBQVMsdUJBQXVCLFNBQVE7SUFDeEMsUUFBUSwwQkFBMEIsU0FBUTtHQUMzQyxFQUNBLE9BQU07Q0FDVjtBQUlNLElBQU0sMEJBQTBCLGlCQUFFLEtBQUssQ0FBQyxRQUFRLE9BQU8sQ0FBQztBQUV4RCxJQUFNLDJCQUEyQixpQkFBRSxLQUFLO0VBQzdDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFRCxJQUFNLDZCQUE2QixpQkFDaEMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksc0JBQXNCLEVBRzFCLE9BQU8sQ0FBQyxVQUFVLENBQUMseUJBQXlCLEtBQUssS0FBSyxHQUFHO0VBQ3hELFNBQVM7Q0FDVjtBQU1JLElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPO0VBQ04sS0FBSyxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVE7RUFDOUIsWUFBWTtFQUNaLE9BQU87RUFDUCxRQUFRO0VBQ1IsVUFBVSx1QkFBdUIsU0FBUTtFQUN6QyxTQUFTLHVCQUF1QixTQUFRO0VBQ3hDLGVBQWUsdUJBQXVCLFNBQVE7RUFDOUMsUUFBUSwwQkFBMEIsU0FBUTtFQUMxQyxTQUFTLGtCQUFrQixTQUFRO0VBQ25DLGFBQWEsaUJBQ1YsTUFBTSwwQkFBMEIsRUFDaEMsSUFBSSx3QkFBd0IsRUFDNUIsU0FBUTtFQUNYLFVBQVUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLFdBQVcsRUFBRSxJQUFJLFVBQVUsRUFBRSxTQUFRO0VBQ3BFLFFBQVEsMEJBQTBCLFNBQVE7Q0FDM0MsRUFDQSxPQUFNO0FBTUYsSUFBTSwrQkFBK0IsaUJBQUUsS0FBSyxDQUFDLFlBQVksT0FBTyxDQUFDO0FBSWpFLElBQU0saUNBQWlDLGlCQUFFLFFBQzlDLCtCQUErQjtBQUkxQixJQUFNLHFDQUFxQyxpQkFDL0MsT0FBTztFQUNOLFFBQVE7RUFDUixXQUFXO0VBQ1gsU0FBUztFQUNULFVBQVUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0NBQ3ZDLEVBQ0EsT0FBTTtBQU9GLElBQU0sbUNBQW1DLGlCQUM3QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsVUFBVSxpQkFBRSxPQUFPLHdCQUF3Qix3QkFBd0I7RUFDbkUsUUFBUSxpQkFBRSxPQUFPLGVBQWUsaUJBQWlCO0VBQ2pELE9BQU8saUJBQUUsTUFBTSx1QkFBdUIsRUFBRSxJQUFJLHdCQUF3QjtDQUNyRSxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsT0FBTyxZQUFXO0FBQzlCLE1BQUksT0FBTyxLQUFLLE1BQU0sUUFBUSxFQUFFLFNBQVMscUJBQXFCO0FBQzVELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVU7S0FDbEI7RUFDSDtBQUNBLE1BQUksT0FBTyxLQUFLLE1BQU0sTUFBTSxFQUFFLFNBQVMsbUJBQW1CO0FBQ3hELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFFBQVE7S0FDaEI7RUFDSDtBQUNGLENBQUM7QUFNSSxJQUFNLGlDQUFpQyxpQkFBRSxRQUFRLDRCQUE0QjtBQU83RSxJQUFNLG1DQUFtQyxpQkFDN0MsT0FBTztFQUNOLFFBQVE7RUFDUixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixXQUFXO0VBQ1gsU0FBUztFQUNULFVBQVUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQ3RDLFdBQVc7RUFDWCxXQUFXO0VBQ1gsT0FBTyxnQkFBZ0IsT0FBTywwQkFBMEI7RUFDeEQsWUFBWTtFQUNaLG1CQUFtQixnQkFBZ0IsT0FBTyx1Q0FBdUM7Q0FDbEYsRUFDQSxPQUFNO0FBUVQsSUFBTSx1QkFDSjtBQUVLLElBQU0sMEJBQTBCO0FBQ2hDLElBQU0sdUJBQXVCO0FBQzdCLElBQU0seUJBQXlCLElBQUksT0FBTztBQUcxQyxJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLEdBQUcsaUJBQUUsUUFBUSxDQUFDO0VBQ2QsT0FBTyxpQkFBRSxPQUFNLEVBQUcsSUFBSSxFQUFFLEVBQUUsSUFBSSxHQUFHO0VBQ2pDLElBQUksaUJBQUUsUUFBUSxNQUFNO0VBQ3BCLFlBQVk7RUFDWixNQUFNLGlCQUNILE1BQU0saUJBQUUsT0FBTSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksb0JBQW9CLENBQUMsRUFDakQsSUFBSSxDQUFDLEVBQ0wsSUFBSSx1QkFBdUI7Q0FDL0IsRUFDQSxPQUFNO0FBS0YsSUFBTSxpQ0FBaUMsaUJBQzNDLE9BQU87RUFDTixHQUFHLGlCQUFFLFFBQVEsQ0FBQztFQUNkLE9BQU8saUJBQUUsUUFBUSxVQUFVO0VBQzNCLFNBQVMsaUJBQUUsS0FBSyxDQUFDLFNBQVMsTUFBTSxDQUFDO0VBQ2pDLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFFRixJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLEdBQUcsaUJBQUUsUUFBUSxDQUFDO0VBQ2QsT0FBTyxpQkFBRSxLQUFLLENBQUMsVUFBVSxRQUFRLENBQUM7RUFDbEMsTUFBTSxpQkFBRSxPQUFNLEVBQUcsTUFBTSxzQkFBc0IsOEJBQThCO0NBQzVFLEVBQ0EsT0FBTTtBQUVGLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sR0FBRyxpQkFBRSxRQUFRLENBQUM7RUFDZCxPQUFPLGlCQUFFLFFBQVEsTUFBTTtFQUN2QixVQUFVLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsSUFBSSxXQUFXLEVBQUUsSUFBSSxVQUFVLEVBQUUsU0FBUTtFQUNwRSxRQUFRLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxTQUFRO0NBQzNDLEVBQ0EsT0FBTTtBQUVGLElBQU0sK0JBQStCLGlCQUFFLG1CQUFtQixTQUFTO0VBQ3hFO0VBQ0E7RUFDQTtDQUNEO0FBS00sSUFBTSwrQkFBK0IsaUJBQUUsbUJBQW1CLFNBQVM7RUFDeEUsaUJBQ0csT0FBTztJQUNOLEdBQUcsaUJBQUUsUUFBUSxDQUFDO0lBQ2QsT0FBTyxpQkFBRSxRQUFRLE9BQU87SUFDeEIsTUFBTSxpQkFBRSxPQUFNLEVBQUcsTUFBTSxvQkFBb0I7R0FDNUMsRUFDQSxPQUFNO0VBQ1QsaUJBQUUsT0FBTyxFQUFFLEdBQUcsaUJBQUUsUUFBUSxDQUFDLEdBQUcsT0FBTyxpQkFBRSxRQUFRLGFBQWEsRUFBQyxDQUFFLEVBQUUsT0FBTTtDQUN0RTs7O0FDdnhCTSxJQUFNLGlDQUFpQyxpQkFBRSxLQUFLO0VBQ25EO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFRCxJQUFNLDRCQUE0QixpQkFDL0IsT0FBTSxFQUNOLElBQUksRUFBRSxFQUNOLElBQUksR0FBRyxFQUNQLE1BQU0sZ0NBQWdDO0FBRWxDLElBQU0sNkNBQTZDLGlCQUN2RCxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUztFQUNULGFBQWE7RUFDYixjQUFjO0VBQ2QsbUJBQW1CO0VBQ25CLGdCQUFnQjtFQUNoQixnQkFBZ0I7RUFDaEIsa0JBQWtCO0VBQ2xCLHVCQUF1QjtFQUN2QixrQkFBa0I7RUFDbEIsT0FBTztDQUNSLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsTUFBSSxRQUFRLGlCQUFpQixRQUFRLG1CQUFtQjtBQUN0RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLG1CQUFtQjtNQUMxQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLFFBQU0sU0FBUztJQUNiLFVBQVU7SUFDVixxQkFBcUI7SUFDckIsb0JBQW9CO0lBQ3BCLFdBQVc7SUFDWCxRQUFRLEtBQUs7QUFDZixNQUFJLFFBQVEsaUJBQWlCLFdBQVcsUUFBUSxnQkFBZ0I7QUFDOUQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxnQkFBZ0I7TUFDdkIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSxzQ0FBc0MsaUJBQ2hELE9BQU87RUFDTixTQUFTO0VBQ1QsbUJBQW1CO0NBQ3BCLEVBQ0EsT0FBTTtBQVlGLElBQU0sc0NBQXNDLGlCQUFFLEtBQUs7RUFDeEQ7RUFDQTtDQUNEO0FBRUQsSUFBTSxxQkFBcUIsY0FBYyxPQUN2QyxDQUFDLFNBQWtDLEtBQUssU0FBUyxnQkFDakQ7RUFDRSxPQUFPO0NBQ1I7QUFHSSxJQUFNLHlDQUF5QyxpQkFDbkQsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLE1BQU0saUJBQUUsUUFBUSx1QkFBdUI7RUFDdkMsYUFBYTtFQUNiLFNBQVM7RUFDVCxVQUFVO0VBQ1YsT0FBTztFQUNQLFlBQVk7RUFDWixZQUFZO0VBQ1osaUJBQWlCO0VBQ2pCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsV0FBVztFQUNYLFlBQVk7Q0FDYixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLFFBQU0sMkJBQ0osT0FBTyxVQUFVLGNBQWMsT0FBTyxVQUFVLHNCQUM1QyxZQUNBO0FBQ04sTUFDRSxPQUFPLFdBQVcsVUFBVSxZQUM1QixPQUFPLGdCQUFnQixVQUFVLDRCQUNqQyxPQUFPLFdBQVcsT0FBTyxPQUFPLGdCQUFnQixNQUNoRCxPQUFPLFdBQVcsZUFBZSxPQUFPLGdCQUFnQixjQUN4RCxPQUFPLG1CQUFtQixPQUFPLFdBQVcsUUFBUSxrQkFDcEQsT0FBTyxXQUFXLFFBQVEsWUFBWSxPQUFPLFdBQzdDLE9BQU8sV0FBVyxRQUFRLGdCQUFnQixPQUFPLGVBQ2pELE9BQU8sV0FBVyxRQUFRLGlCQUFpQixPQUFPLFdBQVcsTUFDN0QsT0FBTyxXQUFXLFFBQVEsc0JBQXNCLE9BQU8sZ0JBQWdCLE1BQ3ZFLE9BQU8sV0FBVyxRQUFRLFVBQVUsT0FBTyxPQUMzQztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsWUFBWTtNQUNuQixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFNSSxJQUFNLHFEQUFxRCxLQUFLOzs7QUM3SGhFLElBQU0seUJBQXlCO0FBQy9CLElBQU0seUJBQXlCO0FBTy9CLElBQU0sZ0NBQWdDO0FBQ3RDLElBQU0sMEJBQTBCO0FBQ2hDLElBQU0scUNBQXFDO0FBVzNDLElBQU0sNEJBQTRCLGlCQUFFLEtBQUs7O0VBRTlDOztFQUVBOztFQUVBOztFQUVBOztFQUVBOztFQUVBO0NBQ0Q7QUFXTSxJQUFNLDhCQUE4QixpQkFDeEMsT0FBTztFQUNOLHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUcsRUFDSCxJQUFJLHNCQUFzQixFQUMxQixJQUFJLHNCQUFzQjtFQUM3QixlQUFlLGlCQUNaLE9BQU0sRUFDTixJQUFHLEVBQ0gsSUFBSSxzQkFBc0IsRUFDMUIsSUFBSSxzQkFBc0I7RUFDN0IsMEJBQTBCLGlCQUN2QixPQUFNLEVBQ04sSUFBRyxFQUNILElBQUksc0JBQXNCLEVBQzFCLElBQUksc0JBQXNCO0NBQzlCLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsTUFBSSxPQUFPLGdCQUFnQixPQUFPLHFCQUFxQjtBQUNyRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxNQUFJLE9BQU8sMkJBQTJCLE9BQU8scUJBQXFCO0FBQ2hFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLDBCQUEwQjtLQUNsQztFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sa0NBQXlELE9BQU8sT0FBTztFQUNsRixxQkFBcUI7RUFDckIsZUFBZTtFQUNmLDBCQUEwQjtDQUMzQjs7O0FDL0VNLElBQU0saUNBQWlDO0FBQ3ZDLElBQU0sK0JBQStCLE1BQU0sT0FBTztBQUV6RCxJQUFNQyw4QkFBNkIsZ0JBQ2hDLE9BQU8sRUFBRSxFQUNULE9BQU8sQ0FBQyxVQUFVLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRSxlQUFlLElBQUk7RUFDcEUsT0FBTztDQUNSO0FBRUksSUFBTSx3QkFDWEEsNEJBQTJCLE1BQUs7QUFDM0IsSUFBTSxrQ0FDWEEsNEJBQTJCLE1BQUs7QUFZM0IsSUFBTSwyQkFBMkIsaUJBQ3JDLE9BQU87RUFDTixXQUFXLGlCQUFFLFFBQVEsOENBQThDO0VBQ25FLFlBQVk7RUFDWixlQUFlO0NBQ2hCLEVBQ0EsT0FBTTtBQUVGLElBQU0sZ0NBQWdDLGlCQUMxQyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLFFBQVE7RUFDeEIsUUFBUSxpQkFBRSxRQUFRLDJCQUEyQjtFQUM3QyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixTQUFTO0VBQ1QsZUFBZTtFQUNmLFdBQVc7RUFDWCxZQUFZO0NBQ2IsRUFDQSxPQUFNO0FBU0YsSUFBTSxrQ0FBa0MsaUJBQUUsS0FBSzs7RUFFcEQ7O0VBRUE7O0VBRUE7Q0FDRDtBQUVNLElBQU0sNEJBQTRCLGlCQUN0QyxPQUFPO0VBQ04sV0FBVztFQUNYLE9BQU8saUJBQUUsS0FBSyxDQUFDLFlBQVksTUFBTSxDQUFDO0VBQ2xDLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFPRixJQUFNLDZCQUE2QixpQkFDdkMsTUFBTSx5QkFBeUIsRUFDL0IsSUFBSSxHQUFLLEVBQ1QsWUFBWSxDQUFDLGNBQWMsWUFBVztBQUNyQyxRQUFNLE9BQU8sb0JBQUksSUFBRztBQUNwQixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssYUFBYSxRQUFPLEdBQUk7QUFDdEQsVUFBTSxNQUFNLEdBQUcsU0FBUyxLQUFLLElBQUksU0FBUyxTQUFTO0FBQ25ELFFBQUksS0FBSyxJQUFJLEdBQUcsR0FBRztBQUNqQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxPQUFPLFdBQVc7T0FDMUI7SUFDSDtBQUNBLFNBQUssSUFBSSxHQUFHO0VBQ2Q7QUFDRixDQUFDO0FBU0ksSUFBTSwrQkFBK0IsaUJBQUUsbUJBQW1CLFFBQVE7RUFDdkUsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxPQUFPO0lBQ3ZCLFNBQVM7SUFDVCxVQUFVO0dBQ1gsRUFDQSxPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxNQUFNO0lBQ3RCLFNBQVM7SUFDVCxRQUFRO0lBQ1IsVUFBVTtJQUNWLFVBQVU7R0FDWCxFQUNBLE9BQU07Q0FDVjtBQUVNLElBQU0sZ0NBQWdDLGlCQUMxQyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLFFBQVE7RUFDeEIsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsWUFBWSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxJQUFJLDhCQUE4QjtFQUM3RSxXQUFXLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVyxFQUFHLElBQUksOEJBQThCO0VBQzVFLGtCQUFrQkE7RUFDbEIsbUJBQW1CO0NBQ3BCLEVBQ0EsT0FBTTtBQUVGLElBQU0sdUJBQXVCLGlCQUNqQyxPQUFPO0VBQ04sY0FBYyxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVEsRUFBRyxJQUFJLDRCQUE0QjtFQUMxRSxrQkFBa0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSw4QkFBOEI7Q0FDakYsRUFDQSxPQUFNO0FBR0YsSUFBTSxrQ0FBa0MsaUJBQUUsS0FBSyxDQUFDLFFBQVEsUUFBUSxRQUFRLENBQUM7QUFFekUsSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixTQUFTO0VBQ1QsV0FBVztFQUNYLGVBQWUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQzNDLGVBQWUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQzNDLGNBQWMsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQzFDLGdCQUFnQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVc7Q0FDN0MsRUFDQSxPQUFNOyIsCiAgIm5hbWVzIjogWyJwb2xpY2llcyIsICJjYW5vbmljYWwzMkJ5dGVWYWx1ZVNjaGVtYSJdCn0K