kavrix 0.2.3 → 0.2.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/bin.js +1366 -8302
- package/dist/chunks/chunk-3LXISP6O.js +7789 -0
- package/dist/chunks/{chunk-FLG24WVK.js → chunk-7AJQTDJG.js} +4 -31
- package/dist/chunks/{chunk-JOPGABL4.js → chunk-G6X4LRO2.js} +2 -28
- package/dist/chunks/{chunk-D4JYLAAS.js → chunk-MNQHU3EJ.js} +4134 -29
- package/dist/chunks/{chunk-3MTK6AVM.js → chunk-MTADWNBJ.js} +37 -187
- package/dist/chunks/{chunk-S4PSIM2L.js → chunk-T5WUZPWZ.js} +0 -26
- package/dist/index.d.ts +1 -1
- package/dist/index.js +1 -1
- package/dist/kavrix.cdx.json +20 -42
- package/package.json +1 -1
- package/dist/chunks/chunk-EOAERCV7.js +0 -4499
- package/dist/chunks/chunk-TQHLXSBI.js +0 -1217
|
@@ -1,4499 +0,0 @@
|
|
|
1
|
-
/*! Kavrix is MIT licensed. Bundled third-party notices:
|
|
2
|
-
|
|
3
|
-
commander@15.0.0 (MIT)
|
|
4
|
-
(The MIT License)
|
|
5
|
-
|
|
6
|
-
Copyright (c) 2011 TJ Holowaychuk <tj@vision-media.ca>
|
|
7
|
-
|
|
8
|
-
Permission is hereby granted, free of charge, to any person obtaining
|
|
9
|
-
a copy of this software and associated documentation files (the
|
|
10
|
-
'Software'), to deal in the Software without restriction, including
|
|
11
|
-
without limitation the rights to use, copy, modify, merge, publish,
|
|
12
|
-
distribute, sublicense, and/or sell copies of the Software, and to
|
|
13
|
-
permit persons to whom the Software is furnished to do so, subject to
|
|
14
|
-
the following conditions:
|
|
15
|
-
|
|
16
|
-
The above copyright notice and this permission notice shall be
|
|
17
|
-
included in all copies or substantial portions of the Software.
|
|
18
|
-
|
|
19
|
-
THE SOFTWARE IS PROVIDED 'AS IS', WITHOUT WARRANTY OF ANY KIND,
|
|
20
|
-
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
|
|
21
|
-
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
|
|
22
|
-
IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY
|
|
23
|
-
CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
|
|
24
|
-
TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE
|
|
25
|
-
SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
26
|
-
|
|
27
|
-
zod@4.4.3 (MIT)
|
|
28
|
-
MIT License
|
|
29
|
-
|
|
30
|
-
Copyright (c) 2025 Colin McDonnell
|
|
31
|
-
|
|
32
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
33
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
34
|
-
in the Software without restriction, including without limitation the rights
|
|
35
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
36
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
37
|
-
furnished to do so, subject to the following conditions:
|
|
38
|
-
|
|
39
|
-
The above copyright notice and this permission notice shall be included in all
|
|
40
|
-
copies or substantial portions of the Software.
|
|
41
|
-
|
|
42
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
43
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
44
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
45
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
46
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
47
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
48
|
-
SOFTWARE.
|
|
49
|
-
|
|
50
|
-
yaml@2.8.3 (ISC)
|
|
51
|
-
Copyright Eemeli Aro <eemeli@gmail.com>
|
|
52
|
-
|
|
53
|
-
Permission to use, copy, modify, and/or distribute this software for any purpose
|
|
54
|
-
with or without fee is hereby granted, provided that the above copyright notice
|
|
55
|
-
and this permission notice appear in all copies.
|
|
56
|
-
|
|
57
|
-
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
|
|
58
|
-
REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND
|
|
59
|
-
FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
|
|
60
|
-
INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS
|
|
61
|
-
OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER
|
|
62
|
-
TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF
|
|
63
|
-
THIS SOFTWARE.
|
|
64
|
-
|
|
65
|
-
mongodb@7.5.0 (Apache-2.0)
|
|
66
|
-
Apache License
|
|
67
|
-
Version 2.0, January 2004
|
|
68
|
-
http://www.apache.org/licenses/
|
|
69
|
-
|
|
70
|
-
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
|
71
|
-
|
|
72
|
-
1. Definitions.
|
|
73
|
-
|
|
74
|
-
"License" shall mean the terms and conditions for use, reproduction,
|
|
75
|
-
and distribution as defined by Sections 1 through 9 of this document.
|
|
76
|
-
|
|
77
|
-
"Licensor" shall mean the copyright owner or entity authorized by
|
|
78
|
-
the copyright owner that is granting the License.
|
|
79
|
-
|
|
80
|
-
"Legal Entity" shall mean the union of the acting entity and all
|
|
81
|
-
other entities that control, are controlled by, or are under common
|
|
82
|
-
control with that entity. For the purposes of this definition,
|
|
83
|
-
"control" means (i) the power, direct or indirect, to cause the
|
|
84
|
-
direction or management of such entity, whether by contract or
|
|
85
|
-
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
|
86
|
-
outstanding shares, or (iii) beneficial ownership of such entity.
|
|
87
|
-
|
|
88
|
-
"You" (or "Your") shall mean an individual or Legal Entity
|
|
89
|
-
exercising permissions granted by this License.
|
|
90
|
-
|
|
91
|
-
"Source" form shall mean the preferred form for making modifications,
|
|
92
|
-
including but not limited to software source code, documentation
|
|
93
|
-
source, and configuration files.
|
|
94
|
-
|
|
95
|
-
"Object" form shall mean any form resulting from mechanical
|
|
96
|
-
transformation or translation of a Source form, including but
|
|
97
|
-
not limited to compiled object code, generated documentation,
|
|
98
|
-
and conversions to other media types.
|
|
99
|
-
|
|
100
|
-
"Work" shall mean the work of authorship, whether in Source or
|
|
101
|
-
Object form, made available under the License, as indicated by a
|
|
102
|
-
copyright notice that is included in or attached to the work
|
|
103
|
-
(an example is provided in the Appendix below).
|
|
104
|
-
|
|
105
|
-
"Derivative Works" shall mean any work, whether in Source or Object
|
|
106
|
-
form, that is based on (or derived from) the Work and for which the
|
|
107
|
-
editorial revisions, annotations, elaborations, or other modifications
|
|
108
|
-
represent, as a whole, an original work of authorship. For the purposes
|
|
109
|
-
of this License, Derivative Works shall not include works that remain
|
|
110
|
-
separable from, or merely link (or bind by name) to the interfaces of,
|
|
111
|
-
the Work and Derivative Works thereof.
|
|
112
|
-
|
|
113
|
-
"Contribution" shall mean any work of authorship, including
|
|
114
|
-
the original version of the Work and any modifications or additions
|
|
115
|
-
to that Work or Derivative Works thereof, that is intentionally
|
|
116
|
-
submitted to Licensor for inclusion in the Work by the copyright owner
|
|
117
|
-
or by an individual or Legal Entity authorized to submit on behalf of
|
|
118
|
-
the copyright owner. For the purposes of this definition, "submitted"
|
|
119
|
-
means any form of electronic, verbal, or written communication sent
|
|
120
|
-
to the Licensor or its representatives, including but not limited to
|
|
121
|
-
communication on electronic mailing lists, source code control systems,
|
|
122
|
-
and issue tracking systems that are managed by, or on behalf of, the
|
|
123
|
-
Licensor for the purpose of discussing and improving the Work, but
|
|
124
|
-
excluding communication that is conspicuously marked or otherwise
|
|
125
|
-
designated in writing by the copyright owner as "Not a Contribution."
|
|
126
|
-
|
|
127
|
-
"Contributor" shall mean Licensor and any individual or Legal Entity
|
|
128
|
-
on behalf of whom a Contribution has been received by Licensor and
|
|
129
|
-
subsequently incorporated within the Work.
|
|
130
|
-
|
|
131
|
-
2. Grant of Copyright License. Subject to the terms and conditions of
|
|
132
|
-
this License, each Contributor hereby grants to You a perpetual,
|
|
133
|
-
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
134
|
-
copyright license to reproduce, prepare Derivative Works of,
|
|
135
|
-
publicly display, publicly perform, sublicense, and distribute the
|
|
136
|
-
Work and such Derivative Works in Source or Object form.
|
|
137
|
-
|
|
138
|
-
3. Grant of Patent License. Subject to the terms and conditions of
|
|
139
|
-
this License, each Contributor hereby grants to You a perpetual,
|
|
140
|
-
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
|
141
|
-
(except as stated in this section) patent license to make, have made,
|
|
142
|
-
use, offer to sell, sell, import, and otherwise transfer the Work,
|
|
143
|
-
where such license applies only to those patent claims licensable
|
|
144
|
-
by such Contributor that are necessarily infringed by their
|
|
145
|
-
Contribution(s) alone or by combination of their Contribution(s)
|
|
146
|
-
with the Work to which such Contribution(s) was submitted. If You
|
|
147
|
-
institute patent litigation against any entity (including a
|
|
148
|
-
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
|
149
|
-
or a Contribution incorporated within the Work constitutes direct
|
|
150
|
-
or contributory patent infringement, then any patent licenses
|
|
151
|
-
granted to You under this License for that Work shall terminate
|
|
152
|
-
as of the date such litigation is filed.
|
|
153
|
-
|
|
154
|
-
4. Redistribution. You may reproduce and distribute copies of the
|
|
155
|
-
Work or Derivative Works thereof in any medium, with or without
|
|
156
|
-
modifications, and in Source or Object form, provided that You
|
|
157
|
-
meet the following conditions:
|
|
158
|
-
|
|
159
|
-
(a) You must give any other recipients of the Work or
|
|
160
|
-
Derivative Works a copy of this License; and
|
|
161
|
-
|
|
162
|
-
(b) You must cause any modified files to carry prominent notices
|
|
163
|
-
stating that You changed the files; and
|
|
164
|
-
|
|
165
|
-
(c) You must retain, in the Source form of any Derivative Works
|
|
166
|
-
that You distribute, all copyright, patent, trademark, and
|
|
167
|
-
attribution notices from the Source form of the Work,
|
|
168
|
-
excluding those notices that do not pertain to any part of
|
|
169
|
-
the Derivative Works; and
|
|
170
|
-
|
|
171
|
-
(d) If the Work includes a "NOTICE" text file as part of its
|
|
172
|
-
distribution, then any Derivative Works that You distribute must
|
|
173
|
-
include a readable copy of the attribution notices contained
|
|
174
|
-
within such NOTICE file, excluding those notices that do not
|
|
175
|
-
pertain to any part of the Derivative Works, in at least one
|
|
176
|
-
of the following places: within a NOTICE text file distributed
|
|
177
|
-
as part of the Derivative Works; within the Source form or
|
|
178
|
-
documentation, if provided along with the Derivative Works; or,
|
|
179
|
-
within a display generated by the Derivative Works, if and
|
|
180
|
-
wherever such third-party notices normally appear. The contents
|
|
181
|
-
of the NOTICE file are for informational purposes only and
|
|
182
|
-
do not modify the License. You may add Your own attribution
|
|
183
|
-
notices within Derivative Works that You distribute, alongside
|
|
184
|
-
or as an addendum to the NOTICE text from the Work, provided
|
|
185
|
-
that such additional attribution notices cannot be construed
|
|
186
|
-
as modifying the License.
|
|
187
|
-
|
|
188
|
-
You may add Your own copyright statement to Your modifications and
|
|
189
|
-
may provide additional or different license terms and conditions
|
|
190
|
-
for use, reproduction, or distribution of Your modifications, or
|
|
191
|
-
for any such Derivative Works as a whole, provided Your use,
|
|
192
|
-
reproduction, and distribution of the Work otherwise complies with
|
|
193
|
-
the conditions stated in this License.
|
|
194
|
-
|
|
195
|
-
5. Submission of Contributions. Unless You explicitly state otherwise,
|
|
196
|
-
any Contribution intentionally submitted for inclusion in the Work
|
|
197
|
-
by You to the Licensor shall be under the terms and conditions of
|
|
198
|
-
this License, without any additional terms or conditions.
|
|
199
|
-
Notwithstanding the above, nothing herein shall supersede or modify
|
|
200
|
-
the terms of any separate license agreement you may have executed
|
|
201
|
-
with Licensor regarding such Contributions.
|
|
202
|
-
|
|
203
|
-
6. Trademarks. This License does not grant permission to use the trade
|
|
204
|
-
names, trademarks, service marks, or product names of the Licensor,
|
|
205
|
-
except as required for reasonable and customary use in describing the
|
|
206
|
-
origin of the Work and reproducing the content of the NOTICE file.
|
|
207
|
-
|
|
208
|
-
7. Disclaimer of Warranty. Unless required by applicable law or
|
|
209
|
-
agreed to in writing, Licensor provides the Work (and each
|
|
210
|
-
Contributor provides its Contributions) on an "AS IS" BASIS,
|
|
211
|
-
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
|
212
|
-
implied, including, without limitation, any warranties or conditions
|
|
213
|
-
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
|
214
|
-
PARTICULAR PURPOSE. You are solely responsible for determining the
|
|
215
|
-
appropriateness of using or redistributing the Work and assume any
|
|
216
|
-
risks associated with Your exercise of permissions under this License.
|
|
217
|
-
|
|
218
|
-
8. Limitation of Liability. In no event and under no legal theory,
|
|
219
|
-
whether in tort (including negligence), contract, or otherwise,
|
|
220
|
-
unless required by applicable law (such as deliberate and grossly
|
|
221
|
-
negligent acts) or agreed to in writing, shall any Contributor be
|
|
222
|
-
liable to You for damages, including any direct, indirect, special,
|
|
223
|
-
incidental, or consequential damages of any character arising as a
|
|
224
|
-
result of this License or out of the use or inability to use the
|
|
225
|
-
Work (including but not limited to damages for loss of goodwill,
|
|
226
|
-
work stoppage, computer failure or malfunction, or any and all
|
|
227
|
-
other commercial damages or losses), even if such Contributor
|
|
228
|
-
has been advised of the possibility of such damages.
|
|
229
|
-
|
|
230
|
-
9. Accepting Warranty or Additional Liability. While redistributing
|
|
231
|
-
the Work or Derivative Works thereof, You may choose to offer,
|
|
232
|
-
and charge a fee for, acceptance of support, warranty, indemnity,
|
|
233
|
-
or other liability obligations and/or rights consistent with this
|
|
234
|
-
License. However, in accepting such obligations, You may act only
|
|
235
|
-
on Your own behalf and on Your sole responsibility, not on behalf
|
|
236
|
-
of any other Contributor, and only if You agree to indemnify,
|
|
237
|
-
defend, and hold each Contributor harmless for any liability
|
|
238
|
-
incurred by, or claims asserted against, such Contributor by reason
|
|
239
|
-
of your accepting any such warranty or additional liability.
|
|
240
|
-
|
|
241
|
-
END OF TERMS AND CONDITIONS
|
|
242
|
-
|
|
243
|
-
APPENDIX: How to apply the Apache License to your work.
|
|
244
|
-
|
|
245
|
-
To apply the Apache License to your work, attach the following
|
|
246
|
-
boilerplate notice, with the fields enclosed by brackets "{}"
|
|
247
|
-
replaced with your own identifying information. (Don't include
|
|
248
|
-
the brackets!) The text should be enclosed in the appropriate
|
|
249
|
-
comment syntax for the file format. We also recommend that a
|
|
250
|
-
file or class name and description of purpose be included on the
|
|
251
|
-
same "printed page" as the copyright notice for easier
|
|
252
|
-
identification within third-party archives.
|
|
253
|
-
|
|
254
|
-
Copyright {yyyy} {name of copyright owner}
|
|
255
|
-
|
|
256
|
-
Licensed under the Apache License, Version 2.0 (the "License");
|
|
257
|
-
you may not use this file except in compliance with the License.
|
|
258
|
-
You may obtain a copy of the License at
|
|
259
|
-
|
|
260
|
-
http://www.apache.org/licenses/LICENSE-2.0
|
|
261
|
-
|
|
262
|
-
Unless required by applicable law or agreed to in writing, software
|
|
263
|
-
distributed under the License is distributed on an "AS IS" BASIS,
|
|
264
|
-
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
265
|
-
See the License for the specific language governing permissions and
|
|
266
|
-
limitations under the License.
|
|
267
|
-
|
|
268
|
-
libsodium-wrappers@0.8.4 (ISC)
|
|
269
|
-
Copyright (c) 2015-2026
|
|
270
|
-
Ahmad Ben Mrad <batikhsouri at gmail dot org>
|
|
271
|
-
Frank Denis <j at pureftpd dot org>
|
|
272
|
-
Ryan Lester <ryan at cyph dot com>
|
|
273
|
-
|
|
274
|
-
Permission to use, copy, modify, and/or distribute this software for any
|
|
275
|
-
purpose with or without fee is hereby granted, provided that the above
|
|
276
|
-
copyright notice and this permission notice appear in all copies.
|
|
277
|
-
|
|
278
|
-
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
279
|
-
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
280
|
-
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
281
|
-
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
282
|
-
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
283
|
-
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
284
|
-
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
285
|
-
|
|
286
|
-
libsodium@0.8.4 (ISC)
|
|
287
|
-
Copyright (c) 2015-2026
|
|
288
|
-
Ahmad Ben Mrad <batikhsouri at gmail dot org>
|
|
289
|
-
Frank Denis <j at pureftpd dot org>
|
|
290
|
-
Ryan Lester <ryan at cyph dot com>
|
|
291
|
-
|
|
292
|
-
Permission to use, copy, modify, and/or distribute this software for any
|
|
293
|
-
purpose with or without fee is hereby granted, provided that the above
|
|
294
|
-
copyright notice and this permission notice appear in all copies.
|
|
295
|
-
|
|
296
|
-
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
297
|
-
WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
298
|
-
MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
299
|
-
ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
300
|
-
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
301
|
-
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
302
|
-
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
303
|
-
|
|
304
|
-
ink@7.1.1 (MIT)
|
|
305
|
-
MIT License
|
|
306
|
-
|
|
307
|
-
Copyright (c) Vadym Demedes <vadimdemedes@hey.com> (https://github.com/vadimdemedes)
|
|
308
|
-
Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
|
|
309
|
-
|
|
310
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
|
|
311
|
-
|
|
312
|
-
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
|
|
313
|
-
|
|
314
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
|
|
315
|
-
|
|
316
|
-
react@19.2.8 (MIT)
|
|
317
|
-
MIT License
|
|
318
|
-
|
|
319
|
-
Copyright (c) Meta Platforms, Inc. and affiliates.
|
|
320
|
-
|
|
321
|
-
Permission is hereby granted, free of charge, to any person obtaining a copy
|
|
322
|
-
of this software and associated documentation files (the "Software"), to deal
|
|
323
|
-
in the Software without restriction, including without limitation the rights
|
|
324
|
-
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
|
325
|
-
copies of the Software, and to permit persons to whom the Software is
|
|
326
|
-
furnished to do so, subject to the following conditions:
|
|
327
|
-
|
|
328
|
-
The above copyright notice and this permission notice shall be included in all
|
|
329
|
-
copies or substantial portions of the Software.
|
|
330
|
-
|
|
331
|
-
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
|
332
|
-
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
333
|
-
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
|
334
|
-
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
|
335
|
-
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
|
336
|
-
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
|
337
|
-
SOFTWARE.
|
|
338
|
-
|
|
339
|
-
smol-toml@1.3.1 (BSD-3-Clause)
|
|
340
|
-
Copyright (c) Squirrel Chat et al., All rights reserved.
|
|
341
|
-
|
|
342
|
-
Redistribution and use in source and binary forms, with or without
|
|
343
|
-
modification, are permitted provided that the following conditions are met:
|
|
344
|
-
|
|
345
|
-
1. Redistributions of source code must retain the above copyright notice, this
|
|
346
|
-
list of conditions and the following disclaimer.
|
|
347
|
-
2. Redistributions in binary form must reproduce the above copyright notice,
|
|
348
|
-
this list of conditions and the following disclaimer in the
|
|
349
|
-
documentation and/or other materials provided with the distribution.
|
|
350
|
-
3. Neither the name of the copyright holder nor the names of its contributors
|
|
351
|
-
may be used to endorse or promote products derived from this software without
|
|
352
|
-
specific prior written permission.
|
|
353
|
-
|
|
354
|
-
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
|
|
355
|
-
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
|
|
356
|
-
WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
357
|
-
DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
|
|
358
|
-
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
359
|
-
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
|
|
360
|
-
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
|
|
361
|
-
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
|
|
362
|
-
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
|
|
363
|
-
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
364
|
-
*/
|
|
365
|
-
import { createRequire as __kavrixCreateRequire } from 'node:module';
|
|
366
|
-
const __kavrixNodeRequire = __kavrixCreateRequire(import.meta.url);
|
|
367
|
-
const __kavrixNodeBuiltin = (name) => __kavrixNodeRequire(`node:${name}`);
|
|
368
|
-
import {
|
|
369
|
-
external_exports
|
|
370
|
-
} from "./chunk-D4JYLAAS.js";
|
|
371
|
-
|
|
372
|
-
// ../../packages/schemas/dist/identifiers.js
|
|
373
|
-
var MIN_OPAQUE_ID_CHARS = 1;
|
|
374
|
-
var MAX_OPAQUE_ID_CHARS = 128;
|
|
375
|
-
var OPAQUE_ID_PATTERN_SOURCE = "^[A-Za-z0-9][A-Za-z0-9._~-]*$";
|
|
376
|
-
var opaqueIdPattern = new RegExp(OPAQUE_ID_PATTERN_SOURCE);
|
|
377
|
-
var opaqueId = external_exports.string().min(MIN_OPAQUE_ID_CHARS).max(MAX_OPAQUE_ID_CHARS).regex(opaqueIdPattern, "Must be an opaque identifier");
|
|
378
|
-
var vaultIdSchema = opaqueId.brand();
|
|
379
|
-
var databaseIdSchema = opaqueId.brand();
|
|
380
|
-
var profileIdSchema = opaqueId.brand();
|
|
381
|
-
var keySlotIdSchema = opaqueId.brand();
|
|
382
|
-
var groupIdSchema = opaqueId.brand();
|
|
383
|
-
var itemIdSchema = opaqueId.brand();
|
|
384
|
-
var fieldIdSchema = opaqueId.brand();
|
|
385
|
-
var noteIdSchema = opaqueId.brand();
|
|
386
|
-
var templateIdSchema = opaqueId.brand();
|
|
387
|
-
var templateMigrationIdSchema = opaqueId.brand();
|
|
388
|
-
var deviceIdSchema = opaqueId.brand();
|
|
389
|
-
var changeIdSchema = opaqueId.brand();
|
|
390
|
-
var auditEventIdSchema = opaqueId.brand();
|
|
391
|
-
var attachmentIdSchema = opaqueId.brand();
|
|
392
|
-
var historyIdSchema = opaqueId.brand();
|
|
393
|
-
var inviteIdSchema = opaqueId.brand();
|
|
394
|
-
var policyIdSchema = opaqueId.brand();
|
|
395
|
-
var grantIdSchema = opaqueId.brand();
|
|
396
|
-
|
|
397
|
-
// ../../packages/schemas/dist/primitives.js
|
|
398
|
-
var MAX_TEXT_BYTES = 1048576;
|
|
399
|
-
var MAX_CIPHERTEXT_CHARS = 22369632;
|
|
400
|
-
var MAX_SEMANTIC_VERSION = 4294967295;
|
|
401
|
-
var MAX_SEMANTIC_REVISION = Number.MAX_SAFE_INTEGER;
|
|
402
|
-
var textEncoder = new TextEncoder();
|
|
403
|
-
function utf8ByteLength(value) {
|
|
404
|
-
return textEncoder.encode(value).byteLength;
|
|
405
|
-
}
|
|
406
|
-
var maxTextBytesSchema = external_exports.string().superRefine((value, context) => {
|
|
407
|
-
if (value.length > MAX_TEXT_BYTES || utf8ByteLength(value) > MAX_TEXT_BYTES) {
|
|
408
|
-
context.addIssue({
|
|
409
|
-
code: "too_big",
|
|
410
|
-
origin: "string",
|
|
411
|
-
maximum: MAX_TEXT_BYTES,
|
|
412
|
-
inclusive: true,
|
|
413
|
-
message: `Too big: expected string to have <=${String(MAX_TEXT_BYTES)} bytes`
|
|
414
|
-
});
|
|
415
|
-
}
|
|
416
|
-
});
|
|
417
|
-
var CURRENT_SCHEMA_VERSION = 1;
|
|
418
|
-
var SUPPORTED_SCHEMA_VERSIONS = Object.freeze([
|
|
419
|
-
CURRENT_SCHEMA_VERSION
|
|
420
|
-
]);
|
|
421
|
-
var CURRENT_CRYPTOGRAPHIC_VERSION = 1;
|
|
422
|
-
var SUPPORTED_CRYPTOGRAPHIC_VERSIONS = Object.freeze([
|
|
423
|
-
CURRENT_CRYPTOGRAPHIC_VERSION
|
|
424
|
-
]);
|
|
425
|
-
var CURRENT_TOKEN_VERSION = 1;
|
|
426
|
-
var SUPPORTED_TOKEN_VERSIONS = Object.freeze([CURRENT_TOKEN_VERSION]);
|
|
427
|
-
var CANONICAL_BASE64URL_PATTERN_SOURCE = "^(?:[A-Za-z0-9_-]{4})*(?:[A-Za-z0-9_-][AQgw]|[A-Za-z0-9_-]{2}[AEIMQUYcgkosw048])?$";
|
|
428
|
-
var CANONICAL_TIMESTAMP_CHARS = 24;
|
|
429
|
-
var CANONICAL_TIMESTAMP_PATTERN_SOURCE = "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}\\.[0-9]{3}Z$";
|
|
430
|
-
var SHA256_DIGEST_BASE64URL_CHARS = 43;
|
|
431
|
-
var canonicalBase64UrlPattern = new RegExp(CANONICAL_BASE64URL_PATTERN_SOURCE);
|
|
432
|
-
var canonicalTimestampPattern = new RegExp(CANONICAL_TIMESTAMP_PATTERN_SOURCE);
|
|
433
|
-
function hasCanonicalBase64UrlTerminalBits(value) {
|
|
434
|
-
if (value.length === 0)
|
|
435
|
-
return false;
|
|
436
|
-
const remainder = value.length % 4;
|
|
437
|
-
if (remainder === 1)
|
|
438
|
-
return false;
|
|
439
|
-
const tailLength = remainder === 0 ? Math.min(value.length, 4) : remainder;
|
|
440
|
-
return canonicalBase64UrlPattern.test(value.slice(-tailLength));
|
|
441
|
-
}
|
|
442
|
-
var timestampSchema = external_exports.iso.datetime({ offset: false, precision: 3 }).length(CANONICAL_TIMESTAMP_CHARS).regex(canonicalTimestampPattern);
|
|
443
|
-
var revisionSchema = external_exports.number().int().nonnegative().brand();
|
|
444
|
-
var positiveVersionSchema = external_exports.number().int().positive().max(MAX_SEMANTIC_VERSION).brand();
|
|
445
|
-
var semanticVersionSchema = external_exports.number().int().positive().max(MAX_SEMANTIC_VERSION);
|
|
446
|
-
var semanticRevisionSchema = external_exports.number().int().nonnegative().max(MAX_SEMANTIC_REVISION);
|
|
447
|
-
var schemaVersionSchema = semanticVersionSchema.brand();
|
|
448
|
-
var keyVersionSchema = semanticVersionSchema.brand();
|
|
449
|
-
var templateVersionSchema = semanticVersionSchema.brand();
|
|
450
|
-
var tokenVersionSchema = semanticVersionSchema.brand();
|
|
451
|
-
var cryptographicVersionSchema = semanticVersionSchema.brand();
|
|
452
|
-
var supportedSchemaVersionSchema = schemaVersionSchema.refine((value) => SUPPORTED_SCHEMA_VERSIONS.some((supported) => value === supported), { error: "Unsupported schema version" });
|
|
453
|
-
var supportedCryptographicVersionSchema = cryptographicVersionSchema.refine((value) => SUPPORTED_CRYPTOGRAPHIC_VERSIONS.some((supported) => value === supported), { error: "Unsupported cryptographic version" });
|
|
454
|
-
var supportedTokenVersionSchema = tokenVersionSchema.refine((value) => SUPPORTED_TOKEN_VERSIONS.some((supported) => value === supported), { error: "Unsupported token version" });
|
|
455
|
-
var recordRevisionSchema = semanticRevisionSchema.brand();
|
|
456
|
-
var vaultRevisionSchema = semanticRevisionSchema.brand();
|
|
457
|
-
var changeSequenceSchema = semanticRevisionSchema.brand();
|
|
458
|
-
var envelopeVersionSchema = external_exports.literal(1).brand();
|
|
459
|
-
var associatedDataVersionSchema = external_exports.literal(1).brand();
|
|
460
|
-
var keySlotVersionSchema = external_exports.literal(1).brand();
|
|
461
|
-
var sortOrderSchema = external_exports.number().int().nonnegative();
|
|
462
|
-
var nonEmptyTextSchema = external_exports.string().trim().min(1).max(256);
|
|
463
|
-
var encryptedTextSchema = maxTextBytesSchema;
|
|
464
|
-
var secretValueSchema = maxTextBytesSchema.brand();
|
|
465
|
-
var secretBytesSchema = external_exports.instanceof(Uint8Array).refine((value) => value.byteLength > 0 && value.byteLength <= MAX_TEXT_BYTES, {
|
|
466
|
-
error: "Secret byte length is outside the supported range"
|
|
467
|
-
}).brand();
|
|
468
|
-
var base64UrlSchema = external_exports.string().min(1).max(MAX_CIPHERTEXT_CHARS).regex(/^[A-Za-z0-9_-]+$/, "Must use unpadded base64url encoding").refine(hasCanonicalBase64UrlTerminalBits, {
|
|
469
|
-
error: "Must use canonical unpadded base64url encoding"
|
|
470
|
-
}).refine((value) => Buffer.from(value, "base64url").toString("base64url") === value, {
|
|
471
|
-
error: "Must use canonical unpadded base64url encoding"
|
|
472
|
-
});
|
|
473
|
-
var sha256DigestSchema = base64UrlSchema.length(SHA256_DIGEST_BASE64URL_CHARS).refine((value) => Buffer.from(value, "base64url").byteLength === 32, {
|
|
474
|
-
error: "SHA-256 digests must canonically encode exactly 32 bytes"
|
|
475
|
-
}).brand();
|
|
476
|
-
var slugSchema = external_exports.string().trim().min(1).max(128).regex(/^[\p{L}\p{N}](?:[\p{L}\p{N}._~-]|-(?!-))*$/u, "Invalid slug");
|
|
477
|
-
|
|
478
|
-
// ../../packages/schemas/dist/encrypted-records.js
|
|
479
|
-
var encryptedEntityTypeSchema = external_exports.enum([
|
|
480
|
-
"vault-preferences",
|
|
481
|
-
"group",
|
|
482
|
-
"item",
|
|
483
|
-
"attachment",
|
|
484
|
-
"attachment-chunk",
|
|
485
|
-
"audit-event",
|
|
486
|
-
"history",
|
|
487
|
-
"device-label",
|
|
488
|
-
"wrapped-root-key",
|
|
489
|
-
"wrapped-group-key",
|
|
490
|
-
"wrapped-item-key",
|
|
491
|
-
"wrapped-attachment-key"
|
|
492
|
-
]);
|
|
493
|
-
var encryptedPayloadPurposeSchema = external_exports.enum([
|
|
494
|
-
"vault-preferences",
|
|
495
|
-
"group-payload",
|
|
496
|
-
"item-payload",
|
|
497
|
-
"attachment-metadata",
|
|
498
|
-
"attachment-chunk",
|
|
499
|
-
"audit-event",
|
|
500
|
-
"history-event",
|
|
501
|
-
"device-label",
|
|
502
|
-
"vrk-slot",
|
|
503
|
-
"group-key",
|
|
504
|
-
"item-key",
|
|
505
|
-
"attachment-key"
|
|
506
|
-
]);
|
|
507
|
-
var AEAD_NONCE_BASE64URL_CHARS = 32;
|
|
508
|
-
var AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS = 22;
|
|
509
|
-
var associatedDataBaseSchema = external_exports.object({
|
|
510
|
-
version: associatedDataVersionSchema,
|
|
511
|
-
schemaVersion: schemaVersionSchema,
|
|
512
|
-
keyVersion: keyVersionSchema,
|
|
513
|
-
vaultId: vaultIdSchema,
|
|
514
|
-
revision: vaultRevisionSchema.optional(),
|
|
515
|
-
metadataDigest: sha256DigestSchema.optional()
|
|
516
|
-
}).strict();
|
|
517
|
-
var unboundAssociatedData = {
|
|
518
|
-
groupId: external_exports.undefined().optional(),
|
|
519
|
-
parentId: external_exports.undefined().optional()
|
|
520
|
-
};
|
|
521
|
-
var associatedDataSchema = external_exports.discriminatedUnion("entityType", [
|
|
522
|
-
associatedDataBaseSchema.extend({
|
|
523
|
-
entityType: external_exports.literal("vault-preferences"),
|
|
524
|
-
entityId: vaultIdSchema,
|
|
525
|
-
purpose: external_exports.literal("vault-preferences"),
|
|
526
|
-
...unboundAssociatedData
|
|
527
|
-
}),
|
|
528
|
-
associatedDataBaseSchema.extend({
|
|
529
|
-
entityType: external_exports.literal("group"),
|
|
530
|
-
entityId: groupIdSchema,
|
|
531
|
-
purpose: external_exports.literal("group-payload"),
|
|
532
|
-
...unboundAssociatedData
|
|
533
|
-
}),
|
|
534
|
-
associatedDataBaseSchema.extend({
|
|
535
|
-
entityType: external_exports.literal("item"),
|
|
536
|
-
entityId: itemIdSchema,
|
|
537
|
-
purpose: external_exports.literal("item-payload"),
|
|
538
|
-
groupId: groupIdSchema,
|
|
539
|
-
parentId: external_exports.undefined().optional()
|
|
540
|
-
}),
|
|
541
|
-
associatedDataBaseSchema.extend({
|
|
542
|
-
entityType: external_exports.literal("attachment"),
|
|
543
|
-
entityId: attachmentIdSchema,
|
|
544
|
-
purpose: external_exports.literal("attachment-metadata"),
|
|
545
|
-
groupId: groupIdSchema,
|
|
546
|
-
parentId: itemIdSchema
|
|
547
|
-
}),
|
|
548
|
-
associatedDataBaseSchema.extend({
|
|
549
|
-
entityType: external_exports.literal("attachment-chunk"),
|
|
550
|
-
entityId: attachmentIdSchema,
|
|
551
|
-
purpose: external_exports.literal("attachment-chunk"),
|
|
552
|
-
groupId: groupIdSchema,
|
|
553
|
-
parentId: itemIdSchema
|
|
554
|
-
}),
|
|
555
|
-
associatedDataBaseSchema.extend({
|
|
556
|
-
entityType: external_exports.literal("audit-event"),
|
|
557
|
-
entityId: auditEventIdSchema,
|
|
558
|
-
purpose: external_exports.literal("audit-event"),
|
|
559
|
-
...unboundAssociatedData
|
|
560
|
-
}),
|
|
561
|
-
associatedDataBaseSchema.extend({
|
|
562
|
-
entityType: external_exports.literal("history"),
|
|
563
|
-
entityId: historyIdSchema,
|
|
564
|
-
purpose: external_exports.literal("history-event"),
|
|
565
|
-
groupId: groupIdSchema,
|
|
566
|
-
parentId: itemIdSchema
|
|
567
|
-
}),
|
|
568
|
-
associatedDataBaseSchema.extend({
|
|
569
|
-
entityType: external_exports.literal("device-label"),
|
|
570
|
-
entityId: deviceIdSchema,
|
|
571
|
-
purpose: external_exports.literal("device-label"),
|
|
572
|
-
...unboundAssociatedData
|
|
573
|
-
}),
|
|
574
|
-
associatedDataBaseSchema.extend({
|
|
575
|
-
entityType: external_exports.literal("wrapped-root-key"),
|
|
576
|
-
entityId: keySlotIdSchema,
|
|
577
|
-
purpose: external_exports.literal("vrk-slot"),
|
|
578
|
-
...unboundAssociatedData
|
|
579
|
-
}),
|
|
580
|
-
associatedDataBaseSchema.extend({
|
|
581
|
-
entityType: external_exports.literal("wrapped-group-key"),
|
|
582
|
-
entityId: groupIdSchema,
|
|
583
|
-
purpose: external_exports.literal("group-key"),
|
|
584
|
-
...unboundAssociatedData
|
|
585
|
-
}),
|
|
586
|
-
associatedDataBaseSchema.extend({
|
|
587
|
-
entityType: external_exports.literal("wrapped-item-key"),
|
|
588
|
-
entityId: itemIdSchema,
|
|
589
|
-
purpose: external_exports.literal("item-key"),
|
|
590
|
-
groupId: groupIdSchema,
|
|
591
|
-
parentId: external_exports.undefined().optional()
|
|
592
|
-
}),
|
|
593
|
-
associatedDataBaseSchema.extend({
|
|
594
|
-
entityType: external_exports.literal("wrapped-attachment-key"),
|
|
595
|
-
entityId: attachmentIdSchema,
|
|
596
|
-
purpose: external_exports.literal("attachment-key"),
|
|
597
|
-
groupId: groupIdSchema,
|
|
598
|
-
parentId: itemIdSchema
|
|
599
|
-
})
|
|
600
|
-
]);
|
|
601
|
-
var currentAssociatedDataSchema = associatedDataSchema.superRefine((associatedData, context) => {
|
|
602
|
-
if (!supportedSchemaVersionSchema.safeParse(associatedData.schemaVersion).success) {
|
|
603
|
-
context.addIssue({
|
|
604
|
-
code: "custom",
|
|
605
|
-
message: "Current envelopes require a supported schema version",
|
|
606
|
-
path: ["schemaVersion"]
|
|
607
|
-
});
|
|
608
|
-
}
|
|
609
|
-
});
|
|
610
|
-
var aeadEnvelopeSchema = external_exports.object({
|
|
611
|
-
version: envelopeVersionSchema,
|
|
612
|
-
algorithm: external_exports.literal("xchacha20-poly1305-ietf"),
|
|
613
|
-
nonce: base64UrlSchema,
|
|
614
|
-
ciphertext: base64UrlSchema,
|
|
615
|
-
authenticationTag: base64UrlSchema,
|
|
616
|
-
aad: currentAssociatedDataSchema,
|
|
617
|
-
keyVersion: keyVersionSchema
|
|
618
|
-
}).strict().superRefine((envelope, context) => {
|
|
619
|
-
if (envelope.nonce.length !== AEAD_NONCE_BASE64URL_CHARS) {
|
|
620
|
-
context.addIssue({
|
|
621
|
-
code: "custom",
|
|
622
|
-
message: "Nonce length does not match the authenticated-encryption algorithm",
|
|
623
|
-
path: ["nonce"]
|
|
624
|
-
});
|
|
625
|
-
}
|
|
626
|
-
if (envelope.authenticationTag.length !== AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS) {
|
|
627
|
-
context.addIssue({
|
|
628
|
-
code: "custom",
|
|
629
|
-
message: "Authentication tag must encode 16 bytes",
|
|
630
|
-
path: ["authenticationTag"]
|
|
631
|
-
});
|
|
632
|
-
}
|
|
633
|
-
if (envelope.keyVersion !== envelope.aad.keyVersion) {
|
|
634
|
-
context.addIssue({
|
|
635
|
-
code: "custom",
|
|
636
|
-
message: "Envelope key version must be authenticated in associated data",
|
|
637
|
-
path: ["keyVersion"]
|
|
638
|
-
});
|
|
639
|
-
}
|
|
640
|
-
});
|
|
641
|
-
var MAX_ENCRYPTED_DEVICE_LABEL_CIPHERTEXT_CHARS = 4096;
|
|
642
|
-
var encryptedDeviceLabelSchema = aeadEnvelopeSchema.superRefine((envelope, context) => {
|
|
643
|
-
if (envelope.ciphertext.length > MAX_ENCRYPTED_DEVICE_LABEL_CIPHERTEXT_CHARS) {
|
|
644
|
-
context.addIssue({
|
|
645
|
-
code: "custom",
|
|
646
|
-
message: "Encrypted device-label ciphertext exceeds the canonical bound",
|
|
647
|
-
path: ["ciphertext"]
|
|
648
|
-
});
|
|
649
|
-
}
|
|
650
|
-
if (envelope.aad.entityType !== "device-label") {
|
|
651
|
-
context.addIssue({
|
|
652
|
-
code: "custom",
|
|
653
|
-
message: "Encrypted device labels require device-label associated data",
|
|
654
|
-
path: ["aad"]
|
|
655
|
-
});
|
|
656
|
-
}
|
|
657
|
-
});
|
|
658
|
-
var MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES = 8 * 1024 * 1024;
|
|
659
|
-
var SECRETSTREAM_CHUNK_OVERHEAD_BYTES = 17;
|
|
660
|
-
var MAX_ATTACHMENT_CHUNKS = 1e6;
|
|
661
|
-
var MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES = 4 * 1024 * 1024 * 1024;
|
|
662
|
-
var MAX_ATTACHMENT_CHUNK_CIPHERTEXT_BYTES = MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES + SECRETSTREAM_CHUNK_OVERHEAD_BYTES;
|
|
663
|
-
var MAX_ATTACHMENT_STREAM_CIPHERTEXT_BYTES = MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES + MAX_ATTACHMENT_CHUNKS * SECRETSTREAM_CHUNK_OVERHEAD_BYTES;
|
|
664
|
-
var SECRETSTREAM_HEADER_BASE64URL_CHARS = 32;
|
|
665
|
-
var MIN_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS = Math.ceil(SECRETSTREAM_CHUNK_OVERHEAD_BYTES * 4 / 3);
|
|
666
|
-
var MAX_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS = Math.ceil(MAX_ATTACHMENT_CHUNK_CIPHERTEXT_BYTES * 4 / 3);
|
|
667
|
-
var secretStreamHeaderSchema = base64UrlSchema.length(SECRETSTREAM_HEADER_BASE64URL_CHARS).refine((value) => Buffer.from(value, "base64url").byteLength === 24, {
|
|
668
|
-
error: "Secretstream headers must canonically encode exactly 24 bytes"
|
|
669
|
-
});
|
|
670
|
-
var attachmentChunkCiphertextSchema = base64UrlSchema.min(MIN_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS).max(MAX_ATTACHMENT_CHUNK_CIPHERTEXT_CHARS).refine((value) => {
|
|
671
|
-
const byteLength = Buffer.from(value, "base64url").byteLength;
|
|
672
|
-
return byteLength >= SECRETSTREAM_CHUNK_OVERHEAD_BYTES && byteLength <= MAX_ATTACHMENT_CHUNK_CIPHERTEXT_BYTES;
|
|
673
|
-
}, { error: "Attachment chunk ciphertext is outside the canonical byte bounds" }).brand();
|
|
674
|
-
var attachmentSecretStreamIdentitySchema = external_exports.object({
|
|
675
|
-
version: external_exports.literal(1),
|
|
676
|
-
algorithm: external_exports.literal("secretstream-xchacha20-poly1305"),
|
|
677
|
-
streamVersion: external_exports.literal(1),
|
|
678
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
679
|
-
keyVersion: keyVersionSchema,
|
|
680
|
-
vaultId: vaultIdSchema,
|
|
681
|
-
groupId: groupIdSchema,
|
|
682
|
-
itemId: itemIdSchema,
|
|
683
|
-
attachmentId: attachmentIdSchema
|
|
684
|
-
});
|
|
685
|
-
var attachmentSecretStreamHeaderRecordSchema = attachmentSecretStreamIdentitySchema.extend({
|
|
686
|
-
recordType: external_exports.literal("header"),
|
|
687
|
-
header: secretStreamHeaderSchema
|
|
688
|
-
}).strict();
|
|
689
|
-
var attachmentSecretStreamChunkRecordSchema = attachmentSecretStreamIdentitySchema.extend({
|
|
690
|
-
recordType: external_exports.literal("chunk"),
|
|
691
|
-
index: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS - 1),
|
|
692
|
-
ciphertext: attachmentChunkCiphertextSchema,
|
|
693
|
-
tag: external_exports.enum(["message", "final"])
|
|
694
|
-
}).strict();
|
|
695
|
-
var attachmentSecretStreamRecordSchema = external_exports.discriminatedUnion("recordType", [
|
|
696
|
-
attachmentSecretStreamHeaderRecordSchema,
|
|
697
|
-
attachmentSecretStreamChunkRecordSchema
|
|
698
|
-
]);
|
|
699
|
-
var persistedAttachmentHeaderRecordSchema = external_exports.object({
|
|
700
|
-
entityType: external_exports.literal("attachment-header"),
|
|
701
|
-
record: attachmentSecretStreamHeaderRecordSchema,
|
|
702
|
-
recordRevision: recordRevisionSchema,
|
|
703
|
-
contentHash: sha256DigestSchema,
|
|
704
|
-
createdAt: timestampSchema,
|
|
705
|
-
updatedAt: timestampSchema
|
|
706
|
-
}).strict();
|
|
707
|
-
var persistedAttachmentChunkRecordSchema = external_exports.object({
|
|
708
|
-
entityType: external_exports.literal("attachment-chunk"),
|
|
709
|
-
record: attachmentSecretStreamChunkRecordSchema,
|
|
710
|
-
plaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES),
|
|
711
|
-
recordRevision: recordRevisionSchema,
|
|
712
|
-
ciphertextHash: sha256DigestSchema,
|
|
713
|
-
createdAt: timestampSchema,
|
|
714
|
-
updatedAt: timestampSchema
|
|
715
|
-
}).strict().superRefine((chunk, context) => {
|
|
716
|
-
const ciphertextBytes = Buffer.from(chunk.record.ciphertext, "base64url").byteLength;
|
|
717
|
-
if (ciphertextBytes !== chunk.plaintextBytes + SECRETSTREAM_CHUNK_OVERHEAD_BYTES) {
|
|
718
|
-
context.addIssue({
|
|
719
|
-
code: "custom",
|
|
720
|
-
message: "Chunk ciphertext length must equal plaintext plus stream overhead",
|
|
721
|
-
path: ["plaintextBytes"]
|
|
722
|
-
});
|
|
723
|
-
}
|
|
724
|
-
});
|
|
725
|
-
var attachmentSecretStreamManifestSchema = attachmentSecretStreamIdentitySchema.extend({
|
|
726
|
-
manifestVersion: external_exports.literal(1),
|
|
727
|
-
header: secretStreamHeaderSchema,
|
|
728
|
-
chunkCount: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
|
|
729
|
-
totalPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES),
|
|
730
|
-
plaintextSha256: sha256DigestSchema
|
|
731
|
-
}).strict();
|
|
732
|
-
var HKDF_SALT_BASE64URL_CHARS = 43;
|
|
733
|
-
var ARGON2ID_SALT_BASE64URL_CHARS = 22;
|
|
734
|
-
var KEY_DERIVATION_OUTPUT_BYTES = 32;
|
|
735
|
-
var MIN_ARGON2_MEMORY_KIB = 65536;
|
|
736
|
-
var MAX_ARGON2_MEMORY_KIB = 1048576;
|
|
737
|
-
var MIN_ARGON2_PASSES = 3;
|
|
738
|
-
var MAX_ARGON2_PASSES = 64;
|
|
739
|
-
var MIN_ARGON2_PARALLELISM = 4;
|
|
740
|
-
var MAX_ARGON2_PARALLELISM = 32;
|
|
741
|
-
var MAX_DEVICE_KEY_PROVIDER_CHARS = 128;
|
|
742
|
-
var hkdfSaltSchema = base64UrlSchema.length(HKDF_SALT_BASE64URL_CHARS);
|
|
743
|
-
var argon2idSaltSchema = base64UrlSchema.length(ARGON2ID_SALT_BASE64URL_CHARS);
|
|
744
|
-
var portableKeyDerivationSchema = external_exports.object({
|
|
745
|
-
algorithm: external_exports.literal("hkdf-sha256"),
|
|
746
|
-
version: external_exports.literal(1),
|
|
747
|
-
salt: hkdfSaltSchema,
|
|
748
|
-
context: external_exports.literal("credvault/v1/portable-key-wrap"),
|
|
749
|
-
outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES)
|
|
750
|
-
}).strict();
|
|
751
|
-
var passphraseDerivationSchema = external_exports.object({
|
|
752
|
-
algorithm: external_exports.literal("argon2id"),
|
|
753
|
-
version: external_exports.literal(1),
|
|
754
|
-
salt: argon2idSaltSchema,
|
|
755
|
-
memoryKiB: external_exports.number().int().min(MIN_ARGON2_MEMORY_KIB).max(MAX_ARGON2_MEMORY_KIB),
|
|
756
|
-
passes: external_exports.number().int().min(MIN_ARGON2_PASSES).max(MAX_ARGON2_PASSES),
|
|
757
|
-
parallelism: external_exports.number().int().min(MIN_ARGON2_PARALLELISM).max(MAX_ARGON2_PARALLELISM),
|
|
758
|
-
outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES)
|
|
759
|
-
}).strict();
|
|
760
|
-
var recoveryKeyDerivationSchema = external_exports.object({
|
|
761
|
-
algorithm: external_exports.literal("hkdf-sha256"),
|
|
762
|
-
version: external_exports.literal(1),
|
|
763
|
-
salt: hkdfSaltSchema,
|
|
764
|
-
context: external_exports.literal("credvault/v1/recovery-key-wrap"),
|
|
765
|
-
outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES)
|
|
766
|
-
}).strict();
|
|
767
|
-
var deviceKeyDerivationSchema = external_exports.object({
|
|
768
|
-
algorithm: external_exports.literal("hkdf-sha256"),
|
|
769
|
-
version: external_exports.literal(1),
|
|
770
|
-
salt: hkdfSaltSchema,
|
|
771
|
-
context: external_exports.literal("credvault/v1/device-key-wrap"),
|
|
772
|
-
outputLength: external_exports.literal(KEY_DERIVATION_OUTPUT_BYTES),
|
|
773
|
-
provider: external_exports.string().min(1).max(MAX_DEVICE_KEY_PROVIDER_CHARS)
|
|
774
|
-
}).strict();
|
|
775
|
-
var MIN_VAULT_KEY_SLOTS = 1;
|
|
776
|
-
var MAX_VAULT_KEY_SLOTS = 128;
|
|
777
|
-
var keySlotBaseSchema = external_exports.object({
|
|
778
|
-
slotVersion: keySlotVersionSchema,
|
|
779
|
-
id: keySlotIdSchema,
|
|
780
|
-
state: external_exports.enum(["pending", "active", "superseded", "revoked"]),
|
|
781
|
-
keyVersion: keyVersionSchema,
|
|
782
|
-
wrappedRootKey: aeadEnvelopeSchema,
|
|
783
|
-
createdAt: timestampSchema,
|
|
784
|
-
supersededAt: timestampSchema.optional(),
|
|
785
|
-
revokedAt: timestampSchema.optional()
|
|
786
|
-
});
|
|
787
|
-
var keySlotSchema = external_exports.discriminatedUnion("type", [
|
|
788
|
-
keySlotBaseSchema.extend({
|
|
789
|
-
type: external_exports.literal("portable-key"),
|
|
790
|
-
derivation: portableKeyDerivationSchema
|
|
791
|
-
}).strict(),
|
|
792
|
-
keySlotBaseSchema.extend({
|
|
793
|
-
type: external_exports.literal("passphrase"),
|
|
794
|
-
derivation: passphraseDerivationSchema
|
|
795
|
-
}).strict(),
|
|
796
|
-
keySlotBaseSchema.extend({
|
|
797
|
-
type: external_exports.literal("recovery-key"),
|
|
798
|
-
derivation: recoveryKeyDerivationSchema
|
|
799
|
-
}).strict(),
|
|
800
|
-
keySlotBaseSchema.extend({
|
|
801
|
-
type: external_exports.literal("device-key"),
|
|
802
|
-
derivation: deviceKeyDerivationSchema,
|
|
803
|
-
deviceId: deviceIdSchema
|
|
804
|
-
}).strict()
|
|
805
|
-
]).superRefine((slot, context) => {
|
|
806
|
-
if (slot.wrappedRootKey.aad.entityType !== "wrapped-root-key") {
|
|
807
|
-
context.addIssue({
|
|
808
|
-
code: "custom",
|
|
809
|
-
message: "Key slot envelope must be bound as a wrapped root key",
|
|
810
|
-
path: ["wrappedRootKey", "aad", "entityType"]
|
|
811
|
-
});
|
|
812
|
-
}
|
|
813
|
-
if (slot.wrappedRootKey.aad.entityId !== slot.id) {
|
|
814
|
-
context.addIssue({
|
|
815
|
-
code: "custom",
|
|
816
|
-
message: "Key slot envelope is bound to a different slot",
|
|
817
|
-
path: ["wrappedRootKey", "aad", "entityId"]
|
|
818
|
-
});
|
|
819
|
-
}
|
|
820
|
-
if (slot.wrappedRootKey.keyVersion !== slot.keyVersion) {
|
|
821
|
-
context.addIssue({
|
|
822
|
-
code: "custom",
|
|
823
|
-
message: "Wrapped root-key version does not match its slot",
|
|
824
|
-
path: ["wrappedRootKey", "keyVersion"]
|
|
825
|
-
});
|
|
826
|
-
}
|
|
827
|
-
if (slot.state === "revoked" && slot.revokedAt === void 0) {
|
|
828
|
-
context.addIssue({
|
|
829
|
-
code: "custom",
|
|
830
|
-
message: "Revoked slots require a timestamp",
|
|
831
|
-
path: ["revokedAt"]
|
|
832
|
-
});
|
|
833
|
-
}
|
|
834
|
-
if (slot.state !== "revoked" && slot.revokedAt !== void 0) {
|
|
835
|
-
context.addIssue({
|
|
836
|
-
code: "custom",
|
|
837
|
-
message: "Only revoked slots may have a revoked timestamp",
|
|
838
|
-
path: ["revokedAt"]
|
|
839
|
-
});
|
|
840
|
-
}
|
|
841
|
-
if (slot.state === "superseded" && slot.supersededAt === void 0) {
|
|
842
|
-
context.addIssue({
|
|
843
|
-
code: "custom",
|
|
844
|
-
message: "Superseded slots require a timestamp",
|
|
845
|
-
path: ["supersededAt"]
|
|
846
|
-
});
|
|
847
|
-
}
|
|
848
|
-
if (slot.state !== "superseded" && slot.supersededAt !== void 0) {
|
|
849
|
-
context.addIssue({
|
|
850
|
-
code: "custom",
|
|
851
|
-
message: "Only superseded slots may have a superseded timestamp",
|
|
852
|
-
path: ["supersededAt"]
|
|
853
|
-
});
|
|
854
|
-
}
|
|
855
|
-
});
|
|
856
|
-
var vaultRecordSchema = external_exports.object({
|
|
857
|
-
id: vaultIdSchema,
|
|
858
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
859
|
-
cryptographicVersion: supportedCryptographicVersionSchema,
|
|
860
|
-
keySlots: external_exports.array(keySlotSchema).min(MIN_VAULT_KEY_SLOTS).max(MAX_VAULT_KEY_SLOTS),
|
|
861
|
-
currentKeyVersion: keyVersionSchema,
|
|
862
|
-
revision: vaultRevisionSchema,
|
|
863
|
-
encryptedPreferences: aeadEnvelopeSchema,
|
|
864
|
-
createdAt: timestampSchema,
|
|
865
|
-
updatedAt: timestampSchema
|
|
866
|
-
}).strict().superRefine((vault, context) => {
|
|
867
|
-
const ids = /* @__PURE__ */ new Set();
|
|
868
|
-
for (const [index, slot] of vault.keySlots.entries()) {
|
|
869
|
-
if (slot.wrappedRootKey.aad.vaultId !== vault.id) {
|
|
870
|
-
context.addIssue({
|
|
871
|
-
code: "custom",
|
|
872
|
-
message: "Key slot belongs to a different vault",
|
|
873
|
-
path: ["keySlots", index, "wrappedRootKey", "aad", "vaultId"]
|
|
874
|
-
});
|
|
875
|
-
}
|
|
876
|
-
if (slot.wrappedRootKey.aad.schemaVersion !== vault.schemaVersion) {
|
|
877
|
-
context.addIssue({
|
|
878
|
-
code: "custom",
|
|
879
|
-
message: "Key slot schema version does not match its vault",
|
|
880
|
-
path: ["keySlots", index, "wrappedRootKey", "aad", "schemaVersion"]
|
|
881
|
-
});
|
|
882
|
-
}
|
|
883
|
-
if (ids.has(slot.id)) {
|
|
884
|
-
context.addIssue({
|
|
885
|
-
code: "custom",
|
|
886
|
-
message: "Key slot IDs must be unique",
|
|
887
|
-
path: ["keySlots", index, "id"]
|
|
888
|
-
});
|
|
889
|
-
}
|
|
890
|
-
ids.add(slot.id);
|
|
891
|
-
}
|
|
892
|
-
if (!vault.keySlots.some((slot) => slot.state === "active")) {
|
|
893
|
-
context.addIssue({
|
|
894
|
-
code: "custom",
|
|
895
|
-
message: "Vault requires an active unlock slot",
|
|
896
|
-
path: ["keySlots"]
|
|
897
|
-
});
|
|
898
|
-
}
|
|
899
|
-
if (!vault.keySlots.some((slot) => slot.state === "active" && slot.keyVersion === vault.currentKeyVersion)) {
|
|
900
|
-
context.addIssue({
|
|
901
|
-
code: "custom",
|
|
902
|
-
message: "Current key version requires an active unlock slot",
|
|
903
|
-
path: ["currentKeyVersion"]
|
|
904
|
-
});
|
|
905
|
-
}
|
|
906
|
-
if (vault.encryptedPreferences.aad.vaultId !== vault.id || vault.encryptedPreferences.aad.entityType !== "vault-preferences" || vault.encryptedPreferences.aad.entityId !== vault.id || vault.encryptedPreferences.aad.schemaVersion !== vault.schemaVersion) {
|
|
907
|
-
context.addIssue({
|
|
908
|
-
code: "custom",
|
|
909
|
-
message: "Encrypted preferences have invalid associated data",
|
|
910
|
-
path: ["encryptedPreferences", "aad"]
|
|
911
|
-
});
|
|
912
|
-
}
|
|
913
|
-
});
|
|
914
|
-
var encryptedGroupRecordSchema = external_exports.object({
|
|
915
|
-
id: groupIdSchema,
|
|
916
|
-
vaultId: vaultIdSchema,
|
|
917
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
918
|
-
wrappedGroupKey: aeadEnvelopeSchema,
|
|
919
|
-
encryptedPayload: aeadEnvelopeSchema,
|
|
920
|
-
templateVersion: templateVersionSchema,
|
|
921
|
-
recordRevision: recordRevisionSchema,
|
|
922
|
-
createdAt: timestampSchema,
|
|
923
|
-
updatedAt: timestampSchema,
|
|
924
|
-
tombstonedAt: timestampSchema.optional()
|
|
925
|
-
}).strict().superRefine((record, context) => {
|
|
926
|
-
validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "group", record.id);
|
|
927
|
-
validateEnvelopeBinding(context, record.wrappedGroupKey, record.vaultId, record.schemaVersion, "wrapped-group-key", record.id);
|
|
928
|
-
});
|
|
929
|
-
var encryptedItemRecordSchema = external_exports.object({
|
|
930
|
-
id: itemIdSchema,
|
|
931
|
-
vaultId: vaultIdSchema,
|
|
932
|
-
groupId: groupIdSchema,
|
|
933
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
934
|
-
wrappedItemKey: aeadEnvelopeSchema,
|
|
935
|
-
encryptedPayload: aeadEnvelopeSchema,
|
|
936
|
-
recordRevision: recordRevisionSchema,
|
|
937
|
-
ciphertextHash: sha256DigestSchema,
|
|
938
|
-
createdAt: timestampSchema,
|
|
939
|
-
updatedAt: timestampSchema,
|
|
940
|
-
tombstonedAt: timestampSchema.optional()
|
|
941
|
-
}).strict().superRefine((record, context) => {
|
|
942
|
-
validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "item", record.id, record.groupId);
|
|
943
|
-
validateEnvelopeBinding(context, record.wrappedItemKey, record.vaultId, record.schemaVersion, "wrapped-item-key", record.id, record.groupId);
|
|
944
|
-
});
|
|
945
|
-
var encryptedAttachmentRecordSchema = external_exports.object({
|
|
946
|
-
id: attachmentIdSchema,
|
|
947
|
-
vaultId: vaultIdSchema,
|
|
948
|
-
groupId: groupIdSchema,
|
|
949
|
-
itemId: itemIdSchema,
|
|
950
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
951
|
-
wrappedAttachmentKey: aeadEnvelopeSchema,
|
|
952
|
-
encryptedManifest: aeadEnvelopeSchema,
|
|
953
|
-
chunkCount: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
|
|
954
|
-
recordRevision: recordRevisionSchema,
|
|
955
|
-
createdAt: timestampSchema,
|
|
956
|
-
updatedAt: timestampSchema,
|
|
957
|
-
tombstonedAt: timestampSchema.optional()
|
|
958
|
-
}).strict().superRefine((record, context) => {
|
|
959
|
-
validateEnvelopeBinding(context, record.encryptedManifest, record.vaultId, record.schemaVersion, "attachment", record.id, record.groupId, record.itemId);
|
|
960
|
-
validateEnvelopeBinding(context, record.wrappedAttachmentKey, record.vaultId, record.schemaVersion, "wrapped-attachment-key", record.id, record.groupId, record.itemId);
|
|
961
|
-
if (record.wrappedAttachmentKey.keyVersion !== record.encryptedManifest.keyVersion) {
|
|
962
|
-
context.addIssue({
|
|
963
|
-
code: "custom",
|
|
964
|
-
path: ["wrappedAttachmentKey", "keyVersion"],
|
|
965
|
-
message: "Attachment key envelopes must use one exact key version"
|
|
966
|
-
});
|
|
967
|
-
}
|
|
968
|
-
});
|
|
969
|
-
var encryptedAuditRecordSchema = external_exports.object({
|
|
970
|
-
id: auditEventIdSchema,
|
|
971
|
-
vaultId: vaultIdSchema,
|
|
972
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
973
|
-
encryptedPayload: aeadEnvelopeSchema,
|
|
974
|
-
recordRevision: recordRevisionSchema,
|
|
975
|
-
createdAt: timestampSchema
|
|
976
|
-
}).strict().superRefine((record, context) => {
|
|
977
|
-
validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "audit-event", record.id);
|
|
978
|
-
});
|
|
979
|
-
var encryptedHistoryRecordSchema = external_exports.object({
|
|
980
|
-
id: historyIdSchema,
|
|
981
|
-
vaultId: vaultIdSchema,
|
|
982
|
-
groupId: groupIdSchema,
|
|
983
|
-
itemId: itemIdSchema,
|
|
984
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
985
|
-
encryptedPayload: aeadEnvelopeSchema,
|
|
986
|
-
itemRecordRevision: recordRevisionSchema,
|
|
987
|
-
ciphertextHash: sha256DigestSchema,
|
|
988
|
-
createdAt: timestampSchema
|
|
989
|
-
}).strict().superRefine((record, context) => {
|
|
990
|
-
validateEnvelopeBinding(context, record.encryptedPayload, record.vaultId, record.schemaVersion, "history", record.id, record.groupId, record.itemId);
|
|
991
|
-
});
|
|
992
|
-
var encryptedRecordSchema = external_exports.union([
|
|
993
|
-
encryptedGroupRecordSchema,
|
|
994
|
-
encryptedItemRecordSchema,
|
|
995
|
-
encryptedAttachmentRecordSchema,
|
|
996
|
-
encryptedAuditRecordSchema,
|
|
997
|
-
encryptedHistoryRecordSchema
|
|
998
|
-
]);
|
|
999
|
-
function validateEnvelopeBinding(context, envelope, vaultId, schemaVersion, entityType, entityId, groupId, parentId) {
|
|
1000
|
-
if (envelope.aad.vaultId !== vaultId || envelope.aad.schemaVersion !== schemaVersion || envelope.aad.entityType !== entityType || envelope.aad.entityId !== entityId || envelope.aad.groupId !== groupId || envelope.aad.parentId !== parentId) {
|
|
1001
|
-
context.addIssue({
|
|
1002
|
-
code: "custom",
|
|
1003
|
-
message: "Envelope associated data does not match its record",
|
|
1004
|
-
path: ["aad"]
|
|
1005
|
-
});
|
|
1006
|
-
}
|
|
1007
|
-
}
|
|
1008
|
-
|
|
1009
|
-
// ../../packages/schemas/dist/content-hash.js
|
|
1010
|
-
import { createHash, timingSafeEqual } from "node:crypto";
|
|
1011
|
-
var BACKUP_STAGED_ENTRIES_DOMAIN = Buffer.from("kavrix/backup-staged-entries/v1", "utf8");
|
|
1012
|
-
function canonicalJson(value) {
|
|
1013
|
-
if (value === null)
|
|
1014
|
-
return "null";
|
|
1015
|
-
if (typeof value === "string" || typeof value === "boolean") {
|
|
1016
|
-
return JSON.stringify(value);
|
|
1017
|
-
}
|
|
1018
|
-
if (typeof value === "number") {
|
|
1019
|
-
if (!Number.isFinite(value)) {
|
|
1020
|
-
throw new TypeError("Canonical JSON rejects non-finite numbers.");
|
|
1021
|
-
}
|
|
1022
|
-
return JSON.stringify(value);
|
|
1023
|
-
}
|
|
1024
|
-
if (Array.isArray(value)) {
|
|
1025
|
-
return `[${value.map((entry) => canonicalJson(entry)).join(",")}]`;
|
|
1026
|
-
}
|
|
1027
|
-
if (typeof value !== "object") {
|
|
1028
|
-
throw new TypeError("Canonical JSON accepts only JSON values.");
|
|
1029
|
-
}
|
|
1030
|
-
const prototype = Object.getPrototypeOf(value);
|
|
1031
|
-
if (prototype !== Object.prototype && prototype !== null) {
|
|
1032
|
-
throw new TypeError("Canonical JSON rejects non-plain objects.");
|
|
1033
|
-
}
|
|
1034
|
-
const object = value;
|
|
1035
|
-
return `{${Object.keys(object).sort().filter((key) => object[key] !== void 0).map((key) => `${JSON.stringify(key)}:${canonicalJson(object[key])}`).join(",")}}`;
|
|
1036
|
-
}
|
|
1037
|
-
function attachmentHeaderContentHash(header) {
|
|
1038
|
-
return sha256DigestSchema.parse(createHash("sha256").update(canonicalJson(header.record), "utf8").digest("base64url"));
|
|
1039
|
-
}
|
|
1040
|
-
|
|
1041
|
-
// ../../packages/schemas/dist/fields.js
|
|
1042
|
-
var fieldTypeSchema = external_exports.enum([
|
|
1043
|
-
"text",
|
|
1044
|
-
"secret",
|
|
1045
|
-
"username",
|
|
1046
|
-
"email",
|
|
1047
|
-
"url",
|
|
1048
|
-
"phone",
|
|
1049
|
-
"number",
|
|
1050
|
-
"boolean",
|
|
1051
|
-
"date",
|
|
1052
|
-
"datetime",
|
|
1053
|
-
"multiline",
|
|
1054
|
-
"secure-multiline",
|
|
1055
|
-
"api-key",
|
|
1056
|
-
"access-token",
|
|
1057
|
-
"refresh-token",
|
|
1058
|
-
"client-id",
|
|
1059
|
-
"client-secret",
|
|
1060
|
-
"connection-string",
|
|
1061
|
-
"host",
|
|
1062
|
-
"port",
|
|
1063
|
-
"database-name",
|
|
1064
|
-
"private-key",
|
|
1065
|
-
"public-key",
|
|
1066
|
-
"certificate",
|
|
1067
|
-
"totp-secret",
|
|
1068
|
-
"recovery-code-list",
|
|
1069
|
-
"json",
|
|
1070
|
-
"select",
|
|
1071
|
-
"multi-select",
|
|
1072
|
-
"tags",
|
|
1073
|
-
"environment-map",
|
|
1074
|
-
"command-snippet",
|
|
1075
|
-
"attachment",
|
|
1076
|
-
"item-reference",
|
|
1077
|
-
"custom"
|
|
1078
|
-
]);
|
|
1079
|
-
var sensitiveFieldTypes = /* @__PURE__ */ new Set([
|
|
1080
|
-
"secret",
|
|
1081
|
-
"api-key",
|
|
1082
|
-
"access-token",
|
|
1083
|
-
"refresh-token",
|
|
1084
|
-
"client-secret",
|
|
1085
|
-
"connection-string",
|
|
1086
|
-
"private-key",
|
|
1087
|
-
"totp-secret",
|
|
1088
|
-
"recovery-code-list",
|
|
1089
|
-
"secure-multiline"
|
|
1090
|
-
]);
|
|
1091
|
-
function isSensitiveFieldType(fieldType) {
|
|
1092
|
-
return sensitiveFieldTypes.has(fieldType);
|
|
1093
|
-
}
|
|
1094
|
-
var copyPolicySchema = external_exports.enum(["never", "allowed", "confirm"]);
|
|
1095
|
-
var revealPolicySchema = external_exports.enum(["never", "timed", "confirm"]);
|
|
1096
|
-
var reauthenticationPolicySchema = external_exports.enum(["never", "after-lock", "always"]);
|
|
1097
|
-
var exportPolicySchema = external_exports.enum(["never", "encrypted-only", "guarded"]);
|
|
1098
|
-
var namedValidationSchema = external_exports.enum([
|
|
1099
|
-
"ascii",
|
|
1100
|
-
"lowercase-ascii",
|
|
1101
|
-
"alphanumeric-ascii",
|
|
1102
|
-
"hostname",
|
|
1103
|
-
"ipv4",
|
|
1104
|
-
"base64url"
|
|
1105
|
-
]);
|
|
1106
|
-
var validationRulesSchema = external_exports.object({
|
|
1107
|
-
minLength: external_exports.number().int().nonnegative().optional(),
|
|
1108
|
-
maxLength: external_exports.number().int().positive().max(1048576).optional(),
|
|
1109
|
-
namedValidation: namedValidationSchema.optional(),
|
|
1110
|
-
min: external_exports.number().optional(),
|
|
1111
|
-
max: external_exports.number().optional(),
|
|
1112
|
-
allowedSchemes: external_exports.array(external_exports.string().min(1).max(32)).max(16).optional()
|
|
1113
|
-
}).strict().superRefine((rules, context) => {
|
|
1114
|
-
if (rules.minLength !== void 0 && rules.maxLength !== void 0 && rules.minLength > rules.maxLength) {
|
|
1115
|
-
context.addIssue({
|
|
1116
|
-
code: "custom",
|
|
1117
|
-
message: "Minimum length cannot exceed maximum length",
|
|
1118
|
-
path: ["minLength"]
|
|
1119
|
-
});
|
|
1120
|
-
}
|
|
1121
|
-
if (rules.min !== void 0 && rules.max !== void 0 && rules.min > rules.max) {
|
|
1122
|
-
context.addIssue({
|
|
1123
|
-
code: "custom",
|
|
1124
|
-
message: "Minimum cannot exceed maximum",
|
|
1125
|
-
path: ["min"]
|
|
1126
|
-
});
|
|
1127
|
-
}
|
|
1128
|
-
});
|
|
1129
|
-
var selectOptionSchema = external_exports.object({
|
|
1130
|
-
value: external_exports.string().min(1).max(128),
|
|
1131
|
-
label: nonEmptyTextSchema
|
|
1132
|
-
}).strict();
|
|
1133
|
-
var opaqueFieldValueIdSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._~-]*$/, "Must be an opaque identifier");
|
|
1134
|
-
var fieldValueElementIdSchema = opaqueFieldValueIdSchema.brand();
|
|
1135
|
-
var nonEmptyFieldTextSchema = encryptedTextSchema.refine((value) => value.length > 0, { error: "Present text values cannot be empty" });
|
|
1136
|
-
var nonEmptySecretValueSchema = secretValueSchema.refine((value) => value.length > 0, { error: "Present secret values cannot be empty" });
|
|
1137
|
-
var fieldScalarValueSchema = external_exports.discriminatedUnion("kind", [
|
|
1138
|
-
external_exports.object({ kind: external_exports.literal("text"), value: nonEmptyFieldTextSchema }).strict(),
|
|
1139
|
-
external_exports.object({ kind: external_exports.literal("secret"), value: nonEmptySecretValueSchema }).strict(),
|
|
1140
|
-
external_exports.object({ kind: external_exports.literal("number"), value: external_exports.number() }).strict(),
|
|
1141
|
-
external_exports.object({ kind: external_exports.literal("boolean"), value: external_exports.boolean() }).strict(),
|
|
1142
|
-
external_exports.object({ kind: external_exports.literal("item-reference"), itemId: itemIdSchema }).strict(),
|
|
1143
|
-
external_exports.object({
|
|
1144
|
-
kind: external_exports.literal("attachment-reference"),
|
|
1145
|
-
attachmentId: attachmentIdSchema
|
|
1146
|
-
}).strict(),
|
|
1147
|
-
external_exports.object({
|
|
1148
|
-
kind: external_exports.literal("environment-entry"),
|
|
1149
|
-
key: external_exports.string().min(1).max(256),
|
|
1150
|
-
value: external_exports.discriminatedUnion("classification", [
|
|
1151
|
-
external_exports.object({
|
|
1152
|
-
classification: external_exports.literal("text"),
|
|
1153
|
-
value: nonEmptyFieldTextSchema
|
|
1154
|
-
}).strict(),
|
|
1155
|
-
external_exports.object({
|
|
1156
|
-
classification: external_exports.literal("secret"),
|
|
1157
|
-
value: nonEmptySecretValueSchema
|
|
1158
|
-
}).strict()
|
|
1159
|
-
])
|
|
1160
|
-
}).strict()
|
|
1161
|
-
]);
|
|
1162
|
-
var fieldValueElementLifecycleSchema = external_exports.discriminatedUnion("status", [
|
|
1163
|
-
external_exports.object({
|
|
1164
|
-
version: external_exports.literal(1),
|
|
1165
|
-
status: external_exports.literal("available"),
|
|
1166
|
-
usedAt: external_exports.undefined().optional()
|
|
1167
|
-
}).strict(),
|
|
1168
|
-
external_exports.object({
|
|
1169
|
-
version: external_exports.literal(1),
|
|
1170
|
-
status: external_exports.literal("used"),
|
|
1171
|
-
usedAt: timestampSchema
|
|
1172
|
-
}).strict()
|
|
1173
|
-
]);
|
|
1174
|
-
var fieldValueElementSchema = external_exports.object({
|
|
1175
|
-
id: fieldValueElementIdSchema,
|
|
1176
|
-
value: fieldScalarValueSchema,
|
|
1177
|
-
lifecycle: fieldValueElementLifecycleSchema
|
|
1178
|
-
}).strict();
|
|
1179
|
-
var fieldValueContentSchema = external_exports.discriminatedUnion("cardinality", [
|
|
1180
|
-
external_exports.object({
|
|
1181
|
-
cardinality: external_exports.literal("single"),
|
|
1182
|
-
value: fieldScalarValueSchema
|
|
1183
|
-
}).strict(),
|
|
1184
|
-
external_exports.object({
|
|
1185
|
-
cardinality: external_exports.literal("multiple"),
|
|
1186
|
-
elements: external_exports.array(fieldValueElementSchema).min(1).max(1e4)
|
|
1187
|
-
}).strict().superRefine((content, context) => {
|
|
1188
|
-
const ids = /* @__PURE__ */ new Set();
|
|
1189
|
-
const environmentKeys = /* @__PURE__ */ new Set();
|
|
1190
|
-
for (const [index, element] of content.elements.entries()) {
|
|
1191
|
-
if (ids.has(element.id)) {
|
|
1192
|
-
context.addIssue({
|
|
1193
|
-
code: "custom",
|
|
1194
|
-
message: "Repeatable field element IDs must be unique",
|
|
1195
|
-
path: ["elements", index, "id"]
|
|
1196
|
-
});
|
|
1197
|
-
}
|
|
1198
|
-
ids.add(element.id);
|
|
1199
|
-
if (element.value.kind === "environment-entry") {
|
|
1200
|
-
if (environmentKeys.has(element.value.key)) {
|
|
1201
|
-
context.addIssue({
|
|
1202
|
-
code: "custom",
|
|
1203
|
-
message: "Environment entry keys must be unique",
|
|
1204
|
-
path: ["elements", index, "value", "key"]
|
|
1205
|
-
});
|
|
1206
|
-
}
|
|
1207
|
-
environmentKeys.add(element.value.key);
|
|
1208
|
-
}
|
|
1209
|
-
}
|
|
1210
|
-
})
|
|
1211
|
-
]).refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4194304, { error: "Field value content exceeds the aggregate size limit" });
|
|
1212
|
-
var missingFieldValueSchema = external_exports.object({ version: external_exports.literal(1), state: external_exports.literal("missing") }).strict();
|
|
1213
|
-
var emptyFieldValueSchema = external_exports.object({ version: external_exports.literal(1), state: external_exports.literal("empty") }).strict();
|
|
1214
|
-
var inapplicableFieldValueSchema = external_exports.object({
|
|
1215
|
-
version: external_exports.literal(1),
|
|
1216
|
-
state: external_exports.literal("inapplicable"),
|
|
1217
|
-
reason: external_exports.string().trim().min(1).max(256).optional()
|
|
1218
|
-
}).strict();
|
|
1219
|
-
var unreadableFieldValueSchema = external_exports.object({
|
|
1220
|
-
version: external_exports.literal(1),
|
|
1221
|
-
state: external_exports.literal("unreadable"),
|
|
1222
|
-
reason: external_exports.enum([
|
|
1223
|
-
"unsupported-version",
|
|
1224
|
-
"invalid-encoding",
|
|
1225
|
-
"decryption-failed",
|
|
1226
|
-
"reference-unavailable"
|
|
1227
|
-
])
|
|
1228
|
-
}).strict();
|
|
1229
|
-
var presentFieldValueSchema = external_exports.object({
|
|
1230
|
-
version: external_exports.literal(1),
|
|
1231
|
-
state: external_exports.literal("present"),
|
|
1232
|
-
content: fieldValueContentSchema
|
|
1233
|
-
}).strict();
|
|
1234
|
-
var activeFieldValueSchema = external_exports.discriminatedUnion("state", [
|
|
1235
|
-
missingFieldValueSchema,
|
|
1236
|
-
emptyFieldValueSchema,
|
|
1237
|
-
presentFieldValueSchema,
|
|
1238
|
-
inapplicableFieldValueSchema,
|
|
1239
|
-
unreadableFieldValueSchema
|
|
1240
|
-
]);
|
|
1241
|
-
var orphanedFieldValueSchema = external_exports.object({
|
|
1242
|
-
version: external_exports.literal(1),
|
|
1243
|
-
state: external_exports.literal("orphaned"),
|
|
1244
|
-
originalValue: activeFieldValueSchema
|
|
1245
|
-
}).strict();
|
|
1246
|
-
var fieldValueSchema = external_exports.discriminatedUnion("state", [
|
|
1247
|
-
missingFieldValueSchema,
|
|
1248
|
-
emptyFieldValueSchema,
|
|
1249
|
-
presentFieldValueSchema,
|
|
1250
|
-
orphanedFieldValueSchema,
|
|
1251
|
-
inapplicableFieldValueSchema,
|
|
1252
|
-
unreadableFieldValueSchema
|
|
1253
|
-
]).refine((value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 4194304, { error: "Field value exceeds the aggregate size limit" });
|
|
1254
|
-
var stableFieldKeySchema = external_exports.string().min(1).max(128).regex(/^[a-z][a-z0-9]*(?:[._-][a-z0-9]+)*$/, "Invalid stable field key");
|
|
1255
|
-
var fieldDefinitionSchema = external_exports.object({
|
|
1256
|
-
id: fieldIdSchema,
|
|
1257
|
-
stableKey: stableFieldKeySchema,
|
|
1258
|
-
label: nonEmptyTextSchema,
|
|
1259
|
-
description: external_exports.string().trim().max(1024).optional(),
|
|
1260
|
-
type: fieldTypeSchema,
|
|
1261
|
-
required: external_exports.boolean(),
|
|
1262
|
-
sensitive: external_exports.boolean(),
|
|
1263
|
-
repeatable: external_exports.boolean(),
|
|
1264
|
-
copyable: external_exports.boolean(),
|
|
1265
|
-
searchableLocally: external_exports.boolean(),
|
|
1266
|
-
showInPreview: external_exports.boolean(),
|
|
1267
|
-
defaultValue: presentFieldValueSchema.optional(),
|
|
1268
|
-
placeholder: external_exports.string().max(256).optional(),
|
|
1269
|
-
validationRules: validationRulesSchema.optional(),
|
|
1270
|
-
selectOptions: external_exports.array(selectOptionSchema).max(1e3).optional(),
|
|
1271
|
-
environmentVariableName: external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/).max(256).optional(),
|
|
1272
|
-
copyPolicy: copyPolicySchema,
|
|
1273
|
-
revealPolicy: revealPolicySchema,
|
|
1274
|
-
reauthenticationPolicy: reauthenticationPolicySchema,
|
|
1275
|
-
exportPolicy: exportPolicySchema,
|
|
1276
|
-
sortOrder: sortOrderSchema,
|
|
1277
|
-
createdAt: timestampSchema,
|
|
1278
|
-
updatedAt: timestampSchema
|
|
1279
|
-
}).strict().superRefine((field, context) => {
|
|
1280
|
-
if (field.copyable !== (field.copyPolicy !== "never")) {
|
|
1281
|
-
context.addIssue({
|
|
1282
|
-
code: "custom",
|
|
1283
|
-
message: "Copyable and copy policy must describe one canonical state",
|
|
1284
|
-
path: ["copyPolicy"]
|
|
1285
|
-
});
|
|
1286
|
-
}
|
|
1287
|
-
if (field.sensitive && field.defaultValue !== void 0) {
|
|
1288
|
-
context.addIssue({
|
|
1289
|
-
code: "custom",
|
|
1290
|
-
message: "Sensitive fields cannot define default values",
|
|
1291
|
-
path: ["defaultValue"]
|
|
1292
|
-
});
|
|
1293
|
-
}
|
|
1294
|
-
if (isSensitiveFieldType(field.type) && !field.sensitive) {
|
|
1295
|
-
context.addIssue({
|
|
1296
|
-
code: "custom",
|
|
1297
|
-
message: "This field type must be sensitive",
|
|
1298
|
-
path: ["sensitive"]
|
|
1299
|
-
});
|
|
1300
|
-
}
|
|
1301
|
-
if (field.sensitive && field.showInPreview) {
|
|
1302
|
-
context.addIssue({
|
|
1303
|
-
code: "custom",
|
|
1304
|
-
message: "Sensitive fields cannot appear in list previews",
|
|
1305
|
-
path: ["showInPreview"]
|
|
1306
|
-
});
|
|
1307
|
-
}
|
|
1308
|
-
if (field.sensitive && field.reauthenticationPolicy === "never") {
|
|
1309
|
-
context.addIssue({
|
|
1310
|
-
code: "custom",
|
|
1311
|
-
message: "Sensitive fields require reauthentication after locking",
|
|
1312
|
-
path: ["reauthenticationPolicy"]
|
|
1313
|
-
});
|
|
1314
|
-
}
|
|
1315
|
-
if (!field.sensitive && field.revealPolicy !== "never") {
|
|
1316
|
-
context.addIssue({
|
|
1317
|
-
code: "custom",
|
|
1318
|
-
message: "Non-sensitive fields do not use reveal policies",
|
|
1319
|
-
path: ["revealPolicy"]
|
|
1320
|
-
});
|
|
1321
|
-
}
|
|
1322
|
-
const isSelect = field.type === "select" || field.type === "multi-select";
|
|
1323
|
-
if (isSelect && (!field.selectOptions || field.selectOptions.length === 0)) {
|
|
1324
|
-
context.addIssue({
|
|
1325
|
-
code: "custom",
|
|
1326
|
-
message: "Select fields require at least one option",
|
|
1327
|
-
path: ["selectOptions"]
|
|
1328
|
-
});
|
|
1329
|
-
}
|
|
1330
|
-
if (!isSelect && field.selectOptions !== void 0) {
|
|
1331
|
-
context.addIssue({
|
|
1332
|
-
code: "custom",
|
|
1333
|
-
message: "Only select fields may define options",
|
|
1334
|
-
path: ["selectOptions"]
|
|
1335
|
-
});
|
|
1336
|
-
}
|
|
1337
|
-
if (field.defaultValue !== void 0 && !fieldValueMatchesDefinition(field, field.defaultValue)) {
|
|
1338
|
-
context.addIssue({
|
|
1339
|
-
code: "custom",
|
|
1340
|
-
message: "A default value must satisfy its field definition",
|
|
1341
|
-
path: ["defaultValue"]
|
|
1342
|
-
});
|
|
1343
|
-
}
|
|
1344
|
-
});
|
|
1345
|
-
var storedFieldValueSchema = external_exports.object({
|
|
1346
|
-
fieldId: fieldIdSchema,
|
|
1347
|
-
stableKey: stableFieldKeySchema,
|
|
1348
|
-
value: activeFieldValueSchema,
|
|
1349
|
-
updatedAt: timestampSchema
|
|
1350
|
-
}).strict();
|
|
1351
|
-
var archivedFieldValueReasonSchema = external_exports.enum([
|
|
1352
|
-
"template-field-removed",
|
|
1353
|
-
"type-conversion",
|
|
1354
|
-
"user-archived"
|
|
1355
|
-
]);
|
|
1356
|
-
var archivedFieldValueSchema = external_exports.object({
|
|
1357
|
-
definition: fieldDefinitionSchema,
|
|
1358
|
-
value: orphanedFieldValueSchema,
|
|
1359
|
-
sourceTemplateId: templateIdSchema,
|
|
1360
|
-
sourceTemplateVersion: templateVersionSchema,
|
|
1361
|
-
archivedAt: timestampSchema,
|
|
1362
|
-
reason: archivedFieldValueReasonSchema
|
|
1363
|
-
}).strict().superRefine((archived, context) => {
|
|
1364
|
-
if (!fieldValueMatchesDefinition(archived.definition, archived.value.originalValue)) {
|
|
1365
|
-
context.addIssue({
|
|
1366
|
-
code: "custom",
|
|
1367
|
-
message: "Archived values must preserve a state valid for their definition",
|
|
1368
|
-
path: ["value", "originalValue"]
|
|
1369
|
-
});
|
|
1370
|
-
}
|
|
1371
|
-
});
|
|
1372
|
-
var itemReferenceSchema = external_exports.object({
|
|
1373
|
-
itemId: itemIdSchema,
|
|
1374
|
-
relationship: external_exports.string().trim().min(1).max(128)
|
|
1375
|
-
}).strict();
|
|
1376
|
-
var collectionFieldTypes = /* @__PURE__ */ new Set([
|
|
1377
|
-
"multi-select",
|
|
1378
|
-
"tags",
|
|
1379
|
-
"recovery-code-list",
|
|
1380
|
-
"environment-map"
|
|
1381
|
-
]);
|
|
1382
|
-
function fieldExpectsMultipleValues(field) {
|
|
1383
|
-
return field.repeatable || collectionFieldTypes.has(field.type);
|
|
1384
|
-
}
|
|
1385
|
-
function fieldValueMatchesDefinition(field, value) {
|
|
1386
|
-
if (value.state === "orphaned")
|
|
1387
|
-
return false;
|
|
1388
|
-
if (value.state !== "present")
|
|
1389
|
-
return !field.required;
|
|
1390
|
-
const expectsMultiple = fieldExpectsMultipleValues(field);
|
|
1391
|
-
if (expectsMultiple !== (value.content.cardinality === "multiple"))
|
|
1392
|
-
return false;
|
|
1393
|
-
const elements = value.content.cardinality === "multiple" ? value.content.elements : void 0;
|
|
1394
|
-
if (field.type !== "recovery-code-list" && elements?.some(({ lifecycle }) => lifecycle.status === "used") === true) {
|
|
1395
|
-
return false;
|
|
1396
|
-
}
|
|
1397
|
-
const candidates = value.content.cardinality === "multiple" ? value.content.elements.map(({ value: candidate }) => candidate) : [value.content.value];
|
|
1398
|
-
return candidates.every((candidate) => singleValueMatchesType(field, candidate) && valueMatchesRules(field, candidate));
|
|
1399
|
-
}
|
|
1400
|
-
function singleValueMatchesType(field, value) {
|
|
1401
|
-
switch (field.type) {
|
|
1402
|
-
case "number":
|
|
1403
|
-
return value.kind === "number";
|
|
1404
|
-
case "port":
|
|
1405
|
-
return value.kind === "number" && Number.isInteger(value.value) && value.value >= 1 && value.value <= 65535;
|
|
1406
|
-
case "boolean":
|
|
1407
|
-
return value.kind === "boolean";
|
|
1408
|
-
case "attachment":
|
|
1409
|
-
return value.kind === "attachment-reference";
|
|
1410
|
-
case "item-reference":
|
|
1411
|
-
return value.kind === "item-reference";
|
|
1412
|
-
case "environment-map":
|
|
1413
|
-
return value.kind === "environment-entry" && value.value.classification === (field.sensitive ? "secret" : "text");
|
|
1414
|
-
case "json":
|
|
1415
|
-
if (!isExpectedTextKind(field, value))
|
|
1416
|
-
return false;
|
|
1417
|
-
try {
|
|
1418
|
-
JSON.parse(value.value);
|
|
1419
|
-
return true;
|
|
1420
|
-
} catch {
|
|
1421
|
-
return false;
|
|
1422
|
-
}
|
|
1423
|
-
case "select":
|
|
1424
|
-
case "multi-select":
|
|
1425
|
-
return isExpectedTextKind(field, value) && selectValuesMatch(field, value.value);
|
|
1426
|
-
case "email":
|
|
1427
|
-
return isExpectedTextKind(field, value) && isSimpleEmail(value.value);
|
|
1428
|
-
case "url":
|
|
1429
|
-
if (!isExpectedTextKind(field, value))
|
|
1430
|
-
return false;
|
|
1431
|
-
try {
|
|
1432
|
-
const parsed = new URL(value.value);
|
|
1433
|
-
const schemes = field.validationRules?.allowedSchemes;
|
|
1434
|
-
return schemes === void 0 || schemes.includes(parsed.protocol.slice(0, -1));
|
|
1435
|
-
} catch {
|
|
1436
|
-
return false;
|
|
1437
|
-
}
|
|
1438
|
-
default:
|
|
1439
|
-
return isExpectedTextKind(field, value);
|
|
1440
|
-
}
|
|
1441
|
-
}
|
|
1442
|
-
function isExpectedTextKind(field, value) {
|
|
1443
|
-
return field.sensitive ? value.kind === "secret" : value.kind === "text";
|
|
1444
|
-
}
|
|
1445
|
-
function valueMatchesRules(field, value) {
|
|
1446
|
-
const rules = field.validationRules;
|
|
1447
|
-
if (rules === void 0)
|
|
1448
|
-
return true;
|
|
1449
|
-
if (value.kind === "text" || value.kind === "secret") {
|
|
1450
|
-
if (rules.minLength !== void 0 && value.value.length < rules.minLength)
|
|
1451
|
-
return false;
|
|
1452
|
-
if (rules.maxLength !== void 0 && value.value.length > rules.maxLength)
|
|
1453
|
-
return false;
|
|
1454
|
-
if (rules.namedValidation !== void 0 && !matchesNamedValidation(rules.namedValidation, value.value))
|
|
1455
|
-
return false;
|
|
1456
|
-
}
|
|
1457
|
-
if (value.kind === "number") {
|
|
1458
|
-
if (rules.min !== void 0 && value.value < rules.min)
|
|
1459
|
-
return false;
|
|
1460
|
-
if (rules.max !== void 0 && value.value > rules.max)
|
|
1461
|
-
return false;
|
|
1462
|
-
}
|
|
1463
|
-
return true;
|
|
1464
|
-
}
|
|
1465
|
-
function matchesNamedValidation(validation, value) {
|
|
1466
|
-
switch (validation) {
|
|
1467
|
-
case "ascii":
|
|
1468
|
-
return everyCodeUnit(value, (code) => code <= 127);
|
|
1469
|
-
case "lowercase-ascii":
|
|
1470
|
-
return everyCodeUnit(value, (code) => code >= 97 && code <= 122 || code >= 48 && code <= 57 || code === 45 || code === 95);
|
|
1471
|
-
case "alphanumeric-ascii":
|
|
1472
|
-
return everyCodeUnit(value, (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122);
|
|
1473
|
-
case "hostname":
|
|
1474
|
-
return isHostname(value);
|
|
1475
|
-
case "ipv4":
|
|
1476
|
-
return isIpv4(value);
|
|
1477
|
-
case "base64url":
|
|
1478
|
-
return everyCodeUnit(value, (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 45 || code === 95);
|
|
1479
|
-
}
|
|
1480
|
-
}
|
|
1481
|
-
function everyCodeUnit(value, predicate) {
|
|
1482
|
-
if (value.length === 0)
|
|
1483
|
-
return false;
|
|
1484
|
-
for (let index = 0; index < value.length; index += 1) {
|
|
1485
|
-
if (!predicate(value.charCodeAt(index)))
|
|
1486
|
-
return false;
|
|
1487
|
-
}
|
|
1488
|
-
return true;
|
|
1489
|
-
}
|
|
1490
|
-
function isHostname(value) {
|
|
1491
|
-
if (value.length === 0 || value.length > 253)
|
|
1492
|
-
return false;
|
|
1493
|
-
const labels = value.split(".");
|
|
1494
|
-
return labels.every((label) => {
|
|
1495
|
-
if (label.length === 0 || label.length > 63)
|
|
1496
|
-
return false;
|
|
1497
|
-
if (label.startsWith("-") || label.endsWith("-"))
|
|
1498
|
-
return false;
|
|
1499
|
-
return everyCodeUnit(label, (code) => code >= 48 && code <= 57 || code >= 65 && code <= 90 || code >= 97 && code <= 122 || code === 45);
|
|
1500
|
-
});
|
|
1501
|
-
}
|
|
1502
|
-
function isIpv4(value) {
|
|
1503
|
-
const parts = value.split(".");
|
|
1504
|
-
if (parts.length !== 4)
|
|
1505
|
-
return false;
|
|
1506
|
-
return parts.every((part) => {
|
|
1507
|
-
if (part.length === 0 || part.length > 3)
|
|
1508
|
-
return false;
|
|
1509
|
-
if (part.length > 1 && part.startsWith("0"))
|
|
1510
|
-
return false;
|
|
1511
|
-
if (!everyCodeUnit(part, (code) => code >= 48 && code <= 57))
|
|
1512
|
-
return false;
|
|
1513
|
-
const octet = Number(part);
|
|
1514
|
-
return octet >= 0 && octet <= 255;
|
|
1515
|
-
});
|
|
1516
|
-
}
|
|
1517
|
-
function isSimpleEmail(value) {
|
|
1518
|
-
const at = value.indexOf("@");
|
|
1519
|
-
if (at <= 0 || at !== value.lastIndexOf("@"))
|
|
1520
|
-
return false;
|
|
1521
|
-
const domain = value.slice(at + 1);
|
|
1522
|
-
return domain.includes(".") && !value.includes(" ") && !value.includes(" ");
|
|
1523
|
-
}
|
|
1524
|
-
function selectValuesMatch(field, value) {
|
|
1525
|
-
return field.selectOptions?.some((option) => option.value === value) === true;
|
|
1526
|
-
}
|
|
1527
|
-
|
|
1528
|
-
// ../../packages/schemas/dist/notes.js
|
|
1529
|
-
var noteSchema = external_exports.object({
|
|
1530
|
-
id: noteIdSchema,
|
|
1531
|
-
title: nonEmptyTextSchema,
|
|
1532
|
-
content: secretValueSchema,
|
|
1533
|
-
isSensitive: external_exports.boolean(),
|
|
1534
|
-
isPinned: external_exports.boolean(),
|
|
1535
|
-
tags: external_exports.array(external_exports.string().trim().min(1).max(128)).max(256),
|
|
1536
|
-
sortOrder: sortOrderSchema,
|
|
1537
|
-
createdAt: timestampSchema,
|
|
1538
|
-
updatedAt: timestampSchema,
|
|
1539
|
-
archivedAt: timestampSchema.optional()
|
|
1540
|
-
}).strict();
|
|
1541
|
-
var noteCollectionSchema = external_exports.array(noteSchema).max(1e4).superRefine((notes, context) => {
|
|
1542
|
-
const ids = /* @__PURE__ */ new Set();
|
|
1543
|
-
for (const [index, note] of notes.entries()) {
|
|
1544
|
-
if (ids.has(note.id)) {
|
|
1545
|
-
context.addIssue({
|
|
1546
|
-
code: "custom",
|
|
1547
|
-
message: "Note IDs must be unique",
|
|
1548
|
-
path: [index, "id"]
|
|
1549
|
-
});
|
|
1550
|
-
}
|
|
1551
|
-
ids.add(note.id);
|
|
1552
|
-
}
|
|
1553
|
-
});
|
|
1554
|
-
|
|
1555
|
-
// ../../packages/schemas/dist/templates.js
|
|
1556
|
-
var builtInTemplateKeySchema = external_exports.enum([
|
|
1557
|
-
"email",
|
|
1558
|
-
"database",
|
|
1559
|
-
"api-oauth",
|
|
1560
|
-
"server-ssh",
|
|
1561
|
-
"cloud-provider",
|
|
1562
|
-
"git-source-control",
|
|
1563
|
-
"application-environment",
|
|
1564
|
-
"software-license",
|
|
1565
|
-
"secure-note",
|
|
1566
|
-
"custom"
|
|
1567
|
-
]);
|
|
1568
|
-
var groupTemplateSchema = external_exports.object({
|
|
1569
|
-
id: templateIdSchema,
|
|
1570
|
-
name: nonEmptyTextSchema,
|
|
1571
|
-
description: external_exports.string().trim().max(1024).optional(),
|
|
1572
|
-
builtInKey: builtInTemplateKeySchema.optional(),
|
|
1573
|
-
version: templateVersionSchema,
|
|
1574
|
-
fields: external_exports.array(fieldDefinitionSchema).max(1e3),
|
|
1575
|
-
createdAt: timestampSchema,
|
|
1576
|
-
updatedAt: timestampSchema
|
|
1577
|
-
}).strict().superRefine((template, context) => {
|
|
1578
|
-
const ids = /* @__PURE__ */ new Set();
|
|
1579
|
-
const keys = /* @__PURE__ */ new Set();
|
|
1580
|
-
const orders = /* @__PURE__ */ new Set();
|
|
1581
|
-
for (const [index, field] of template.fields.entries()) {
|
|
1582
|
-
if (ids.has(field.id)) {
|
|
1583
|
-
context.addIssue({
|
|
1584
|
-
code: "custom",
|
|
1585
|
-
message: "Field IDs must be unique",
|
|
1586
|
-
path: ["fields", index, "id"]
|
|
1587
|
-
});
|
|
1588
|
-
}
|
|
1589
|
-
if (keys.has(field.stableKey)) {
|
|
1590
|
-
context.addIssue({
|
|
1591
|
-
code: "custom",
|
|
1592
|
-
message: "Stable field keys must be unique",
|
|
1593
|
-
path: ["fields", index, "stableKey"]
|
|
1594
|
-
});
|
|
1595
|
-
}
|
|
1596
|
-
if (orders.has(field.sortOrder)) {
|
|
1597
|
-
context.addIssue({
|
|
1598
|
-
code: "custom",
|
|
1599
|
-
message: "Field sort orders must be unique",
|
|
1600
|
-
path: ["fields", index, "sortOrder"]
|
|
1601
|
-
});
|
|
1602
|
-
}
|
|
1603
|
-
ids.add(field.id);
|
|
1604
|
-
keys.add(field.stableKey);
|
|
1605
|
-
orders.add(field.sortOrder);
|
|
1606
|
-
}
|
|
1607
|
-
});
|
|
1608
|
-
var migrationStepBaseSchema = external_exports.object({
|
|
1609
|
-
affectedItemCount: external_exports.number().int().nonnegative(),
|
|
1610
|
-
requiresConfirmation: external_exports.boolean()
|
|
1611
|
-
});
|
|
1612
|
-
var templateMigrationStepSchema = external_exports.discriminatedUnion("kind", [
|
|
1613
|
-
migrationStepBaseSchema.extend({
|
|
1614
|
-
kind: external_exports.literal("add-field"),
|
|
1615
|
-
field: fieldDefinitionSchema
|
|
1616
|
-
}),
|
|
1617
|
-
migrationStepBaseSchema.extend({
|
|
1618
|
-
kind: external_exports.literal("restore-field"),
|
|
1619
|
-
field: fieldDefinitionSchema
|
|
1620
|
-
}),
|
|
1621
|
-
migrationStepBaseSchema.extend({
|
|
1622
|
-
kind: external_exports.literal("rename-label"),
|
|
1623
|
-
fieldId: fieldIdSchema,
|
|
1624
|
-
fromLabel: nonEmptyTextSchema,
|
|
1625
|
-
toLabel: nonEmptyTextSchema
|
|
1626
|
-
}),
|
|
1627
|
-
migrationStepBaseSchema.extend({
|
|
1628
|
-
kind: external_exports.literal("reorder-field"),
|
|
1629
|
-
fieldId: fieldIdSchema,
|
|
1630
|
-
fromSortOrder: sortOrderSchema,
|
|
1631
|
-
toSortOrder: sortOrderSchema
|
|
1632
|
-
}),
|
|
1633
|
-
migrationStepBaseSchema.extend({
|
|
1634
|
-
kind: external_exports.literal("change-required"),
|
|
1635
|
-
fieldId: fieldIdSchema,
|
|
1636
|
-
fromRequired: external_exports.boolean(),
|
|
1637
|
-
toRequired: external_exports.boolean(),
|
|
1638
|
-
missingValueCount: external_exports.number().int().nonnegative()
|
|
1639
|
-
}),
|
|
1640
|
-
migrationStepBaseSchema.extend({
|
|
1641
|
-
kind: external_exports.literal("update-field-policy"),
|
|
1642
|
-
fieldId: fieldIdSchema,
|
|
1643
|
-
fromField: fieldDefinitionSchema,
|
|
1644
|
-
toField: fieldDefinitionSchema
|
|
1645
|
-
}),
|
|
1646
|
-
migrationStepBaseSchema.extend({
|
|
1647
|
-
kind: external_exports.literal("convert-type"),
|
|
1648
|
-
fieldId: fieldIdSchema,
|
|
1649
|
-
fromField: fieldDefinitionSchema,
|
|
1650
|
-
toField: fieldDefinitionSchema,
|
|
1651
|
-
fromType: fieldTypeSchema,
|
|
1652
|
-
toType: fieldTypeSchema,
|
|
1653
|
-
strategy: external_exports.enum([
|
|
1654
|
-
"identity",
|
|
1655
|
-
"number-to-string",
|
|
1656
|
-
"string-to-number",
|
|
1657
|
-
"boolean-to-string",
|
|
1658
|
-
"string-to-boolean",
|
|
1659
|
-
"archive-incompatible"
|
|
1660
|
-
]),
|
|
1661
|
-
incompatibleValueCount: external_exports.number().int().nonnegative()
|
|
1662
|
-
}),
|
|
1663
|
-
migrationStepBaseSchema.extend({
|
|
1664
|
-
kind: external_exports.literal("archive-field"),
|
|
1665
|
-
field: fieldDefinitionSchema
|
|
1666
|
-
})
|
|
1667
|
-
]);
|
|
1668
|
-
var templateMigrationPlanSchema = external_exports.object({
|
|
1669
|
-
id: templateMigrationIdSchema,
|
|
1670
|
-
fromVersion: templateVersionSchema,
|
|
1671
|
-
toVersion: templateVersionSchema,
|
|
1672
|
-
sourceTemplate: groupTemplateSchema,
|
|
1673
|
-
targetTemplate: groupTemplateSchema,
|
|
1674
|
-
itemSnapshots: external_exports.array(external_exports.object({
|
|
1675
|
-
itemId: itemIdSchema,
|
|
1676
|
-
revision: recordRevisionSchema
|
|
1677
|
-
}).strict()).max(1e6),
|
|
1678
|
-
steps: external_exports.array(templateMigrationStepSchema).max(4e3),
|
|
1679
|
-
status: external_exports.enum(["pending", "running", "completed"]),
|
|
1680
|
-
nextItemIndex: external_exports.number().int().nonnegative(),
|
|
1681
|
-
totalItems: external_exports.number().int().nonnegative(),
|
|
1682
|
-
auditEventId: auditEventIdSchema,
|
|
1683
|
-
createdAt: timestampSchema,
|
|
1684
|
-
updatedAt: timestampSchema
|
|
1685
|
-
}).strict().superRefine((plan, context) => {
|
|
1686
|
-
if (plan.toVersion <= plan.fromVersion) {
|
|
1687
|
-
context.addIssue({
|
|
1688
|
-
code: "custom",
|
|
1689
|
-
message: "Migration target version must be newer",
|
|
1690
|
-
path: ["toVersion"]
|
|
1691
|
-
});
|
|
1692
|
-
}
|
|
1693
|
-
if (plan.targetTemplate.version !== plan.toVersion) {
|
|
1694
|
-
context.addIssue({
|
|
1695
|
-
code: "custom",
|
|
1696
|
-
message: "Target template version must match the migration",
|
|
1697
|
-
path: ["targetTemplate", "version"]
|
|
1698
|
-
});
|
|
1699
|
-
}
|
|
1700
|
-
if (plan.sourceTemplate.version !== plan.fromVersion) {
|
|
1701
|
-
context.addIssue({
|
|
1702
|
-
code: "custom",
|
|
1703
|
-
message: "Source template version must match the migration",
|
|
1704
|
-
path: ["sourceTemplate", "version"]
|
|
1705
|
-
});
|
|
1706
|
-
}
|
|
1707
|
-
if (plan.sourceTemplate.id !== plan.targetTemplate.id) {
|
|
1708
|
-
context.addIssue({
|
|
1709
|
-
code: "custom",
|
|
1710
|
-
message: "A migration cannot change template identity",
|
|
1711
|
-
path: ["targetTemplate", "id"]
|
|
1712
|
-
});
|
|
1713
|
-
}
|
|
1714
|
-
if (plan.itemSnapshots.length !== plan.totalItems) {
|
|
1715
|
-
context.addIssue({
|
|
1716
|
-
code: "custom",
|
|
1717
|
-
message: "Migration item snapshots must match the item count",
|
|
1718
|
-
path: ["itemSnapshots"]
|
|
1719
|
-
});
|
|
1720
|
-
}
|
|
1721
|
-
const snapshotIds = /* @__PURE__ */ new Set();
|
|
1722
|
-
for (const [index, snapshot] of plan.itemSnapshots.entries()) {
|
|
1723
|
-
if (snapshotIds.has(snapshot.itemId)) {
|
|
1724
|
-
context.addIssue({
|
|
1725
|
-
code: "custom",
|
|
1726
|
-
message: "Migration item snapshots must have unique item IDs",
|
|
1727
|
-
path: ["itemSnapshots", index, "itemId"]
|
|
1728
|
-
});
|
|
1729
|
-
}
|
|
1730
|
-
snapshotIds.add(snapshot.itemId);
|
|
1731
|
-
}
|
|
1732
|
-
if (plan.nextItemIndex > plan.totalItems) {
|
|
1733
|
-
context.addIssue({
|
|
1734
|
-
code: "custom",
|
|
1735
|
-
message: "Migration checkpoint exceeds item count",
|
|
1736
|
-
path: ["nextItemIndex"]
|
|
1737
|
-
});
|
|
1738
|
-
}
|
|
1739
|
-
if (plan.status === "completed" && plan.nextItemIndex !== plan.totalItems) {
|
|
1740
|
-
context.addIssue({
|
|
1741
|
-
code: "custom",
|
|
1742
|
-
message: "Completed migration must include every item",
|
|
1743
|
-
path: ["status"]
|
|
1744
|
-
});
|
|
1745
|
-
}
|
|
1746
|
-
});
|
|
1747
|
-
|
|
1748
|
-
// ../../packages/schemas/dist/payloads.js
|
|
1749
|
-
var aliasesSchema = external_exports.array(external_exports.string().trim().min(1).max(256)).max(256);
|
|
1750
|
-
var tagsSchema = external_exports.array(external_exports.string().trim().min(1).max(128)).max(256);
|
|
1751
|
-
var copySequenceIdSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._~-]*$/).brand();
|
|
1752
|
-
var copySequenceSchema = external_exports.object({
|
|
1753
|
-
id: copySequenceIdSchema,
|
|
1754
|
-
name: nonEmptyTextSchema,
|
|
1755
|
-
fieldKeys: external_exports.array(stableFieldKeySchema).min(1).max(100)
|
|
1756
|
-
}).strict().superRefine((sequence, context) => {
|
|
1757
|
-
const keys = /* @__PURE__ */ new Set();
|
|
1758
|
-
for (const [index, key] of sequence.fieldKeys.entries()) {
|
|
1759
|
-
if (keys.has(key)) {
|
|
1760
|
-
context.addIssue({
|
|
1761
|
-
code: "custom",
|
|
1762
|
-
message: "A copy sequence cannot contain the same field twice",
|
|
1763
|
-
path: ["fieldKeys", index]
|
|
1764
|
-
});
|
|
1765
|
-
}
|
|
1766
|
-
keys.add(key);
|
|
1767
|
-
}
|
|
1768
|
-
});
|
|
1769
|
-
var groupPayloadSchema = external_exports.object({
|
|
1770
|
-
id: groupIdSchema,
|
|
1771
|
-
vaultId: vaultIdSchema,
|
|
1772
|
-
name: nonEmptyTextSchema,
|
|
1773
|
-
slug: slugSchema.optional(),
|
|
1774
|
-
aliases: aliasesSchema,
|
|
1775
|
-
description: external_exports.string().trim().max(8192).optional(),
|
|
1776
|
-
icon: external_exports.string().max(64).optional(),
|
|
1777
|
-
colorToken: external_exports.string().max(64).optional(),
|
|
1778
|
-
tags: tagsSchema,
|
|
1779
|
-
notes: noteCollectionSchema,
|
|
1780
|
-
template: groupTemplateSchema,
|
|
1781
|
-
sortOrder: sortOrderSchema,
|
|
1782
|
-
revision: recordRevisionSchema,
|
|
1783
|
-
createdAt: timestampSchema,
|
|
1784
|
-
updatedAt: timestampSchema,
|
|
1785
|
-
archivedAt: timestampSchema.optional(),
|
|
1786
|
-
deletedAt: timestampSchema.optional()
|
|
1787
|
-
}).strict();
|
|
1788
|
-
var itemPayloadV1Schema = external_exports.object({
|
|
1789
|
-
version: external_exports.literal(1),
|
|
1790
|
-
id: itemIdSchema,
|
|
1791
|
-
vaultId: vaultIdSchema,
|
|
1792
|
-
groupId: groupIdSchema,
|
|
1793
|
-
templateId: templateIdSchema,
|
|
1794
|
-
title: nonEmptyTextSchema,
|
|
1795
|
-
slug: slugSchema.optional(),
|
|
1796
|
-
aliases: aliasesSchema,
|
|
1797
|
-
subtitle: external_exports.string().trim().max(512).optional(),
|
|
1798
|
-
templateVersion: templateVersionSchema,
|
|
1799
|
-
templateValues: external_exports.array(storedFieldValueSchema).max(1e3),
|
|
1800
|
-
itemFields: external_exports.array(fieldDefinitionSchema).max(1e3),
|
|
1801
|
-
itemValues: external_exports.array(storedFieldValueSchema).max(1e3),
|
|
1802
|
-
archivedFieldValues: external_exports.array(archivedFieldValueSchema).max(1e4),
|
|
1803
|
-
notes: noteCollectionSchema,
|
|
1804
|
-
tags: tagsSchema,
|
|
1805
|
-
favorite: external_exports.boolean(),
|
|
1806
|
-
environment: external_exports.string().trim().max(128).optional(),
|
|
1807
|
-
owner: external_exports.string().trim().min(1).max(512).optional(),
|
|
1808
|
-
purpose: external_exports.string().trim().min(1).max(2048).optional(),
|
|
1809
|
-
productionSensitive: external_exports.boolean(),
|
|
1810
|
-
expiresAt: timestampSchema.optional(),
|
|
1811
|
-
rotationIntervalDays: external_exports.number().int().positive().max(36500).optional(),
|
|
1812
|
-
lastRotatedAt: timestampSchema.optional(),
|
|
1813
|
-
lastVerifiedAt: timestampSchema.optional(),
|
|
1814
|
-
relatedItemIds: external_exports.array(itemIdSchema).max(1e3),
|
|
1815
|
-
attachmentIds: external_exports.array(attachmentIdSchema).max(1e3),
|
|
1816
|
-
copySequences: external_exports.array(copySequenceSchema).max(100),
|
|
1817
|
-
revision: recordRevisionSchema,
|
|
1818
|
-
createdAt: timestampSchema,
|
|
1819
|
-
updatedAt: timestampSchema,
|
|
1820
|
-
archivedAt: timestampSchema.optional(),
|
|
1821
|
-
deletedAt: timestampSchema.optional()
|
|
1822
|
-
}).strict().superRefine((item, context) => {
|
|
1823
|
-
const fieldIds = /* @__PURE__ */ new Set();
|
|
1824
|
-
const stableKeys = /* @__PURE__ */ new Set();
|
|
1825
|
-
const templateFieldIds = /* @__PURE__ */ new Set();
|
|
1826
|
-
const templateStableKeys = /* @__PURE__ */ new Set();
|
|
1827
|
-
for (const [index, value] of [
|
|
1828
|
-
...item.templateValues,
|
|
1829
|
-
...item.itemValues
|
|
1830
|
-
].entries()) {
|
|
1831
|
-
if (fieldIds.has(value.fieldId) || stableKeys.has(value.stableKey)) {
|
|
1832
|
-
context.addIssue({
|
|
1833
|
-
code: "custom",
|
|
1834
|
-
message: "Active field values must have unique IDs and stable keys",
|
|
1835
|
-
path: ["templateValues", index]
|
|
1836
|
-
});
|
|
1837
|
-
}
|
|
1838
|
-
fieldIds.add(value.fieldId);
|
|
1839
|
-
stableKeys.add(value.stableKey);
|
|
1840
|
-
if (index < item.templateValues.length) {
|
|
1841
|
-
templateFieldIds.add(value.fieldId);
|
|
1842
|
-
templateStableKeys.add(value.stableKey);
|
|
1843
|
-
}
|
|
1844
|
-
}
|
|
1845
|
-
const itemDefinitionsById = /* @__PURE__ */ new Map();
|
|
1846
|
-
const itemDefinitionKeys = /* @__PURE__ */ new Set();
|
|
1847
|
-
for (const [index, definition] of item.itemFields.entries()) {
|
|
1848
|
-
if (itemDefinitionsById.has(definition.id) || itemDefinitionKeys.has(definition.stableKey) || templateFieldIds.has(definition.id) || templateStableKeys.has(definition.stableKey)) {
|
|
1849
|
-
context.addIssue({
|
|
1850
|
-
code: "custom",
|
|
1851
|
-
message: "Item-only field definitions must be unique and cannot shadow template fields",
|
|
1852
|
-
path: ["itemFields", index]
|
|
1853
|
-
});
|
|
1854
|
-
}
|
|
1855
|
-
itemDefinitionsById.set(definition.id, definition);
|
|
1856
|
-
itemDefinitionKeys.add(definition.stableKey);
|
|
1857
|
-
}
|
|
1858
|
-
const itemValueIds = /* @__PURE__ */ new Set();
|
|
1859
|
-
for (const [index, value] of item.itemValues.entries()) {
|
|
1860
|
-
const definition = itemDefinitionsById.get(value.fieldId);
|
|
1861
|
-
const definitionMatches = definition?.stableKey === value.stableKey && fieldValueMatchesDefinition(definition, value.value);
|
|
1862
|
-
if (itemValueIds.has(value.fieldId) || !definitionMatches) {
|
|
1863
|
-
context.addIssue({
|
|
1864
|
-
code: "custom",
|
|
1865
|
-
message: "Item-only values must match one unique item-only definition",
|
|
1866
|
-
path: ["itemValues", index]
|
|
1867
|
-
});
|
|
1868
|
-
}
|
|
1869
|
-
itemValueIds.add(value.fieldId);
|
|
1870
|
-
}
|
|
1871
|
-
for (const [index, definition] of item.itemFields.entries()) {
|
|
1872
|
-
const stored = item.itemValues.find((value) => value.fieldId === definition.id);
|
|
1873
|
-
if (definition.required && (stored === void 0 || !fieldValueMatchesDefinition(definition, stored.value))) {
|
|
1874
|
-
context.addIssue({
|
|
1875
|
-
code: "custom",
|
|
1876
|
-
message: "Required item-only fields must have a value",
|
|
1877
|
-
path: ["itemFields", index]
|
|
1878
|
-
});
|
|
1879
|
-
}
|
|
1880
|
-
}
|
|
1881
|
-
const activeDefinitionIds = /* @__PURE__ */ new Set([
|
|
1882
|
-
...item.templateValues.map(({ fieldId }) => fieldId),
|
|
1883
|
-
...item.itemFields.map(({ id }) => id)
|
|
1884
|
-
]);
|
|
1885
|
-
const activeDefinitionKeys = /* @__PURE__ */ new Set([
|
|
1886
|
-
...item.templateValues.map(({ stableKey }) => stableKey),
|
|
1887
|
-
...item.itemFields.map(({ stableKey }) => stableKey)
|
|
1888
|
-
]);
|
|
1889
|
-
const archivedIds = /* @__PURE__ */ new Set();
|
|
1890
|
-
const archivedKeys = /* @__PURE__ */ new Set();
|
|
1891
|
-
for (const [index, archived] of item.archivedFieldValues.entries()) {
|
|
1892
|
-
if (archivedIds.has(archived.definition.id) || archivedKeys.has(archived.definition.stableKey) || activeDefinitionIds.has(archived.definition.id) || activeDefinitionKeys.has(archived.definition.stableKey)) {
|
|
1893
|
-
context.addIssue({
|
|
1894
|
-
code: "custom",
|
|
1895
|
-
message: "Archived field IDs and stable keys must be unique and disjoint from active fields",
|
|
1896
|
-
path: ["archivedFieldValues", index]
|
|
1897
|
-
});
|
|
1898
|
-
}
|
|
1899
|
-
archivedIds.add(archived.definition.id);
|
|
1900
|
-
archivedKeys.add(archived.definition.stableKey);
|
|
1901
|
-
}
|
|
1902
|
-
const relatedItemIds = /* @__PURE__ */ new Set();
|
|
1903
|
-
for (const [index, relatedItemId] of item.relatedItemIds.entries()) {
|
|
1904
|
-
if (relatedItemId === item.id || relatedItemIds.has(relatedItemId)) {
|
|
1905
|
-
context.addIssue({
|
|
1906
|
-
code: "custom",
|
|
1907
|
-
message: "Related item IDs must be unique and cannot reference the item itself",
|
|
1908
|
-
path: ["relatedItemIds", index]
|
|
1909
|
-
});
|
|
1910
|
-
}
|
|
1911
|
-
relatedItemIds.add(relatedItemId);
|
|
1912
|
-
}
|
|
1913
|
-
const attachmentIds = /* @__PURE__ */ new Set();
|
|
1914
|
-
for (const [index, attachmentId] of item.attachmentIds.entries()) {
|
|
1915
|
-
if (attachmentIds.has(attachmentId)) {
|
|
1916
|
-
context.addIssue({
|
|
1917
|
-
code: "custom",
|
|
1918
|
-
message: "Attachment IDs must be unique",
|
|
1919
|
-
path: ["attachmentIds", index]
|
|
1920
|
-
});
|
|
1921
|
-
}
|
|
1922
|
-
attachmentIds.add(attachmentId);
|
|
1923
|
-
}
|
|
1924
|
-
for (const [collectionName, values] of [
|
|
1925
|
-
["templateValues", item.templateValues],
|
|
1926
|
-
["itemValues", item.itemValues]
|
|
1927
|
-
]) {
|
|
1928
|
-
for (const [valueIndex, stored] of values.entries()) {
|
|
1929
|
-
for (const reference of referencedEntities(stored.value)) {
|
|
1930
|
-
const valid = reference.kind === "item-reference" ? relatedItemIds.has(reference.itemId) : attachmentIds.has(reference.attachmentId);
|
|
1931
|
-
if (!valid) {
|
|
1932
|
-
context.addIssue({
|
|
1933
|
-
code: "custom",
|
|
1934
|
-
message: "Field references must resolve through the item reference lists",
|
|
1935
|
-
path: [collectionName, valueIndex, "value"]
|
|
1936
|
-
});
|
|
1937
|
-
}
|
|
1938
|
-
}
|
|
1939
|
-
}
|
|
1940
|
-
}
|
|
1941
|
-
const activeKeys = /* @__PURE__ */ new Set([
|
|
1942
|
-
...item.templateValues.map(({ stableKey }) => stableKey),
|
|
1943
|
-
...item.itemFields.map(({ stableKey }) => stableKey)
|
|
1944
|
-
]);
|
|
1945
|
-
const sequenceIds = /* @__PURE__ */ new Set();
|
|
1946
|
-
for (const [index, sequence] of item.copySequences.entries()) {
|
|
1947
|
-
if (sequenceIds.has(sequence.id)) {
|
|
1948
|
-
context.addIssue({
|
|
1949
|
-
code: "custom",
|
|
1950
|
-
message: "Copy sequence IDs must be unique",
|
|
1951
|
-
path: ["copySequences", index, "id"]
|
|
1952
|
-
});
|
|
1953
|
-
}
|
|
1954
|
-
sequenceIds.add(sequence.id);
|
|
1955
|
-
if (sequence.fieldKeys.some((key) => !activeKeys.has(key))) {
|
|
1956
|
-
context.addIssue({
|
|
1957
|
-
code: "custom",
|
|
1958
|
-
message: "Copy sequences may contain only active stable field keys",
|
|
1959
|
-
path: ["copySequences", index, "fieldKeys"]
|
|
1960
|
-
});
|
|
1961
|
-
}
|
|
1962
|
-
}
|
|
1963
|
-
});
|
|
1964
|
-
var itemPayloadSchema = itemPayloadV1Schema;
|
|
1965
|
-
function referencedEntities(value) {
|
|
1966
|
-
if (value.state !== "present")
|
|
1967
|
-
return [];
|
|
1968
|
-
const scalars = value.content.cardinality === "single" ? [value.content.value] : value.content.elements.map(({ value: scalar }) => scalar);
|
|
1969
|
-
const references = [];
|
|
1970
|
-
for (const scalar of scalars) {
|
|
1971
|
-
if (scalar.kind === "item-reference")
|
|
1972
|
-
references.push(scalar);
|
|
1973
|
-
if (scalar.kind === "attachment-reference")
|
|
1974
|
-
references.push(scalar);
|
|
1975
|
-
}
|
|
1976
|
-
return references;
|
|
1977
|
-
}
|
|
1978
|
-
var vaultPreferencesSchema = external_exports.object({
|
|
1979
|
-
productLabel: nonEmptyTextSchema,
|
|
1980
|
-
executableName: external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9_-]+$/),
|
|
1981
|
-
clipboardClearSeconds: external_exports.number().int().min(1).max(3600),
|
|
1982
|
-
revealHideSeconds: external_exports.number().int().min(1).max(3600),
|
|
1983
|
-
historyRetentionDays: external_exports.number().int().min(1).max(36500),
|
|
1984
|
-
telemetryEnabled: external_exports.literal(false)
|
|
1985
|
-
}).strict();
|
|
1986
|
-
|
|
1987
|
-
// ../../packages/schemas/dist/local-vault.js
|
|
1988
|
-
var localVaultFormatSchema = external_exports.literal("kavrix-local-vault");
|
|
1989
|
-
var CURRENT_LOCAL_VAULT_VERSION = 2;
|
|
1990
|
-
var localVaultVersionSchema = external_exports.literal(CURRENT_LOCAL_VAULT_VERSION);
|
|
1991
|
-
var MAX_LOCAL_RECOVERY_SLOTS = 32;
|
|
1992
|
-
var localRecoveryKeySlotSchema = keySlotSchema.refine((slot) => slot.type === "recovery-key", { error: "Local recovery slots require recovery-key material" });
|
|
1993
|
-
var localVaultValueSchema = external_exports.object({
|
|
1994
|
-
value: maxTextBytesSchema,
|
|
1995
|
-
updatedAt: timestampSchema
|
|
1996
|
-
}).strict();
|
|
1997
|
-
var localVaultPayloadSchema = external_exports.object({
|
|
1998
|
-
records: external_exports.record(external_exports.string().min(1).max(256), localVaultValueSchema)
|
|
1999
|
-
}).strict().superRefine((payload, context) => {
|
|
2000
|
-
if (Object.keys(payload.records).length > 1e4) {
|
|
2001
|
-
context.addIssue({
|
|
2002
|
-
code: "custom",
|
|
2003
|
-
message: "Local vault contains too many credentials",
|
|
2004
|
-
path: ["records"]
|
|
2005
|
-
});
|
|
2006
|
-
}
|
|
2007
|
-
});
|
|
2008
|
-
var localVaultDocumentSchema = external_exports.object({
|
|
2009
|
-
format: localVaultFormatSchema,
|
|
2010
|
-
version: localVaultVersionSchema,
|
|
2011
|
-
id: vaultIdSchema,
|
|
2012
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
2013
|
-
cryptographicVersion: supportedCryptographicVersionSchema,
|
|
2014
|
-
currentKeyVersion: keyVersionSchema,
|
|
2015
|
-
keySlot: keySlotSchema,
|
|
2016
|
-
recoverySlots: external_exports.array(localRecoveryKeySlotSchema).max(MAX_LOCAL_RECOVERY_SLOTS).default([]),
|
|
2017
|
-
revision: vaultRevisionSchema,
|
|
2018
|
-
encryptedPayload: aeadEnvelopeSchema,
|
|
2019
|
-
createdAt: timestampSchema,
|
|
2020
|
-
updatedAt: timestampSchema
|
|
2021
|
-
}).strict().superRefine((document, context) => {
|
|
2022
|
-
if (document.schemaVersion !== CURRENT_SCHEMA_VERSION) {
|
|
2023
|
-
context.addIssue({
|
|
2024
|
-
code: "custom",
|
|
2025
|
-
message: "Unsupported local vault schema version",
|
|
2026
|
-
path: ["schemaVersion"]
|
|
2027
|
-
});
|
|
2028
|
-
}
|
|
2029
|
-
if (document.cryptographicVersion !== CURRENT_CRYPTOGRAPHIC_VERSION) {
|
|
2030
|
-
context.addIssue({
|
|
2031
|
-
code: "custom",
|
|
2032
|
-
message: "Unsupported local vault cryptographic version",
|
|
2033
|
-
path: ["cryptographicVersion"]
|
|
2034
|
-
});
|
|
2035
|
-
}
|
|
2036
|
-
if (document.keySlot.type !== "portable-key") {
|
|
2037
|
-
context.addIssue({
|
|
2038
|
-
code: "custom",
|
|
2039
|
-
message: "Local vaults require a portable-key unlock slot",
|
|
2040
|
-
path: ["keySlot", "type"]
|
|
2041
|
-
});
|
|
2042
|
-
} else {
|
|
2043
|
-
if (document.keySlot.state !== "active") {
|
|
2044
|
-
context.addIssue({
|
|
2045
|
-
code: "custom",
|
|
2046
|
-
message: "Local vault unlock slot must be active",
|
|
2047
|
-
path: ["keySlot", "state"]
|
|
2048
|
-
});
|
|
2049
|
-
}
|
|
2050
|
-
if (document.keySlot.keyVersion !== document.currentKeyVersion) {
|
|
2051
|
-
context.addIssue({
|
|
2052
|
-
code: "custom",
|
|
2053
|
-
message: "Local vault key versions do not agree",
|
|
2054
|
-
path: ["keySlot", "keyVersion"]
|
|
2055
|
-
});
|
|
2056
|
-
}
|
|
2057
|
-
if (document.keySlot.wrappedRootKey.aad.vaultId !== document.id) {
|
|
2058
|
-
context.addIssue({
|
|
2059
|
-
code: "custom",
|
|
2060
|
-
message: "Local vault key slot belongs to another vault",
|
|
2061
|
-
path: ["keySlot", "wrappedRootKey", "aad", "vaultId"]
|
|
2062
|
-
});
|
|
2063
|
-
}
|
|
2064
|
-
}
|
|
2065
|
-
const slotIds = /* @__PURE__ */ new Set([document.keySlot.id]);
|
|
2066
|
-
for (const [index, slot] of document.recoverySlots.entries()) {
|
|
2067
|
-
if (slotIds.has(slot.id)) {
|
|
2068
|
-
context.addIssue({
|
|
2069
|
-
code: "custom",
|
|
2070
|
-
message: "Local key slot IDs must be unique",
|
|
2071
|
-
path: ["recoverySlots", index, "id"]
|
|
2072
|
-
});
|
|
2073
|
-
}
|
|
2074
|
-
slotIds.add(slot.id);
|
|
2075
|
-
if (slot.keyVersion !== document.currentKeyVersion) {
|
|
2076
|
-
context.addIssue({
|
|
2077
|
-
code: "custom",
|
|
2078
|
-
message: "Local recovery slot key version does not match the vault",
|
|
2079
|
-
path: ["recoverySlots", index, "keyVersion"]
|
|
2080
|
-
});
|
|
2081
|
-
}
|
|
2082
|
-
if (slot.wrappedRootKey.aad.vaultId !== document.id) {
|
|
2083
|
-
context.addIssue({
|
|
2084
|
-
code: "custom",
|
|
2085
|
-
message: "Local recovery slot belongs to another vault",
|
|
2086
|
-
path: ["recoverySlots", index, "wrappedRootKey", "aad", "vaultId"]
|
|
2087
|
-
});
|
|
2088
|
-
}
|
|
2089
|
-
if (slot.wrappedRootKey.aad.schemaVersion !== document.schemaVersion) {
|
|
2090
|
-
context.addIssue({
|
|
2091
|
-
code: "custom",
|
|
2092
|
-
message: "Local recovery slot schema version does not match the vault",
|
|
2093
|
-
path: ["recoverySlots", index, "wrappedRootKey", "aad", "schemaVersion"]
|
|
2094
|
-
});
|
|
2095
|
-
}
|
|
2096
|
-
if (slot.state !== "active" && slot.state !== "revoked") {
|
|
2097
|
-
context.addIssue({
|
|
2098
|
-
code: "custom",
|
|
2099
|
-
message: "Local recovery slots must be active or revoked",
|
|
2100
|
-
path: ["recoverySlots", index, "state"]
|
|
2101
|
-
});
|
|
2102
|
-
}
|
|
2103
|
-
}
|
|
2104
|
-
const aad = document.encryptedPayload.aad;
|
|
2105
|
-
if (aad.revision === void 0 || aad.metadataDigest === void 0 || aad.revision !== document.revision) {
|
|
2106
|
-
context.addIssue({
|
|
2107
|
-
code: "custom",
|
|
2108
|
-
message: "Local vault payload metadata binding is invalid",
|
|
2109
|
-
path: ["encryptedPayload", "aad"]
|
|
2110
|
-
});
|
|
2111
|
-
}
|
|
2112
|
-
if (aad.vaultId !== document.id || aad.entityId !== document.id || aad.schemaVersion !== document.schemaVersion || aad.keyVersion !== document.currentKeyVersion) {
|
|
2113
|
-
context.addIssue({
|
|
2114
|
-
code: "custom",
|
|
2115
|
-
message: "Local vault payload has invalid associated data",
|
|
2116
|
-
path: ["encryptedPayload", "aad"]
|
|
2117
|
-
});
|
|
2118
|
-
}
|
|
2119
|
-
});
|
|
2120
|
-
|
|
2121
|
-
// ../../packages/schemas/dist/authorization.js
|
|
2122
|
-
var API_SCOPE_VALUES = Object.freeze([
|
|
2123
|
-
"sync:read",
|
|
2124
|
-
"sync:write",
|
|
2125
|
-
"device:manage"
|
|
2126
|
-
]);
|
|
2127
|
-
var MIN_API_SCOPES = 1;
|
|
2128
|
-
var MAX_API_SCOPES = API_SCOPE_VALUES.length;
|
|
2129
|
-
var apiScopeSchema = external_exports.enum(API_SCOPE_VALUES);
|
|
2130
|
-
var apiScopesSchema = external_exports.array(apiScopeSchema).min(MIN_API_SCOPES).max(MAX_API_SCOPES).superRefine((scopes, context) => {
|
|
2131
|
-
if (new Set(scopes).size !== scopes.length) {
|
|
2132
|
-
context.addIssue({
|
|
2133
|
-
code: "custom",
|
|
2134
|
-
message: "API scopes must be unique"
|
|
2135
|
-
});
|
|
2136
|
-
}
|
|
2137
|
-
});
|
|
2138
|
-
|
|
2139
|
-
// ../../packages/schemas/dist/sync.js
|
|
2140
|
-
var MIN_IDEMPOTENCY_KEY_CHARS = 16;
|
|
2141
|
-
var MAX_IDEMPOTENCY_KEY_CHARS = 256;
|
|
2142
|
-
var syncEntityTypeSchema = external_exports.enum(["vault", "group", "item", "attachment"]);
|
|
2143
|
-
var syncOperationSchema = external_exports.enum(["upsert", "tombstone", "restore", "purge"]);
|
|
2144
|
-
var changeRecordBaseSchema = external_exports.object({
|
|
2145
|
-
id: changeIdSchema,
|
|
2146
|
-
vaultId: vaultIdSchema,
|
|
2147
|
-
serverSequence: changeSequenceSchema,
|
|
2148
|
-
recordRevision: recordRevisionSchema,
|
|
2149
|
-
operation: syncOperationSchema,
|
|
2150
|
-
ciphertextHash: sha256DigestSchema.optional(),
|
|
2151
|
-
createdAt: timestampSchema
|
|
2152
|
-
}).strict();
|
|
2153
|
-
var changeRecordSchema = external_exports.discriminatedUnion("entityType", [
|
|
2154
|
-
changeRecordBaseSchema.extend({
|
|
2155
|
-
entityType: external_exports.literal("vault"),
|
|
2156
|
-
entityId: vaultIdSchema
|
|
2157
|
-
}),
|
|
2158
|
-
changeRecordBaseSchema.extend({
|
|
2159
|
-
entityType: external_exports.literal("group"),
|
|
2160
|
-
entityId: groupIdSchema
|
|
2161
|
-
}),
|
|
2162
|
-
changeRecordBaseSchema.extend({
|
|
2163
|
-
entityType: external_exports.literal("item"),
|
|
2164
|
-
entityId: itemIdSchema
|
|
2165
|
-
}),
|
|
2166
|
-
changeRecordBaseSchema.extend({
|
|
2167
|
-
entityType: external_exports.literal("attachment"),
|
|
2168
|
-
entityId: attachmentIdSchema
|
|
2169
|
-
})
|
|
2170
|
-
]).superRefine((change, context) => {
|
|
2171
|
-
if (change.serverSequence === 0) {
|
|
2172
|
-
context.addIssue({
|
|
2173
|
-
code: "custom",
|
|
2174
|
-
message: "Change records require a positive server sequence",
|
|
2175
|
-
path: ["serverSequence"]
|
|
2176
|
-
});
|
|
2177
|
-
}
|
|
2178
|
-
if (change.operation !== "purge" && change.ciphertextHash === void 0) {
|
|
2179
|
-
context.addIssue({
|
|
2180
|
-
code: "custom",
|
|
2181
|
-
message: "Non-purge changes require the applicable content hash",
|
|
2182
|
-
path: ["ciphertextHash"]
|
|
2183
|
-
});
|
|
2184
|
-
}
|
|
2185
|
-
if (change.entityType === "vault" && change.entityId !== change.vaultId) {
|
|
2186
|
-
context.addIssue({
|
|
2187
|
-
code: "custom",
|
|
2188
|
-
message: "A vault change must identify its containing vault",
|
|
2189
|
-
path: ["entityId"]
|
|
2190
|
-
});
|
|
2191
|
-
}
|
|
2192
|
-
});
|
|
2193
|
-
var publicDeviceRecordObjectSchema = external_exports.object({
|
|
2194
|
-
id: deviceIdSchema,
|
|
2195
|
-
vaultId: vaultIdSchema,
|
|
2196
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
2197
|
-
tokenVersion: supportedTokenVersionSchema,
|
|
2198
|
-
encryptedLabel: encryptedDeviceLabelSchema.optional(),
|
|
2199
|
-
scopes: apiScopesSchema,
|
|
2200
|
-
createdAt: timestampSchema,
|
|
2201
|
-
lastSeenAt: timestampSchema.optional(),
|
|
2202
|
-
revokedAt: timestampSchema.optional()
|
|
2203
|
-
}).strict();
|
|
2204
|
-
function validateDeviceBinding(device, context) {
|
|
2205
|
-
if (device.encryptedLabel !== void 0 && (device.encryptedLabel.aad.vaultId !== device.vaultId || device.encryptedLabel.aad.schemaVersion !== device.schemaVersion || device.encryptedLabel.aad.entityType !== "device-label" || device.encryptedLabel.aad.entityId !== device.id)) {
|
|
2206
|
-
context.addIssue({
|
|
2207
|
-
code: "custom",
|
|
2208
|
-
message: "Encrypted device label has invalid associated data",
|
|
2209
|
-
path: ["encryptedLabel", "aad"]
|
|
2210
|
-
});
|
|
2211
|
-
}
|
|
2212
|
-
}
|
|
2213
|
-
var publicDeviceRecordSchema = publicDeviceRecordObjectSchema.superRefine(validateDeviceBinding);
|
|
2214
|
-
var deviceRecordSchema = publicDeviceRecordObjectSchema.extend({ tokenHash: sha256DigestSchema }).superRefine(validateDeviceBinding);
|
|
2215
|
-
var outboundObservationKindSchema = external_exports.enum([
|
|
2216
|
-
"generic-push",
|
|
2217
|
-
"template-publication"
|
|
2218
|
-
]);
|
|
2219
|
-
var outboundObservationContentObjectSchema = external_exports.object({
|
|
2220
|
-
version: external_exports.literal(1),
|
|
2221
|
-
kind: outboundObservationKindSchema,
|
|
2222
|
-
batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2223
|
-
requestHash: sha256DigestSchema,
|
|
2224
|
-
responseHash: sha256DigestSchema,
|
|
2225
|
-
responseVaultRevision: vaultRevisionSchema,
|
|
2226
|
-
replayFromServerSequence: changeSequenceSchema,
|
|
2227
|
-
requiredThroughServerSequence: changeSequenceSchema
|
|
2228
|
-
}).strict();
|
|
2229
|
-
function validateObservationSequence(observation, context) {
|
|
2230
|
-
if (observation.requiredThroughServerSequence < observation.replayFromServerSequence) {
|
|
2231
|
-
context.addIssue({
|
|
2232
|
-
code: "custom",
|
|
2233
|
-
message: "The required sequence cannot precede the replay start",
|
|
2234
|
-
path: ["requiredThroughServerSequence"]
|
|
2235
|
-
});
|
|
2236
|
-
}
|
|
2237
|
-
}
|
|
2238
|
-
var outboundObservationContentSchema = outboundObservationContentObjectSchema.superRefine(validateObservationSequence);
|
|
2239
|
-
var outboundObservationSchema = outboundObservationContentObjectSchema.extend({ observationId: sha256DigestSchema }).strict().superRefine(validateObservationSequence);
|
|
2240
|
-
var protectedLocalDeviceStateSchema = external_exports.object({
|
|
2241
|
-
version: external_exports.literal(2),
|
|
2242
|
-
vaultId: vaultIdSchema,
|
|
2243
|
-
deviceId: deviceIdSchema,
|
|
2244
|
-
highestSeenVaultRevision: vaultRevisionSchema,
|
|
2245
|
-
updatedAt: timestampSchema,
|
|
2246
|
-
outboundObservation: outboundObservationSchema.optional(),
|
|
2247
|
-
lastCompletedObservationId: sha256DigestSchema.optional()
|
|
2248
|
-
}).strict().superRefine((state, context) => {
|
|
2249
|
-
if (state.outboundObservation !== void 0 && state.outboundObservation.responseVaultRevision > state.highestSeenVaultRevision) {
|
|
2250
|
-
context.addIssue({
|
|
2251
|
-
code: "custom",
|
|
2252
|
-
message: "The protected anchor must include the observed response revision",
|
|
2253
|
-
path: ["highestSeenVaultRevision"]
|
|
2254
|
-
});
|
|
2255
|
-
}
|
|
2256
|
-
});
|
|
2257
|
-
var tombstoneRecordBaseSchema = external_exports.object({
|
|
2258
|
-
vaultId: vaultIdSchema,
|
|
2259
|
-
state: external_exports.enum(["deleted", "restored"]),
|
|
2260
|
-
tombstoneRevision: recordRevisionSchema,
|
|
2261
|
-
lastRecordRevision: recordRevisionSchema,
|
|
2262
|
-
lastCiphertextHash: sha256DigestSchema,
|
|
2263
|
-
deletedAt: timestampSchema,
|
|
2264
|
-
restoredAt: timestampSchema.optional(),
|
|
2265
|
-
purgeAfter: timestampSchema.optional()
|
|
2266
|
-
}).strict();
|
|
2267
|
-
var tombstoneRecordSchema = external_exports.discriminatedUnion("entityType", [
|
|
2268
|
-
tombstoneRecordBaseSchema.extend({
|
|
2269
|
-
entityType: external_exports.literal("vault"),
|
|
2270
|
-
entityId: vaultIdSchema
|
|
2271
|
-
}),
|
|
2272
|
-
tombstoneRecordBaseSchema.extend({
|
|
2273
|
-
entityType: external_exports.literal("group"),
|
|
2274
|
-
entityId: groupIdSchema
|
|
2275
|
-
}),
|
|
2276
|
-
tombstoneRecordBaseSchema.extend({
|
|
2277
|
-
entityType: external_exports.literal("item"),
|
|
2278
|
-
entityId: itemIdSchema
|
|
2279
|
-
}),
|
|
2280
|
-
tombstoneRecordBaseSchema.extend({
|
|
2281
|
-
entityType: external_exports.literal("attachment"),
|
|
2282
|
-
entityId: attachmentIdSchema
|
|
2283
|
-
})
|
|
2284
|
-
]).superRefine((tombstone, context) => {
|
|
2285
|
-
if (tombstone.tombstoneRevision <= tombstone.lastRecordRevision) {
|
|
2286
|
-
context.addIssue({
|
|
2287
|
-
code: "custom",
|
|
2288
|
-
message: "Tombstone revision must be newer than the deleted record",
|
|
2289
|
-
path: ["tombstoneRevision"]
|
|
2290
|
-
});
|
|
2291
|
-
}
|
|
2292
|
-
if (tombstone.entityType === "vault" && tombstone.entityId !== tombstone.vaultId) {
|
|
2293
|
-
context.addIssue({
|
|
2294
|
-
code: "custom",
|
|
2295
|
-
message: "A vault tombstone must identify its containing vault",
|
|
2296
|
-
path: ["entityId"]
|
|
2297
|
-
});
|
|
2298
|
-
}
|
|
2299
|
-
if (tombstone.state === "restored" && tombstone.restoredAt === void 0) {
|
|
2300
|
-
context.addIssue({
|
|
2301
|
-
code: "custom",
|
|
2302
|
-
message: "Restored tombstones require a restoration timestamp",
|
|
2303
|
-
path: ["restoredAt"]
|
|
2304
|
-
});
|
|
2305
|
-
}
|
|
2306
|
-
if (tombstone.state === "deleted" && tombstone.restoredAt !== void 0) {
|
|
2307
|
-
context.addIssue({
|
|
2308
|
-
code: "custom",
|
|
2309
|
-
message: "Deleted tombstones cannot have a restoration timestamp",
|
|
2310
|
-
path: ["restoredAt"]
|
|
2311
|
-
});
|
|
2312
|
-
}
|
|
2313
|
-
if (tombstone.state === "restored" && tombstone.purgeAfter !== void 0) {
|
|
2314
|
-
context.addIssue({
|
|
2315
|
-
code: "custom",
|
|
2316
|
-
message: "Restored tombstones cannot remain scheduled for purge",
|
|
2317
|
-
path: ["purgeAfter"]
|
|
2318
|
-
});
|
|
2319
|
-
}
|
|
2320
|
-
});
|
|
2321
|
-
var opaqueMutationSchema = external_exports.discriminatedUnion("entityType", [
|
|
2322
|
-
external_exports.object({
|
|
2323
|
-
entityType: external_exports.literal("vault"),
|
|
2324
|
-
expectedVaultRevision: vaultRevisionSchema.nullable(),
|
|
2325
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2326
|
-
record: vaultRecordSchema
|
|
2327
|
-
}).strict(),
|
|
2328
|
-
external_exports.object({
|
|
2329
|
-
entityType: external_exports.literal("group"),
|
|
2330
|
-
expectedRecordRevision: recordRevisionSchema.nullable(),
|
|
2331
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2332
|
-
record: encryptedGroupRecordSchema
|
|
2333
|
-
}).strict(),
|
|
2334
|
-
external_exports.object({
|
|
2335
|
-
entityType: external_exports.literal("item"),
|
|
2336
|
-
expectedRecordRevision: recordRevisionSchema.nullable(),
|
|
2337
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2338
|
-
record: encryptedItemRecordSchema
|
|
2339
|
-
}).strict()
|
|
2340
|
-
]);
|
|
2341
|
-
var attachmentStreamStartInputSchema = external_exports.object({
|
|
2342
|
-
version: external_exports.literal(1),
|
|
2343
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2344
|
-
expectedAttachmentRevision: recordRevisionSchema.nullable(),
|
|
2345
|
-
header: persistedAttachmentHeaderRecordSchema
|
|
2346
|
-
}).strict().superRefine((input, context) => {
|
|
2347
|
-
const expectedNewRevision = input.expectedAttachmentRevision === null ? 0 : input.expectedAttachmentRevision + 1;
|
|
2348
|
-
if (input.header.recordRevision !== expectedNewRevision) {
|
|
2349
|
-
context.addIssue({
|
|
2350
|
-
code: "custom",
|
|
2351
|
-
message: "Staged header revision must immediately follow the expected attachment",
|
|
2352
|
-
path: ["header", "recordRevision"]
|
|
2353
|
-
});
|
|
2354
|
-
}
|
|
2355
|
-
if (attachmentHeaderContentHash(input.header) !== input.header.contentHash) {
|
|
2356
|
-
context.addIssue({
|
|
2357
|
-
code: "custom",
|
|
2358
|
-
message: "Staged attachment headers require their exact canonical content hash",
|
|
2359
|
-
path: ["header", "contentHash"]
|
|
2360
|
-
});
|
|
2361
|
-
}
|
|
2362
|
-
});
|
|
2363
|
-
var attachmentStreamProgressCountersSchema = external_exports.object({
|
|
2364
|
-
version: external_exports.literal(1),
|
|
2365
|
-
nextChunkIndex: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS),
|
|
2366
|
-
totalPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_STREAM_PLAINTEXT_BYTES),
|
|
2367
|
-
totalCiphertextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_STREAM_CIPHERTEXT_BYTES)
|
|
2368
|
-
});
|
|
2369
|
-
var attachmentStreamProgressSchema = external_exports.discriminatedUnion("state", [
|
|
2370
|
-
attachmentStreamProgressCountersSchema.extend({
|
|
2371
|
-
state: external_exports.literal("empty"),
|
|
2372
|
-
nextChunkIndex: external_exports.literal(0),
|
|
2373
|
-
totalPlaintextBytes: external_exports.literal(0),
|
|
2374
|
-
totalCiphertextBytes: external_exports.literal(0)
|
|
2375
|
-
}).strict(),
|
|
2376
|
-
attachmentStreamProgressCountersSchema.extend({
|
|
2377
|
-
state: external_exports.literal("writing"),
|
|
2378
|
-
nextChunkIndex: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
|
|
2379
|
-
lastChunkIndex: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS - 1),
|
|
2380
|
-
lastChunkCiphertextHash: sha256DigestSchema,
|
|
2381
|
-
lastChunkPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES)
|
|
2382
|
-
}).strict(),
|
|
2383
|
-
attachmentStreamProgressCountersSchema.extend({
|
|
2384
|
-
state: external_exports.literal("ready-to-finalize"),
|
|
2385
|
-
nextChunkIndex: external_exports.number().int().positive().max(MAX_ATTACHMENT_CHUNKS),
|
|
2386
|
-
lastChunkIndex: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNKS - 1),
|
|
2387
|
-
lastChunkCiphertextHash: sha256DigestSchema,
|
|
2388
|
-
lastChunkPlaintextBytes: external_exports.number().int().nonnegative().max(MAX_ATTACHMENT_CHUNK_PLAINTEXT_BYTES)
|
|
2389
|
-
}).strict()
|
|
2390
|
-
]).superRefine((progress, context) => {
|
|
2391
|
-
if (progress.state === "empty")
|
|
2392
|
-
return;
|
|
2393
|
-
if (progress.state === "writing" && progress.nextChunkIndex === MAX_ATTACHMENT_CHUNKS) {
|
|
2394
|
-
context.addIssue({
|
|
2395
|
-
code: "custom",
|
|
2396
|
-
message: "The maximum chunk count requires final-chunk state",
|
|
2397
|
-
path: ["state"]
|
|
2398
|
-
});
|
|
2399
|
-
}
|
|
2400
|
-
if (progress.lastChunkIndex !== progress.nextChunkIndex - 1) {
|
|
2401
|
-
context.addIssue({
|
|
2402
|
-
code: "custom",
|
|
2403
|
-
message: "Last chunk index must immediately precede the next chunk index",
|
|
2404
|
-
path: ["lastChunkIndex"]
|
|
2405
|
-
});
|
|
2406
|
-
}
|
|
2407
|
-
if (progress.totalCiphertextBytes !== progress.totalPlaintextBytes + progress.nextChunkIndex * SECRETSTREAM_CHUNK_OVERHEAD_BYTES) {
|
|
2408
|
-
context.addIssue({
|
|
2409
|
-
code: "custom",
|
|
2410
|
-
message: "Staging byte totals must include exactly one overhead per chunk",
|
|
2411
|
-
path: ["totalCiphertextBytes"]
|
|
2412
|
-
});
|
|
2413
|
-
}
|
|
2414
|
-
});
|
|
2415
|
-
var attachmentStreamFinalizeInputSchema = external_exports.object({
|
|
2416
|
-
version: external_exports.literal(1),
|
|
2417
|
-
record: encryptedAttachmentRecordSchema
|
|
2418
|
-
}).strict();
|
|
2419
|
-
var syncCursorSchema = external_exports.object({
|
|
2420
|
-
vaultId: vaultIdSchema,
|
|
2421
|
-
serverSequence: changeSequenceSchema,
|
|
2422
|
-
highestSeenVaultRevision: vaultRevisionSchema
|
|
2423
|
-
}).strict();
|
|
2424
|
-
var syncStateSchema = external_exports.enum([
|
|
2425
|
-
"synced",
|
|
2426
|
-
"offline",
|
|
2427
|
-
"syncing",
|
|
2428
|
-
"conflict",
|
|
2429
|
-
"error"
|
|
2430
|
-
]);
|
|
2431
|
-
var syncConflictResolutionStrategySchema = external_exports.enum([
|
|
2432
|
-
"keep-local",
|
|
2433
|
-
"accept-remote"
|
|
2434
|
-
]);
|
|
2435
|
-
var syncConflictResolutionSchema = external_exports.object({
|
|
2436
|
-
version: external_exports.literal(1),
|
|
2437
|
-
strategy: syncConflictResolutionStrategySchema,
|
|
2438
|
-
currentRevision: external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
|
|
2439
|
-
replacementIdempotencyKey: external_exports.string().nullable(),
|
|
2440
|
-
resolvedAt: timestampSchema
|
|
2441
|
-
}).strict();
|
|
2442
|
-
|
|
2443
|
-
// ../../packages/schemas/dist/api.js
|
|
2444
|
-
var healthResponseSchema = external_exports.object({ status: external_exports.literal("ok") }).strict();
|
|
2445
|
-
var readinessResponseSchema = external_exports.object({ status: external_exports.enum(["ready", "not_ready"]) }).strict();
|
|
2446
|
-
var CONTROL_LIST_CURSOR_VERSION = 1;
|
|
2447
|
-
var DEFAULT_CONTROL_LIST_PAGE_SIZE = 50;
|
|
2448
|
-
var MAX_CONTROL_LIST_PAGE_SIZE = 200;
|
|
2449
|
-
var MAX_CONTROL_LIST_CURSOR_CHARS = 512;
|
|
2450
|
-
var MAX_SYNC_PUSH_MUTATIONS = 100;
|
|
2451
|
-
var MAX_TEMPLATE_MIGRATION_RESULTS = 100;
|
|
2452
|
-
var MAX_SYNC_PULL_PAGE_CHANGES = 500;
|
|
2453
|
-
var controlListCursorPayloadBaseSchema = external_exports.object({
|
|
2454
|
-
version: external_exports.literal(CONTROL_LIST_CURSOR_VERSION),
|
|
2455
|
-
vaultId: vaultIdSchema,
|
|
2456
|
-
createdAt: timestampSchema
|
|
2457
|
-
}).strict();
|
|
2458
|
-
var controlListCursorPayloadSchema = external_exports.discriminatedUnion("resource", [
|
|
2459
|
-
controlListCursorPayloadBaseSchema.extend({
|
|
2460
|
-
resource: external_exports.literal("invites"),
|
|
2461
|
-
id: inviteIdSchema
|
|
2462
|
-
}).strict(),
|
|
2463
|
-
controlListCursorPayloadBaseSchema.extend({
|
|
2464
|
-
resource: external_exports.literal("devices"),
|
|
2465
|
-
id: deviceIdSchema
|
|
2466
|
-
}).strict()
|
|
2467
|
-
]);
|
|
2468
|
-
var boundedControlListCursorSchema = external_exports.string().min(1).max(MAX_CONTROL_LIST_CURSOR_CHARS).pipe(base64UrlSchema).brand();
|
|
2469
|
-
function encodeControlListCursor(payload) {
|
|
2470
|
-
const parsedPayload = controlListCursorPayloadSchema.parse(payload);
|
|
2471
|
-
return boundedControlListCursorSchema.parse(Buffer.from(canonicalJson(parsedPayload), "utf8").toString("base64url"));
|
|
2472
|
-
}
|
|
2473
|
-
function decodeCanonicalControlListCursor(cursor) {
|
|
2474
|
-
try {
|
|
2475
|
-
const parsedCursor = boundedControlListCursorSchema.parse(cursor);
|
|
2476
|
-
const json = new TextDecoder("utf-8", { fatal: true }).decode(Buffer.from(parsedCursor, "base64url"));
|
|
2477
|
-
const payload = controlListCursorPayloadSchema.parse(JSON.parse(json));
|
|
2478
|
-
if (encodeControlListCursor(payload) !== parsedCursor) {
|
|
2479
|
-
throw new TypeError("Noncanonical control-list cursor");
|
|
2480
|
-
}
|
|
2481
|
-
return payload;
|
|
2482
|
-
} catch {
|
|
2483
|
-
throw new TypeError("Invalid control-list cursor");
|
|
2484
|
-
}
|
|
2485
|
-
}
|
|
2486
|
-
function decodeControlListCursor(cursor) {
|
|
2487
|
-
return decodeCanonicalControlListCursor(cursor);
|
|
2488
|
-
}
|
|
2489
|
-
var controlListCursorSchema = boundedControlListCursorSchema.superRefine((cursor, context) => {
|
|
2490
|
-
try {
|
|
2491
|
-
decodeCanonicalControlListCursor(cursor);
|
|
2492
|
-
} catch {
|
|
2493
|
-
context.addIssue({
|
|
2494
|
-
code: "custom",
|
|
2495
|
-
message: "Control-list cursor is malformed or noncanonical"
|
|
2496
|
-
});
|
|
2497
|
-
}
|
|
2498
|
-
});
|
|
2499
|
-
var apiBearerTokenSchema = external_exports.string().length(43).regex(/^[A-Za-z0-9_-]+$/, "Bearer tokens use canonical unpadded base64url").refine((value) => Buffer.from(value, "base64url").toString("base64url") === value, {
|
|
2500
|
-
error: "Bearer tokens use canonical unpadded base64url"
|
|
2501
|
-
}).brand();
|
|
2502
|
-
var apiErrorResponseSchema = external_exports.object({
|
|
2503
|
-
error: external_exports.object({
|
|
2504
|
-
code: external_exports.string().min(1).max(64),
|
|
2505
|
-
message: external_exports.string().min(1).max(256),
|
|
2506
|
-
conflict: external_exports.object({
|
|
2507
|
-
entityType: external_exports.enum(["vault", "group", "item", "attachment"]),
|
|
2508
|
-
entityId: external_exports.string().min(1).max(128),
|
|
2509
|
-
expectedRevision: external_exports.number().int().nonnegative().nullable(),
|
|
2510
|
-
currentRevision: external_exports.number().int().nonnegative().nullable()
|
|
2511
|
-
}).strict().optional()
|
|
2512
|
-
}).strict()
|
|
2513
|
-
}).strict();
|
|
2514
|
-
var inviteIssueRequestSchema = external_exports.object({
|
|
2515
|
-
scopes: apiScopesSchema,
|
|
2516
|
-
expiresInSeconds: external_exports.number().int().min(60).max(86400)
|
|
2517
|
-
}).strict();
|
|
2518
|
-
var inviteIssueResponseSchema = external_exports.object({
|
|
2519
|
-
inviteId: inviteIdSchema,
|
|
2520
|
-
inviteToken: apiBearerTokenSchema,
|
|
2521
|
-
expiresAt: timestampSchema
|
|
2522
|
-
}).strict();
|
|
2523
|
-
var publicInviteRecordSchema = external_exports.object({
|
|
2524
|
-
id: inviteIdSchema,
|
|
2525
|
-
vaultId: vaultIdSchema,
|
|
2526
|
-
issuedByDeviceId: deviceIdSchema,
|
|
2527
|
-
scopes: apiScopesSchema,
|
|
2528
|
-
state: external_exports.enum(["active", "redeemed", "revoked", "expired"]),
|
|
2529
|
-
createdAt: timestampSchema,
|
|
2530
|
-
expiresAt: timestampSchema,
|
|
2531
|
-
consumedAt: timestampSchema.optional(),
|
|
2532
|
-
revokedAt: timestampSchema.optional()
|
|
2533
|
-
}).strict().superRefine((invite, context) => {
|
|
2534
|
-
if (invite.state === "redeemed" !== (invite.consumedAt !== void 0)) {
|
|
2535
|
-
context.addIssue({
|
|
2536
|
-
code: "custom",
|
|
2537
|
-
path: ["consumedAt"],
|
|
2538
|
-
message: "Only redeemed invites carry a consumption timestamp"
|
|
2539
|
-
});
|
|
2540
|
-
}
|
|
2541
|
-
if (invite.state === "revoked" !== (invite.revokedAt !== void 0)) {
|
|
2542
|
-
context.addIssue({
|
|
2543
|
-
code: "custom",
|
|
2544
|
-
path: ["revokedAt"],
|
|
2545
|
-
message: "Only revoked invites carry a revocation timestamp"
|
|
2546
|
-
});
|
|
2547
|
-
}
|
|
2548
|
-
});
|
|
2549
|
-
var inviteListPageResponseSchema = external_exports.object({
|
|
2550
|
-
invites: external_exports.array(publicInviteRecordSchema).max(MAX_CONTROL_LIST_PAGE_SIZE),
|
|
2551
|
-
nextCursor: controlListCursorSchema.nullable()
|
|
2552
|
-
}).strict().superRefine((page, context) => {
|
|
2553
|
-
validateControlListPage("invites", page.invites, page.nextCursor, context);
|
|
2554
|
-
});
|
|
2555
|
-
var vaultInvitePathSchema = external_exports.object({ vaultId: vaultIdSchema, inviteId: inviteIdSchema }).strict();
|
|
2556
|
-
var inviteRedeemResponseSchema = external_exports.object({
|
|
2557
|
-
vaultId: vaultIdSchema,
|
|
2558
|
-
expiresAt: timestampSchema,
|
|
2559
|
-
vault: vaultRecordSchema
|
|
2560
|
-
}).strict().refine((response) => response.vault.id === response.vaultId, {
|
|
2561
|
-
path: ["vault", "id"],
|
|
2562
|
-
error: "Redeemed vaults must match the invite vault"
|
|
2563
|
-
});
|
|
2564
|
-
var enrollmentCompleteRequestSchema = external_exports.object({
|
|
2565
|
-
vaultId: vaultIdSchema,
|
|
2566
|
-
deviceId: deviceIdSchema,
|
|
2567
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
2568
|
-
encryptedLabel: encryptedDeviceLabelSchema.optional()
|
|
2569
|
-
}).strict().superRefine((request, context) => {
|
|
2570
|
-
validateDeviceLabelBinding(request.encryptedLabel, request.vaultId, request.deviceId, request.schemaVersion, context, ["encryptedLabel", "aad"]);
|
|
2571
|
-
});
|
|
2572
|
-
var enrollmentCompleteResponseSchema = external_exports.object({
|
|
2573
|
-
vaultId: vaultIdSchema,
|
|
2574
|
-
deviceId: deviceIdSchema
|
|
2575
|
-
}).strict();
|
|
2576
|
-
var apiSessionResponseSchema = external_exports.object({
|
|
2577
|
-
vaultId: vaultIdSchema,
|
|
2578
|
-
deviceId: deviceIdSchema,
|
|
2579
|
-
scopes: apiScopesSchema
|
|
2580
|
-
}).strict();
|
|
2581
|
-
var vaultBootstrapRequestSchema = external_exports.object({
|
|
2582
|
-
vault: vaultRecordSchema,
|
|
2583
|
-
device: external_exports.object({
|
|
2584
|
-
id: deviceIdSchema,
|
|
2585
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
2586
|
-
encryptedLabel: encryptedDeviceLabelSchema.optional()
|
|
2587
|
-
}).strict()
|
|
2588
|
-
}).strict().superRefine((request, context) => {
|
|
2589
|
-
if (request.vault.revision !== 0) {
|
|
2590
|
-
context.addIssue({
|
|
2591
|
-
code: "custom",
|
|
2592
|
-
path: ["vault", "revision"],
|
|
2593
|
-
message: "Initial vaults must start at revision zero"
|
|
2594
|
-
});
|
|
2595
|
-
}
|
|
2596
|
-
if (request.vault.createdAt !== request.vault.updatedAt) {
|
|
2597
|
-
context.addIssue({
|
|
2598
|
-
code: "custom",
|
|
2599
|
-
path: ["vault", "updatedAt"],
|
|
2600
|
-
message: "Initial vault timestamps must match"
|
|
2601
|
-
});
|
|
2602
|
-
}
|
|
2603
|
-
if (request.device.schemaVersion !== request.vault.schemaVersion) {
|
|
2604
|
-
context.addIssue({
|
|
2605
|
-
code: "custom",
|
|
2606
|
-
path: ["device", "schemaVersion"],
|
|
2607
|
-
message: "The first device and vault schema versions must match"
|
|
2608
|
-
});
|
|
2609
|
-
}
|
|
2610
|
-
validateDeviceLabelBinding(request.device.encryptedLabel, request.vault.id, request.device.id, request.device.schemaVersion, context, ["device", "encryptedLabel", "aad"]);
|
|
2611
|
-
});
|
|
2612
|
-
var vaultBootstrapResponseSchema = external_exports.object({
|
|
2613
|
-
vaultId: vaultIdSchema,
|
|
2614
|
-
deviceId: deviceIdSchema
|
|
2615
|
-
}).strict();
|
|
2616
|
-
var deviceListPageResponseSchema = external_exports.object({
|
|
2617
|
-
devices: external_exports.array(publicDeviceRecordSchema).max(MAX_CONTROL_LIST_PAGE_SIZE),
|
|
2618
|
-
nextCursor: controlListCursorSchema.nullable()
|
|
2619
|
-
}).strict().superRefine((page, context) => {
|
|
2620
|
-
validateControlListPage("devices", page.devices, page.nextCursor, context);
|
|
2621
|
-
});
|
|
2622
|
-
var vaultPathSchema = external_exports.object({ vaultId: vaultIdSchema }).strict();
|
|
2623
|
-
var vaultDevicePathSchema = external_exports.object({ vaultId: vaultIdSchema, deviceId: deviceIdSchema }).strict();
|
|
2624
|
-
var vaultKeySlotPathSchema = external_exports.object({ vaultId: vaultIdSchema, slotId: keySlotIdSchema }).strict();
|
|
2625
|
-
var vaultKeySlotUpdateRequestSchema = external_exports.object({
|
|
2626
|
-
expectedVaultRevision: vaultRevisionSchema,
|
|
2627
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2628
|
-
record: vaultRecordSchema,
|
|
2629
|
-
/** New slot mutations carry an opaque encrypted audit sidecar. */
|
|
2630
|
-
audit: encryptedAuditRecordSchema.optional()
|
|
2631
|
-
}).strict().refine((value) => value.record.revision === value.expectedVaultRevision + 1, {
|
|
2632
|
-
path: ["record", "revision"],
|
|
2633
|
-
error: "Key-slot updates must advance the vault revision exactly once"
|
|
2634
|
-
});
|
|
2635
|
-
var decimalIntegerQuerySchema = external_exports.string().regex(/^(?:0|[1-9][0-9]*)$/, "Must be a canonical nonnegative integer").transform((value, context) => {
|
|
2636
|
-
const parsed = Number(value);
|
|
2637
|
-
if (!Number.isSafeInteger(parsed)) {
|
|
2638
|
-
context.addIssue({
|
|
2639
|
-
code: "custom",
|
|
2640
|
-
message: "Integer is outside the safe range"
|
|
2641
|
-
});
|
|
2642
|
-
return external_exports.NEVER;
|
|
2643
|
-
}
|
|
2644
|
-
return parsed;
|
|
2645
|
-
});
|
|
2646
|
-
var numericControlListPageLimitSchema = external_exports.number().int().min(1).max(MAX_CONTROL_LIST_PAGE_SIZE);
|
|
2647
|
-
var controlListPageOptionsSchema = external_exports.object({
|
|
2648
|
-
limit: numericControlListPageLimitSchema.default(DEFAULT_CONTROL_LIST_PAGE_SIZE),
|
|
2649
|
-
cursor: controlListCursorSchema.optional()
|
|
2650
|
-
}).strict();
|
|
2651
|
-
var controlListPageLimitQuerySchema = decimalIntegerQuerySchema.pipe(numericControlListPageLimitSchema);
|
|
2652
|
-
var controlListPageQuerySchema = external_exports.object({
|
|
2653
|
-
limit: controlListPageLimitQuerySchema.optional(),
|
|
2654
|
-
cursor: controlListCursorSchema.optional()
|
|
2655
|
-
}).strict().transform((query) => controlListPageOptionsSchema.parse(query));
|
|
2656
|
-
var attachmentTransferPathSchema = external_exports.object({
|
|
2657
|
-
vaultId: vaultIdSchema,
|
|
2658
|
-
groupId: groupIdSchema,
|
|
2659
|
-
itemId: itemIdSchema,
|
|
2660
|
-
attachmentId: attachmentIdSchema
|
|
2661
|
-
}).strict();
|
|
2662
|
-
var attachmentChunkPathSchema = attachmentTransferPathSchema.extend({ chunkIndex: decimalIntegerQuerySchema }).strict().refine((path) => path.chunkIndex < MAX_ATTACHMENT_CHUNKS, {
|
|
2663
|
-
path: ["chunkIndex"],
|
|
2664
|
-
error: "Attachment chunk index is outside the canonical bound"
|
|
2665
|
-
});
|
|
2666
|
-
var attachmentChunkStageRequestSchema = external_exports.object({
|
|
2667
|
-
start: attachmentStreamStartInputSchema,
|
|
2668
|
-
chunk: persistedAttachmentChunkRecordSchema
|
|
2669
|
-
}).strict().superRefine((request, context) => {
|
|
2670
|
-
validateAttachmentTransportIdentity(request.start, request.chunk.record, request.chunk.recordRevision, context, ["chunk"]);
|
|
2671
|
-
});
|
|
2672
|
-
var attachmentFinalizeRequestSchema = external_exports.object({
|
|
2673
|
-
start: attachmentStreamStartInputSchema,
|
|
2674
|
-
finalize: attachmentStreamFinalizeInputSchema
|
|
2675
|
-
}).strict().superRefine((request, context) => {
|
|
2676
|
-
validateAttachmentTransportIdentity(request.start, request.finalize.record, request.finalize.record.recordRevision, context, ["finalize", "record"]);
|
|
2677
|
-
});
|
|
2678
|
-
var syncPullQuerySchema = external_exports.object({
|
|
2679
|
-
serverSequence: decimalIntegerQuerySchema.default(0),
|
|
2680
|
-
highestSeenVaultRevision: decimalIntegerQuerySchema,
|
|
2681
|
-
limit: decimalIntegerQuerySchema.default(100)
|
|
2682
|
-
}).strict().transform((value) => ({
|
|
2683
|
-
serverSequence: changeSequenceSchema.parse(value.serverSequence),
|
|
2684
|
-
highestSeenVaultRevision: vaultRevisionSchema.parse(value.highestSeenVaultRevision),
|
|
2685
|
-
limit: value.limit
|
|
2686
|
-
})).refine((value) => value.limit >= 1 && value.limit <= MAX_SYNC_PULL_PAGE_CHANGES, {
|
|
2687
|
-
path: ["limit"],
|
|
2688
|
-
error: "Sync pull limits must be between 1 and 500"
|
|
2689
|
-
});
|
|
2690
|
-
var opaqueSyncRecordSchema = external_exports.union([
|
|
2691
|
-
vaultRecordSchema,
|
|
2692
|
-
encryptedGroupRecordSchema,
|
|
2693
|
-
encryptedItemRecordSchema,
|
|
2694
|
-
encryptedAttachmentRecordSchema,
|
|
2695
|
-
tombstoneRecordSchema
|
|
2696
|
-
]);
|
|
2697
|
-
var syncPulledChangeSchema = external_exports.object({
|
|
2698
|
-
change: changeRecordSchema,
|
|
2699
|
-
record: opaqueSyncRecordSchema.nullable()
|
|
2700
|
-
}).strict().superRefine((pulled, context) => {
|
|
2701
|
-
const { change, record } = pulled;
|
|
2702
|
-
if (change.operation === "purge") {
|
|
2703
|
-
if (record !== null) {
|
|
2704
|
-
context.addIssue({
|
|
2705
|
-
code: "custom",
|
|
2706
|
-
path: ["record"],
|
|
2707
|
-
message: "Purged changes cannot include a record"
|
|
2708
|
-
});
|
|
2709
|
-
}
|
|
2710
|
-
return;
|
|
2711
|
-
}
|
|
2712
|
-
if (record === null || syncRecordVaultId(record) !== change.vaultId || syncRecordEntityType(record) !== change.entityType || syncRecordId(record) !== change.entityId || syncRecordRevision(record) !== change.recordRevision) {
|
|
2713
|
-
context.addIssue({
|
|
2714
|
-
code: "custom",
|
|
2715
|
-
path: ["record"],
|
|
2716
|
-
message: "Pulled records must be bound to their change metadata"
|
|
2717
|
-
});
|
|
2718
|
-
return;
|
|
2719
|
-
}
|
|
2720
|
-
if (change.operation === "tombstone" && (!isTombstoneRecord(record) || record.state !== "deleted")) {
|
|
2721
|
-
context.addIssue({
|
|
2722
|
-
code: "custom",
|
|
2723
|
-
path: ["record"],
|
|
2724
|
-
message: "Tombstone changes require a deleted tombstone record"
|
|
2725
|
-
});
|
|
2726
|
-
}
|
|
2727
|
-
if ((change.operation === "upsert" || change.operation === "restore") && !isCurrentOpaqueRecord(record)) {
|
|
2728
|
-
context.addIssue({
|
|
2729
|
-
code: "custom",
|
|
2730
|
-
path: ["record"],
|
|
2731
|
-
message: "Upsert and restore changes require a current encrypted record"
|
|
2732
|
-
});
|
|
2733
|
-
}
|
|
2734
|
-
});
|
|
2735
|
-
var syncPullResponseSchema = external_exports.object({
|
|
2736
|
-
vaultId: vaultIdSchema,
|
|
2737
|
-
serverVaultRevision: vaultRevisionSchema,
|
|
2738
|
-
changes: external_exports.array(syncPulledChangeSchema).max(MAX_SYNC_PULL_PAGE_CHANGES),
|
|
2739
|
-
nextCursor: syncCursorSchema,
|
|
2740
|
-
hasMore: external_exports.boolean()
|
|
2741
|
-
}).strict().superRefine((page, context) => {
|
|
2742
|
-
if (page.nextCursor.vaultId !== page.vaultId || page.nextCursor.highestSeenVaultRevision !== page.serverVaultRevision) {
|
|
2743
|
-
context.addIssue({
|
|
2744
|
-
code: "custom",
|
|
2745
|
-
path: ["nextCursor"],
|
|
2746
|
-
message: "The next cursor must be bound to the returned vault revision"
|
|
2747
|
-
});
|
|
2748
|
-
}
|
|
2749
|
-
if (page.changes.some(({ change }) => change.vaultId !== page.vaultId)) {
|
|
2750
|
-
context.addIssue({
|
|
2751
|
-
code: "custom",
|
|
2752
|
-
path: ["changes"],
|
|
2753
|
-
message: "All changes must belong to the response vault"
|
|
2754
|
-
});
|
|
2755
|
-
}
|
|
2756
|
-
if (page.hasMore && page.changes.length === 0) {
|
|
2757
|
-
context.addIssue({
|
|
2758
|
-
code: "custom",
|
|
2759
|
-
path: ["hasMore"],
|
|
2760
|
-
message: "A nonterminal page must contain at least one change"
|
|
2761
|
-
});
|
|
2762
|
-
}
|
|
2763
|
-
});
|
|
2764
|
-
var syncPushRequestSchema = external_exports.object({
|
|
2765
|
-
vaultId: vaultIdSchema,
|
|
2766
|
-
batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2767
|
-
mutations: external_exports.array(opaqueMutationSchema).min(1).max(MAX_SYNC_PUSH_MUTATIONS)
|
|
2768
|
-
}).strict().superRefine((batch, context) => {
|
|
2769
|
-
const keys = /* @__PURE__ */ new Set();
|
|
2770
|
-
for (const [index, mutation] of batch.mutations.entries()) {
|
|
2771
|
-
if (syncMutationVaultId(mutation) !== batch.vaultId) {
|
|
2772
|
-
context.addIssue({
|
|
2773
|
-
code: "custom",
|
|
2774
|
-
path: ["mutations", index],
|
|
2775
|
-
message: "Every mutation must belong to the batch vault"
|
|
2776
|
-
});
|
|
2777
|
-
}
|
|
2778
|
-
if (keys.has(mutation.idempotencyKey)) {
|
|
2779
|
-
context.addIssue({
|
|
2780
|
-
code: "custom",
|
|
2781
|
-
path: ["mutations", index, "idempotencyKey"],
|
|
2782
|
-
message: "Mutation idempotency keys must be unique within a batch"
|
|
2783
|
-
});
|
|
2784
|
-
}
|
|
2785
|
-
keys.add(mutation.idempotencyKey);
|
|
2786
|
-
const expected = mutation.entityType === "vault" ? mutation.expectedVaultRevision : mutation.expectedRecordRevision;
|
|
2787
|
-
const revision = mutation.entityType === "vault" ? mutation.record.revision : mutation.record.recordRevision;
|
|
2788
|
-
if (revision !== (expected === null ? 0 : expected + 1)) {
|
|
2789
|
-
context.addIssue({
|
|
2790
|
-
code: "custom",
|
|
2791
|
-
path: ["mutations", index, "record"],
|
|
2792
|
-
message: "Mutations must advance their expected revision exactly once"
|
|
2793
|
-
});
|
|
2794
|
-
}
|
|
2795
|
-
}
|
|
2796
|
-
});
|
|
2797
|
-
var syncAcceptedPushResultSchema = external_exports.object({
|
|
2798
|
-
status: external_exports.literal("accepted"),
|
|
2799
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2800
|
-
disposition: external_exports.enum(["committed", "duplicate"]),
|
|
2801
|
-
change: changeRecordSchema
|
|
2802
|
-
}).strict();
|
|
2803
|
-
var syncConflictingPushResultSchema = external_exports.object({
|
|
2804
|
-
status: external_exports.literal("conflict"),
|
|
2805
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2806
|
-
currentRevision: external_exports.union([vaultRevisionSchema, recordRevisionSchema]),
|
|
2807
|
-
current: opaqueSyncRecordSchema.nullable()
|
|
2808
|
-
}).strict();
|
|
2809
|
-
var syncPushResponseSchema = external_exports.object({
|
|
2810
|
-
vaultId: vaultIdSchema,
|
|
2811
|
-
serverVaultRevision: vaultRevisionSchema,
|
|
2812
|
-
batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2813
|
-
results: external_exports.array(external_exports.discriminatedUnion("status", [
|
|
2814
|
-
syncAcceptedPushResultSchema,
|
|
2815
|
-
syncConflictingPushResultSchema
|
|
2816
|
-
])).min(1).max(MAX_SYNC_PUSH_MUTATIONS)
|
|
2817
|
-
}).strict();
|
|
2818
|
-
var templateMigrationPublicationRequestSchema = syncPushRequestSchema.superRefine((batch, context) => {
|
|
2819
|
-
const entityIds = /* @__PURE__ */ new Set();
|
|
2820
|
-
const itemIds = [];
|
|
2821
|
-
let groupMutation;
|
|
2822
|
-
for (const [index, mutation] of batch.mutations.entries()) {
|
|
2823
|
-
if (mutation.entityType !== "group" && mutation.entityType !== "item") {
|
|
2824
|
-
context.addIssue({
|
|
2825
|
-
code: "custom",
|
|
2826
|
-
path: ["mutations", index, "entityType"],
|
|
2827
|
-
message: "Template migration batches accept only group and item mutations"
|
|
2828
|
-
});
|
|
2829
|
-
continue;
|
|
2830
|
-
}
|
|
2831
|
-
if (mutation.expectedRecordRevision === null || mutation.record.tombstonedAt !== void 0) {
|
|
2832
|
-
context.addIssue({
|
|
2833
|
-
code: "custom",
|
|
2834
|
-
path: ["mutations", index],
|
|
2835
|
-
message: "Template migration mutations must update active current records"
|
|
2836
|
-
});
|
|
2837
|
-
}
|
|
2838
|
-
if (entityIds.has(mutation.record.id)) {
|
|
2839
|
-
context.addIssue({
|
|
2840
|
-
code: "custom",
|
|
2841
|
-
path: ["mutations", index, "record", "id"],
|
|
2842
|
-
message: "Template migration entity IDs must be unique"
|
|
2843
|
-
});
|
|
2844
|
-
}
|
|
2845
|
-
entityIds.add(mutation.record.id);
|
|
2846
|
-
if (mutation.entityType === "group") {
|
|
2847
|
-
if (groupMutation !== void 0) {
|
|
2848
|
-
context.addIssue({
|
|
2849
|
-
code: "custom",
|
|
2850
|
-
path: ["mutations", index],
|
|
2851
|
-
message: "A template migration batch requires exactly one group mutation"
|
|
2852
|
-
});
|
|
2853
|
-
}
|
|
2854
|
-
groupMutation = mutation;
|
|
2855
|
-
} else {
|
|
2856
|
-
itemIds.push(mutation.record.id);
|
|
2857
|
-
}
|
|
2858
|
-
}
|
|
2859
|
-
if (groupMutation === void 0) {
|
|
2860
|
-
context.addIssue({
|
|
2861
|
-
code: "custom",
|
|
2862
|
-
path: ["mutations"],
|
|
2863
|
-
message: "A template migration batch requires one group mutation"
|
|
2864
|
-
});
|
|
2865
|
-
return;
|
|
2866
|
-
}
|
|
2867
|
-
if (batch.mutations.at(-1) !== groupMutation) {
|
|
2868
|
-
context.addIssue({
|
|
2869
|
-
code: "custom",
|
|
2870
|
-
path: ["mutations"],
|
|
2871
|
-
message: "The group mutation must be last"
|
|
2872
|
-
});
|
|
2873
|
-
}
|
|
2874
|
-
for (const [index, mutation] of batch.mutations.entries()) {
|
|
2875
|
-
if (mutation.entityType === "item" && mutation.record.groupId !== groupMutation.record.id) {
|
|
2876
|
-
context.addIssue({
|
|
2877
|
-
code: "custom",
|
|
2878
|
-
path: ["mutations", index, "record", "groupId"],
|
|
2879
|
-
message: "Every item must belong to the migrated group"
|
|
2880
|
-
});
|
|
2881
|
-
}
|
|
2882
|
-
}
|
|
2883
|
-
const sortedItemIds = [...itemIds].sort();
|
|
2884
|
-
if (itemIds.some((itemId, index) => itemId !== sortedItemIds[index])) {
|
|
2885
|
-
context.addIssue({
|
|
2886
|
-
code: "custom",
|
|
2887
|
-
path: ["mutations"],
|
|
2888
|
-
message: "Item mutations must be ordered by item ID"
|
|
2889
|
-
});
|
|
2890
|
-
}
|
|
2891
|
-
});
|
|
2892
|
-
var templateMigrationPublicationResultSchema = external_exports.object({
|
|
2893
|
-
idempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2894
|
-
change: changeRecordSchema
|
|
2895
|
-
}).strict().superRefine((result, context) => {
|
|
2896
|
-
if (result.change.entityType !== "group" && result.change.entityType !== "item" || result.change.operation !== "upsert") {
|
|
2897
|
-
context.addIssue({
|
|
2898
|
-
code: "custom",
|
|
2899
|
-
path: ["change"],
|
|
2900
|
-
message: "Template migration results require group or item upserts"
|
|
2901
|
-
});
|
|
2902
|
-
}
|
|
2903
|
-
});
|
|
2904
|
-
var templateMigrationPublicationResponseSchema = external_exports.object({
|
|
2905
|
-
vaultId: vaultIdSchema,
|
|
2906
|
-
batchIdempotencyKey: external_exports.string().min(MIN_IDEMPOTENCY_KEY_CHARS).max(MAX_IDEMPOTENCY_KEY_CHARS),
|
|
2907
|
-
serverVaultRevision: vaultRevisionSchema,
|
|
2908
|
-
results: external_exports.array(templateMigrationPublicationResultSchema).min(1).max(MAX_TEMPLATE_MIGRATION_RESULTS)
|
|
2909
|
-
}).strict().superRefine((response, context) => {
|
|
2910
|
-
const itemIds = [];
|
|
2911
|
-
let groupCount = 0;
|
|
2912
|
-
for (const [index, result] of response.results.entries()) {
|
|
2913
|
-
if (result.change.vaultId !== response.vaultId) {
|
|
2914
|
-
context.addIssue({
|
|
2915
|
-
code: "custom",
|
|
2916
|
-
path: ["results", index, "change", "vaultId"],
|
|
2917
|
-
message: "Every result must belong to the response vault"
|
|
2918
|
-
});
|
|
2919
|
-
}
|
|
2920
|
-
if (index > 0) {
|
|
2921
|
-
const previous = response.results[index - 1];
|
|
2922
|
-
if (previous !== void 0 && result.change.serverSequence !== previous.change.serverSequence + 1) {
|
|
2923
|
-
context.addIssue({
|
|
2924
|
-
code: "custom",
|
|
2925
|
-
path: ["results", index, "change", "serverSequence"],
|
|
2926
|
-
message: "Result sequences must be contiguous"
|
|
2927
|
-
});
|
|
2928
|
-
}
|
|
2929
|
-
}
|
|
2930
|
-
if (result.change.entityType === "group")
|
|
2931
|
-
groupCount += 1;
|
|
2932
|
-
if (result.change.entityType === "item")
|
|
2933
|
-
itemIds.push(result.change.entityId);
|
|
2934
|
-
}
|
|
2935
|
-
if (groupCount !== 1 || response.results.at(-1)?.change.entityType !== "group") {
|
|
2936
|
-
context.addIssue({
|
|
2937
|
-
code: "custom",
|
|
2938
|
-
path: ["results"],
|
|
2939
|
-
message: "Results require exactly one group upsert last"
|
|
2940
|
-
});
|
|
2941
|
-
}
|
|
2942
|
-
const sortedItemIds = [...itemIds].sort();
|
|
2943
|
-
if (itemIds.some((itemId, index) => itemId !== sortedItemIds[index])) {
|
|
2944
|
-
context.addIssue({
|
|
2945
|
-
code: "custom",
|
|
2946
|
-
path: ["results"],
|
|
2947
|
-
message: "Item results must be ordered by item ID"
|
|
2948
|
-
});
|
|
2949
|
-
}
|
|
2950
|
-
});
|
|
2951
|
-
function validateDeviceLabelBinding(encryptedLabel, vaultId, deviceId, schemaVersion, context, path) {
|
|
2952
|
-
if (encryptedLabel !== void 0 && (encryptedLabel.aad.vaultId !== vaultId || encryptedLabel.aad.entityId !== deviceId || encryptedLabel.aad.schemaVersion !== schemaVersion)) {
|
|
2953
|
-
context.addIssue({
|
|
2954
|
-
code: "custom",
|
|
2955
|
-
path,
|
|
2956
|
-
message: "Encrypted device labels must match their containing request"
|
|
2957
|
-
});
|
|
2958
|
-
}
|
|
2959
|
-
}
|
|
2960
|
-
function validateControlListPage(resource, rows, nextCursor, context) {
|
|
2961
|
-
const firstRow = rows[0];
|
|
2962
|
-
if (firstRow !== void 0 && rows.some((row) => row.vaultId !== firstRow.vaultId)) {
|
|
2963
|
-
context.addIssue({
|
|
2964
|
-
code: "custom",
|
|
2965
|
-
message: "Every control-list page row must belong to one vault",
|
|
2966
|
-
path: [resource]
|
|
2967
|
-
});
|
|
2968
|
-
}
|
|
2969
|
-
if (nextCursor === null)
|
|
2970
|
-
return;
|
|
2971
|
-
const finalRow = rows.at(-1);
|
|
2972
|
-
if (finalRow === void 0) {
|
|
2973
|
-
context.addIssue({
|
|
2974
|
-
code: "custom",
|
|
2975
|
-
message: "An empty control-list page cannot carry a next cursor",
|
|
2976
|
-
path: ["nextCursor"]
|
|
2977
|
-
});
|
|
2978
|
-
return;
|
|
2979
|
-
}
|
|
2980
|
-
let cursorPayload;
|
|
2981
|
-
try {
|
|
2982
|
-
cursorPayload = decodeControlListCursor(nextCursor);
|
|
2983
|
-
} catch {
|
|
2984
|
-
context.addIssue({
|
|
2985
|
-
code: "custom",
|
|
2986
|
-
message: "Control-list page carries an invalid next cursor",
|
|
2987
|
-
path: ["nextCursor"]
|
|
2988
|
-
});
|
|
2989
|
-
return;
|
|
2990
|
-
}
|
|
2991
|
-
if (cursorPayload.resource !== resource || cursorPayload.vaultId !== finalRow.vaultId || cursorPayload.createdAt !== finalRow.createdAt || cursorPayload.id !== finalRow.id) {
|
|
2992
|
-
context.addIssue({
|
|
2993
|
-
code: "custom",
|
|
2994
|
-
message: "Next cursor must identify the final control-list page row",
|
|
2995
|
-
path: ["nextCursor"]
|
|
2996
|
-
});
|
|
2997
|
-
}
|
|
2998
|
-
}
|
|
2999
|
-
function validateAttachmentTransportIdentity(start, record, recordRevision, context, path) {
|
|
3000
|
-
const header = start.header;
|
|
3001
|
-
const attachmentId = "id" in record ? record.id : record.attachmentId;
|
|
3002
|
-
const keyVersions = "id" in record ? [record.wrappedAttachmentKey.keyVersion, record.encryptedManifest.keyVersion] : [record.keyVersion];
|
|
3003
|
-
if (record.vaultId !== header.record.vaultId || record.groupId !== header.record.groupId || record.itemId !== header.record.itemId || attachmentId !== header.record.attachmentId || record.schemaVersion !== header.record.schemaVersion || keyVersions.some((keyVersion) => keyVersion !== header.record.keyVersion) || recordRevision !== header.recordRevision) {
|
|
3004
|
-
context.addIssue({
|
|
3005
|
-
code: "custom",
|
|
3006
|
-
path,
|
|
3007
|
-
message: "Attachment transport records must share one exact stream identity"
|
|
3008
|
-
});
|
|
3009
|
-
}
|
|
3010
|
-
}
|
|
3011
|
-
function isTombstoneRecord(record) {
|
|
3012
|
-
return "state" in record;
|
|
3013
|
-
}
|
|
3014
|
-
function isCurrentOpaqueRecord(record) {
|
|
3015
|
-
return !isTombstoneRecord(record) && (!("tombstonedAt" in record) || record.tombstonedAt === void 0);
|
|
3016
|
-
}
|
|
3017
|
-
function syncRecordVaultId(record) {
|
|
3018
|
-
return "vaultId" in record ? record.vaultId : record.id;
|
|
3019
|
-
}
|
|
3020
|
-
function syncRecordId(record) {
|
|
3021
|
-
return isTombstoneRecord(record) ? record.entityId : record.id;
|
|
3022
|
-
}
|
|
3023
|
-
function syncRecordEntityType(record) {
|
|
3024
|
-
if (isTombstoneRecord(record))
|
|
3025
|
-
return record.entityType;
|
|
3026
|
-
if ("revision" in record)
|
|
3027
|
-
return "vault";
|
|
3028
|
-
if ("itemId" in record)
|
|
3029
|
-
return "attachment";
|
|
3030
|
-
if ("groupId" in record)
|
|
3031
|
-
return "item";
|
|
3032
|
-
return "group";
|
|
3033
|
-
}
|
|
3034
|
-
function syncRecordRevision(record) {
|
|
3035
|
-
if (isTombstoneRecord(record))
|
|
3036
|
-
return record.tombstoneRevision;
|
|
3037
|
-
return "revision" in record ? record.revision : record.recordRevision;
|
|
3038
|
-
}
|
|
3039
|
-
function syncMutationVaultId(mutation) {
|
|
3040
|
-
return mutation.entityType === "vault" ? mutation.record.id : mutation.record.vaultId;
|
|
3041
|
-
}
|
|
3042
|
-
|
|
3043
|
-
// ../../packages/schemas/dist/audit.js
|
|
3044
|
-
var keySlotAuditPayloadSchema = external_exports.object({
|
|
3045
|
-
version: external_exports.literal(1),
|
|
3046
|
-
action: external_exports.enum(["create", "revoke"]),
|
|
3047
|
-
slotId: keySlotIdSchema,
|
|
3048
|
-
slotType: external_exports.enum(["portable-key", "passphrase", "recovery-key", "device-key"]),
|
|
3049
|
-
resultingState: external_exports.enum(["active", "revoked"]),
|
|
3050
|
-
keyVersion: keyVersionSchema,
|
|
3051
|
-
actorDeviceId: deviceIdSchema,
|
|
3052
|
-
occurredAt: timestampSchema
|
|
3053
|
-
}).strict();
|
|
3054
|
-
var auditEventClassSchema = external_exports.enum([
|
|
3055
|
-
"device",
|
|
3056
|
-
"slot",
|
|
3057
|
-
"mutation",
|
|
3058
|
-
"backup",
|
|
3059
|
-
"recovery"
|
|
3060
|
-
]);
|
|
3061
|
-
var auditEventActionSchema = external_exports.enum([
|
|
3062
|
-
"create",
|
|
3063
|
-
"supersede",
|
|
3064
|
-
"revoke",
|
|
3065
|
-
"queue"
|
|
3066
|
-
]);
|
|
3067
|
-
var auditEventStateSchema = external_exports.enum([
|
|
3068
|
-
"pending",
|
|
3069
|
-
"active",
|
|
3070
|
-
"superseded",
|
|
3071
|
-
"revoked"
|
|
3072
|
-
]);
|
|
3073
|
-
var AUDIT_EVENT_ID_BOUNDS = { min: 1, max: 512 };
|
|
3074
|
-
var AUDIT_EVENT_SUBJECT_BOUNDS = { min: 1, max: 256 };
|
|
3075
|
-
var auditEventIdentifierSchema = external_exports.string().min(AUDIT_EVENT_ID_BOUNDS.min).max(AUDIT_EVENT_ID_BOUNDS.max).regex(/^[A-Za-z0-9][A-Za-z0-9._~:-]*$/u, {
|
|
3076
|
-
message: "Audit event identifiers accept only [A-Za-z0-9._~:-]"
|
|
3077
|
-
});
|
|
3078
|
-
var auditEventSubjectSchema = external_exports.string().min(AUDIT_EVENT_SUBJECT_BOUNDS.min).max(AUDIT_EVENT_SUBJECT_BOUNDS.max).regex(/^[A-Za-z0-9][A-Za-z0-9._~:-]*$/u, {
|
|
3079
|
-
message: "Audit event subjects accept only [A-Za-z0-9._~:-]"
|
|
3080
|
-
});
|
|
3081
|
-
var localAuditEventSchema = external_exports.object({
|
|
3082
|
-
version: external_exports.literal(1),
|
|
3083
|
-
eventId: auditEventIdentifierSchema,
|
|
3084
|
-
eventClass: auditEventClassSchema,
|
|
3085
|
-
action: auditEventActionSchema,
|
|
3086
|
-
subject: auditEventSubjectSchema,
|
|
3087
|
-
occurredAt: timestampSchema,
|
|
3088
|
-
keyVersion: keyVersionSchema.optional(),
|
|
3089
|
-
state: auditEventStateSchema.optional(),
|
|
3090
|
-
deviceId: deviceIdSchema.optional(),
|
|
3091
|
-
recordRevision: external_exports.number().int().nonnegative().optional()
|
|
3092
|
-
}).strict();
|
|
3093
|
-
|
|
3094
|
-
// ../../packages/schemas/dist/backup.js
|
|
3095
|
-
var DEFAULT_MAX_BACKUP_RECORDS = 2e6;
|
|
3096
|
-
var MAX_SUPPORTED_BACKUP_BYTES = 64 * 1024 * 1024 * 1024;
|
|
3097
|
-
var canonical32ByteValueSchema = base64UrlSchema.length(43).refine((value) => Buffer.from(value, "base64url").byteLength === 32, {
|
|
3098
|
-
error: "Value must canonically encode exactly 32 bytes"
|
|
3099
|
-
});
|
|
3100
|
-
var backupAuthenticationSaltSchema = canonical32ByteValueSchema.brand();
|
|
3101
|
-
var backupAuthenticationTagSchema = canonical32ByteValueSchema.brand();
|
|
3102
|
-
var backupAuthenticationSchema = external_exports.object({
|
|
3103
|
-
algorithm: external_exports.literal("hkdf-sha256+hmac-sha256"),
|
|
3104
|
-
salt: backupAuthenticationSaltSchema
|
|
3105
|
-
}).strict();
|
|
3106
|
-
var encryptedBackupHeaderSchema = external_exports.object({
|
|
3107
|
-
type: external_exports.literal("header"),
|
|
3108
|
-
format: external_exports.literal("kavrix-encrypted-backup"),
|
|
3109
|
-
version: external_exports.literal(1),
|
|
3110
|
-
vaultId: vaultIdSchema,
|
|
3111
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
3112
|
-
createdAt: timestampSchema,
|
|
3113
|
-
authentication: backupAuthenticationSchema
|
|
3114
|
-
}).strict();
|
|
3115
|
-
var encryptedBackupEntrySchema = external_exports.discriminatedUnion("kind", [
|
|
3116
|
-
external_exports.object({ kind: external_exports.literal("vault"), record: vaultRecordSchema }).strict(),
|
|
3117
|
-
external_exports.object({ kind: external_exports.literal("group"), record: encryptedGroupRecordSchema }).strict(),
|
|
3118
|
-
external_exports.object({ kind: external_exports.literal("item"), record: encryptedItemRecordSchema }).strict(),
|
|
3119
|
-
external_exports.object({ kind: external_exports.literal("attachment"), record: encryptedAttachmentRecordSchema }).strict(),
|
|
3120
|
-
external_exports.object({
|
|
3121
|
-
kind: external_exports.literal("attachment-header"),
|
|
3122
|
-
record: persistedAttachmentHeaderRecordSchema
|
|
3123
|
-
}).strict(),
|
|
3124
|
-
external_exports.object({
|
|
3125
|
-
kind: external_exports.literal("attachment-chunk"),
|
|
3126
|
-
record: persistedAttachmentChunkRecordSchema
|
|
3127
|
-
}).strict(),
|
|
3128
|
-
external_exports.object({ kind: external_exports.literal("audit"), record: encryptedAuditRecordSchema }).strict(),
|
|
3129
|
-
external_exports.object({ kind: external_exports.literal("history"), record: encryptedHistoryRecordSchema }).strict(),
|
|
3130
|
-
external_exports.object({
|
|
3131
|
-
kind: external_exports.literal("tombstone-predecessor"),
|
|
3132
|
-
entityType: external_exports.enum(["group", "item", "attachment"]),
|
|
3133
|
-
record: external_exports.union([
|
|
3134
|
-
encryptedGroupRecordSchema,
|
|
3135
|
-
encryptedItemRecordSchema,
|
|
3136
|
-
encryptedAttachmentRecordSchema
|
|
3137
|
-
])
|
|
3138
|
-
}).strict().superRefine((entry, context) => {
|
|
3139
|
-
const actualType = "itemId" in entry.record ? "attachment" : "groupId" in entry.record ? "item" : "group";
|
|
3140
|
-
if (entry.entityType !== actualType) {
|
|
3141
|
-
context.addIssue({
|
|
3142
|
-
code: "custom",
|
|
3143
|
-
path: ["entityType"],
|
|
3144
|
-
message: "Tombstone predecessor kind does not match its opaque record"
|
|
3145
|
-
});
|
|
3146
|
-
}
|
|
3147
|
-
if (entry.record.tombstonedAt !== void 0) {
|
|
3148
|
-
context.addIssue({
|
|
3149
|
-
code: "custom",
|
|
3150
|
-
path: ["record", "tombstonedAt"],
|
|
3151
|
-
message: "Tombstone predecessor must be an active opaque record"
|
|
3152
|
-
});
|
|
3153
|
-
}
|
|
3154
|
-
}),
|
|
3155
|
-
external_exports.object({ kind: external_exports.literal("tombstone"), record: tombstoneRecordSchema }).strict()
|
|
3156
|
-
]);
|
|
3157
|
-
var encryptedBackupFooterSchema = external_exports.object({
|
|
3158
|
-
type: external_exports.literal("footer"),
|
|
3159
|
-
version: external_exports.literal(1),
|
|
3160
|
-
recordCount: external_exports.number().int().positive().max(1e7),
|
|
3161
|
-
transcriptSha256: sha256DigestSchema,
|
|
3162
|
-
authenticationTag: backupAuthenticationTagSchema
|
|
3163
|
-
}).strict();
|
|
3164
|
-
var backupRecordCountSchema = external_exports.number().int().positive().max(DEFAULT_MAX_BACKUP_RECORDS);
|
|
3165
|
-
var backupSubcountSchema = external_exports.number().int().nonnegative().max(DEFAULT_MAX_BACKUP_RECORDS);
|
|
3166
|
-
var backupVerificationSchema = external_exports.object({
|
|
3167
|
-
header: encryptedBackupHeaderSchema,
|
|
3168
|
-
restoreSessionId: sha256DigestSchema,
|
|
3169
|
-
recordCount: backupRecordCountSchema,
|
|
3170
|
-
transcriptSha256: sha256DigestSchema,
|
|
3171
|
-
canonicalEntriesSha256: sha256DigestSchema
|
|
3172
|
-
}).strict();
|
|
3173
|
-
var selectedRestoreSlotSchema = external_exports.object({
|
|
3174
|
-
id: keySlotIdSchema,
|
|
3175
|
-
type: external_exports.enum(["portable-key", "passphrase", "recovery-key"]),
|
|
3176
|
-
keyVersion: keyVersionSchema
|
|
3177
|
-
}).strict();
|
|
3178
|
-
var verifiedRestoreCountsSchema = external_exports.object({
|
|
3179
|
-
vaults: external_exports.literal(1),
|
|
3180
|
-
groups: backupSubcountSchema,
|
|
3181
|
-
items: backupSubcountSchema,
|
|
3182
|
-
attachments: backupSubcountSchema,
|
|
3183
|
-
attachmentHeaders: backupSubcountSchema,
|
|
3184
|
-
attachmentChunks: backupSubcountSchema,
|
|
3185
|
-
tombstonePredecessors: external_exports.object({
|
|
3186
|
-
groups: backupSubcountSchema,
|
|
3187
|
-
items: backupSubcountSchema,
|
|
3188
|
-
attachments: backupSubcountSchema
|
|
3189
|
-
}).strict(),
|
|
3190
|
-
tombstones: backupSubcountSchema,
|
|
3191
|
-
histories: backupSubcountSchema,
|
|
3192
|
-
audits: backupSubcountSchema
|
|
3193
|
-
}).strict();
|
|
3194
|
-
var restoreKnownRecordsVerificationV1Schema = external_exports.object({
|
|
3195
|
-
version: external_exports.literal(1),
|
|
3196
|
-
scope: external_exports.literal("known-v1-records"),
|
|
3197
|
-
vaultId: vaultIdSchema,
|
|
3198
|
-
vaultRevision: vaultRevisionSchema,
|
|
3199
|
-
restoreSessionId: sha256DigestSchema,
|
|
3200
|
-
transcriptSha256: sha256DigestSchema,
|
|
3201
|
-
canonicalEntriesSha256: sha256DigestSchema,
|
|
3202
|
-
recordCount: backupRecordCountSchema,
|
|
3203
|
-
selectedSlot: selectedRestoreSlotSchema,
|
|
3204
|
-
verified: verifiedRestoreCountsSchema
|
|
3205
|
-
}).strict().superRefine((receipt, context) => {
|
|
3206
|
-
const predecessors = receipt.verified.tombstonePredecessors;
|
|
3207
|
-
const predecessorCount = predecessors.groups + predecessors.items + predecessors.attachments;
|
|
3208
|
-
const observedCount = receipt.verified.vaults + receipt.verified.groups + receipt.verified.items + receipt.verified.attachments + receipt.verified.attachmentHeaders + receipt.verified.attachmentChunks + predecessorCount + receipt.verified.tombstones + receipt.verified.histories + receipt.verified.audits;
|
|
3209
|
-
if (observedCount !== receipt.recordCount) {
|
|
3210
|
-
context.addIssue({
|
|
3211
|
-
code: "custom",
|
|
3212
|
-
path: ["recordCount"],
|
|
3213
|
-
message: "Restore verification counts do not match the backup record count"
|
|
3214
|
-
});
|
|
3215
|
-
}
|
|
3216
|
-
if (receipt.verified.attachmentHeaders !== receipt.verified.attachments) {
|
|
3217
|
-
context.addIssue({
|
|
3218
|
-
code: "custom",
|
|
3219
|
-
path: ["verified", "attachmentHeaders"],
|
|
3220
|
-
message: "Every verified attachment must have one verified header"
|
|
3221
|
-
});
|
|
3222
|
-
}
|
|
3223
|
-
if (receipt.verified.attachmentChunks < receipt.verified.attachments) {
|
|
3224
|
-
context.addIssue({
|
|
3225
|
-
code: "custom",
|
|
3226
|
-
path: ["verified", "attachmentChunks"],
|
|
3227
|
-
message: "Every verified attachment must have at least one verified chunk"
|
|
3228
|
-
});
|
|
3229
|
-
}
|
|
3230
|
-
if (receipt.verified.tombstones < predecessorCount) {
|
|
3231
|
-
context.addIssue({
|
|
3232
|
-
code: "custom",
|
|
3233
|
-
path: ["verified", "tombstones"],
|
|
3234
|
-
message: "Verified tombstones cannot have more predecessors than tombstones"
|
|
3235
|
-
});
|
|
3236
|
-
}
|
|
3237
|
-
});
|
|
3238
|
-
var restoreProgressStatusSchema = external_exports.object({
|
|
3239
|
-
protocolVersion: external_exports.literal(2),
|
|
3240
|
-
restoreSessionId: sha256DigestSchema,
|
|
3241
|
-
maximumBytes: external_exports.number().int().positive().max(MAX_SUPPORTED_BACKUP_BYTES),
|
|
3242
|
-
maximumRecords: backupRecordCountSchema,
|
|
3243
|
-
stagedBytes: external_exports.number().int().nonnegative().max(MAX_SUPPORTED_BACKUP_BYTES),
|
|
3244
|
-
stagedRecords: backupSubcountSchema,
|
|
3245
|
-
createdAt: timestampSchema,
|
|
3246
|
-
updatedAt: timestampSchema
|
|
3247
|
-
});
|
|
3248
|
-
var stagingRestoreStatusSchema = restoreProgressStatusSchema.extend({
|
|
3249
|
-
state: external_exports.literal("staging"),
|
|
3250
|
-
vaultId: vaultIdSchema.optional()
|
|
3251
|
-
}).strict();
|
|
3252
|
-
var sealedRestoreStatusSchema = restoreProgressStatusSchema.extend({
|
|
3253
|
-
state: external_exports.literal("sealed"),
|
|
3254
|
-
vaultId: vaultIdSchema,
|
|
3255
|
-
summary: backupVerificationSchema,
|
|
3256
|
-
sealedAt: timestampSchema
|
|
3257
|
-
}).strict();
|
|
3258
|
-
var publishedRestoreStatusSchema = restoreProgressStatusSchema.extend({
|
|
3259
|
-
state: external_exports.literal("published"),
|
|
3260
|
-
vaultId: vaultIdSchema,
|
|
3261
|
-
summary: backupVerificationSchema,
|
|
3262
|
-
sealedAt: timestampSchema,
|
|
3263
|
-
publishedAt: timestampSchema
|
|
3264
|
-
}).strict();
|
|
3265
|
-
var committedRestoreStatusSchema = external_exports.object({
|
|
3266
|
-
state: external_exports.literal("committed"),
|
|
3267
|
-
protocolVersion: external_exports.literal(2),
|
|
3268
|
-
restoreSessionId: sha256DigestSchema,
|
|
3269
|
-
summary: backupVerificationSchema,
|
|
3270
|
-
committedAt: timestampSchema
|
|
3271
|
-
}).strict();
|
|
3272
|
-
var abortedRestoreStatusSchema = external_exports.object({
|
|
3273
|
-
state: external_exports.literal("aborted"),
|
|
3274
|
-
protocolVersion: external_exports.literal(2),
|
|
3275
|
-
restoreSessionId: sha256DigestSchema,
|
|
3276
|
-
abortedAt: timestampSchema
|
|
3277
|
-
}).strict();
|
|
3278
|
-
var backupRestoreStatusSchema = external_exports.discriminatedUnion("state", [
|
|
3279
|
-
stagingRestoreStatusSchema,
|
|
3280
|
-
sealedRestoreStatusSchema,
|
|
3281
|
-
publishedRestoreStatusSchema,
|
|
3282
|
-
committedRestoreStatusSchema,
|
|
3283
|
-
abortedRestoreStatusSchema
|
|
3284
|
-
]).superRefine((status, context) => {
|
|
3285
|
-
if ("stagedBytes" in status && status.stagedBytes > status.maximumBytes) {
|
|
3286
|
-
context.addIssue({
|
|
3287
|
-
code: "custom",
|
|
3288
|
-
path: ["stagedBytes"],
|
|
3289
|
-
message: "Staged bytes exceed the restore session bound"
|
|
3290
|
-
});
|
|
3291
|
-
}
|
|
3292
|
-
if ("stagedRecords" in status && status.stagedRecords > status.maximumRecords) {
|
|
3293
|
-
context.addIssue({
|
|
3294
|
-
code: "custom",
|
|
3295
|
-
path: ["stagedRecords"],
|
|
3296
|
-
message: "Staged records exceed the restore session bound"
|
|
3297
|
-
});
|
|
3298
|
-
}
|
|
3299
|
-
if ("stagedRecords" in status) {
|
|
3300
|
-
const hasStagedRecords = status.stagedRecords > 0;
|
|
3301
|
-
const hasStagedBytes = status.stagedBytes > 0;
|
|
3302
|
-
if (hasStagedRecords !== hasStagedBytes) {
|
|
3303
|
-
context.addIssue({
|
|
3304
|
-
code: "custom",
|
|
3305
|
-
path: ["stagedRecords"],
|
|
3306
|
-
message: "Restore staging record and byte progress must advance together"
|
|
3307
|
-
});
|
|
3308
|
-
}
|
|
3309
|
-
if (status.state === "staging" && status.vaultId !== void 0 !== hasStagedRecords) {
|
|
3310
|
-
context.addIssue({
|
|
3311
|
-
code: "custom",
|
|
3312
|
-
path: ["vaultId"],
|
|
3313
|
-
message: "Restore staging binds a vault exactly when its prefix is nonempty"
|
|
3314
|
-
});
|
|
3315
|
-
}
|
|
3316
|
-
}
|
|
3317
|
-
if (status.state === "staging" || status.state === "aborted")
|
|
3318
|
-
return;
|
|
3319
|
-
if (status.restoreSessionId !== status.summary.restoreSessionId) {
|
|
3320
|
-
context.addIssue({
|
|
3321
|
-
code: "custom",
|
|
3322
|
-
path: ["restoreSessionId"],
|
|
3323
|
-
message: "Restore status and authenticated summary identify different sessions"
|
|
3324
|
-
});
|
|
3325
|
-
}
|
|
3326
|
-
if (status.state === "committed")
|
|
3327
|
-
return;
|
|
3328
|
-
if (status.vaultId !== status.summary.header.vaultId) {
|
|
3329
|
-
context.addIssue({
|
|
3330
|
-
code: "custom",
|
|
3331
|
-
path: ["vaultId"],
|
|
3332
|
-
message: "Restore status and authenticated summary identify different vaults"
|
|
3333
|
-
});
|
|
3334
|
-
}
|
|
3335
|
-
if (status.stagedRecords !== status.summary.recordCount || status.summary.recordCount > status.maximumRecords) {
|
|
3336
|
-
context.addIssue({
|
|
3337
|
-
code: "custom",
|
|
3338
|
-
path: ["stagedRecords"],
|
|
3339
|
-
message: "Frozen restore progress does not match the authenticated summary"
|
|
3340
|
-
});
|
|
3341
|
-
}
|
|
3342
|
-
});
|
|
3343
|
-
|
|
3344
|
-
// ../../packages/schemas/dist/cli-contract.js
|
|
3345
|
-
var CLI_EXIT_CODES = Object.freeze({
|
|
3346
|
-
ok: 0,
|
|
3347
|
-
unclassifiedFailure: 1,
|
|
3348
|
-
usageError: 2,
|
|
3349
|
-
authenticationFailed: 10,
|
|
3350
|
-
credentialMissing: 11,
|
|
3351
|
-
authorizationDenied: 12,
|
|
3352
|
-
grantInvalid: 13,
|
|
3353
|
-
invalidConfiguration: 14,
|
|
3354
|
-
datastoreFailure: 15,
|
|
3355
|
-
securityIntegrityFailure: 16,
|
|
3356
|
-
confirmationRequired: 17
|
|
3357
|
-
});
|
|
3358
|
-
var CLI_ERROR_CODES = [
|
|
3359
|
-
"OK",
|
|
3360
|
-
"UNCLASSIFIED_FAILURE",
|
|
3361
|
-
"USAGE_ERROR",
|
|
3362
|
-
"AUTHENTICATION_FAILED",
|
|
3363
|
-
"CREDENTIAL_MISSING",
|
|
3364
|
-
"AUTHORIZATION_DENIED",
|
|
3365
|
-
"GRANT_INVALID",
|
|
3366
|
-
"INVALID_CONFIGURATION",
|
|
3367
|
-
"DATASTORE_FAILURE",
|
|
3368
|
-
"SECURITY_INTEGRITY_FAILURE",
|
|
3369
|
-
"CONFIRMATION_REQUIRED"
|
|
3370
|
-
];
|
|
3371
|
-
var cliErrorCodeSchema = external_exports.enum(CLI_ERROR_CODES);
|
|
3372
|
-
var CLI_ERROR_EXIT_CODES = Object.freeze({
|
|
3373
|
-
OK: CLI_EXIT_CODES.ok,
|
|
3374
|
-
UNCLASSIFIED_FAILURE: CLI_EXIT_CODES.unclassifiedFailure,
|
|
3375
|
-
USAGE_ERROR: CLI_EXIT_CODES.usageError,
|
|
3376
|
-
AUTHENTICATION_FAILED: CLI_EXIT_CODES.authenticationFailed,
|
|
3377
|
-
CREDENTIAL_MISSING: CLI_EXIT_CODES.credentialMissing,
|
|
3378
|
-
AUTHORIZATION_DENIED: CLI_EXIT_CODES.authorizationDenied,
|
|
3379
|
-
GRANT_INVALID: CLI_EXIT_CODES.grantInvalid,
|
|
3380
|
-
INVALID_CONFIGURATION: CLI_EXIT_CODES.invalidConfiguration,
|
|
3381
|
-
DATASTORE_FAILURE: CLI_EXIT_CODES.datastoreFailure,
|
|
3382
|
-
SECURITY_INTEGRITY_FAILURE: CLI_EXIT_CODES.securityIntegrityFailure,
|
|
3383
|
-
CONFIRMATION_REQUIRED: CLI_EXIT_CODES.confirmationRequired
|
|
3384
|
-
});
|
|
3385
|
-
function exitCodeForCliError(code) {
|
|
3386
|
-
return CLI_ERROR_EXIT_CODES[code];
|
|
3387
|
-
}
|
|
3388
|
-
var cliErrorEnvelopeSchema = external_exports.object({
|
|
3389
|
-
error: external_exports.object({
|
|
3390
|
-
code: cliErrorCodeSchema,
|
|
3391
|
-
exitCode: external_exports.number().int().min(0).max(255),
|
|
3392
|
-
message: external_exports.string().min(1).max(1024)
|
|
3393
|
-
}).strict()
|
|
3394
|
-
}).strict();
|
|
3395
|
-
|
|
3396
|
-
// ../../packages/schemas/dist/database-container.js
|
|
3397
|
-
var DATABASE_CONTAINER_FORMAT = "kavrix-encrypted-database";
|
|
3398
|
-
var FILE_DATABASE_CONTAINER_FORMAT = "kavrix-file-database-container";
|
|
3399
|
-
var CURRENT_DATABASE_CONTAINER_VERSION = 1;
|
|
3400
|
-
var MAX_DATABASE_RECOVERY_SLOTS = 32;
|
|
3401
|
-
var MAX_DATABASE_VAULTS = 1e3;
|
|
3402
|
-
var databaseRevisionSchema = external_exports.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER).brand();
|
|
3403
|
-
var opaqueDatabaseEntityIdSchema = external_exports.union([
|
|
3404
|
-
databaseIdSchema,
|
|
3405
|
-
vaultIdSchema,
|
|
3406
|
-
keySlotIdSchema
|
|
3407
|
-
]);
|
|
3408
|
-
var databaseAssociatedDataSchema = external_exports.object({
|
|
3409
|
-
version: external_exports.literal(1),
|
|
3410
|
-
databaseId: databaseIdSchema,
|
|
3411
|
-
entityType: external_exports.enum([
|
|
3412
|
-
"database-catalog",
|
|
3413
|
-
"wrapped-database-root",
|
|
3414
|
-
"wrapped-vault-root"
|
|
3415
|
-
]),
|
|
3416
|
-
entityId: opaqueDatabaseEntityIdSchema,
|
|
3417
|
-
purpose: external_exports.enum(["catalog", "database-root", "vault-root"]),
|
|
3418
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
3419
|
-
keyVersion: keyVersionSchema,
|
|
3420
|
-
revision: databaseRevisionSchema,
|
|
3421
|
-
vaultId: vaultIdSchema.optional(),
|
|
3422
|
-
metadataDigest: sha256DigestSchema
|
|
3423
|
-
}).strict().superRefine((associatedData, context) => {
|
|
3424
|
-
const invalidRelation = associatedData.entityType === "database-catalog" && (associatedData.purpose !== "catalog" || associatedData.entityId !== associatedData.databaseId || associatedData.vaultId !== void 0) || associatedData.entityType === "wrapped-database-root" && (associatedData.purpose !== "database-root" || !keySlotIdSchema.safeParse(associatedData.entityId).success || associatedData.vaultId !== void 0) || associatedData.entityType === "wrapped-vault-root" && (associatedData.purpose !== "vault-root" || !vaultIdSchema.safeParse(associatedData.entityId).success || associatedData.vaultId === void 0 || associatedData.entityId !== associatedData.vaultId);
|
|
3425
|
-
if (invalidRelation) {
|
|
3426
|
-
context.addIssue({
|
|
3427
|
-
code: "custom",
|
|
3428
|
-
message: "Database associated data has an invalid entity, purpose, or identity binding"
|
|
3429
|
-
});
|
|
3430
|
-
}
|
|
3431
|
-
});
|
|
3432
|
-
var databaseAeadEnvelopeSchema = external_exports.object({
|
|
3433
|
-
version: envelopeVersionSchema,
|
|
3434
|
-
algorithm: external_exports.literal("xchacha20-poly1305-ietf"),
|
|
3435
|
-
nonce: base64UrlSchema,
|
|
3436
|
-
ciphertext: base64UrlSchema,
|
|
3437
|
-
authenticationTag: base64UrlSchema,
|
|
3438
|
-
aad: databaseAssociatedDataSchema,
|
|
3439
|
-
keyVersion: keyVersionSchema
|
|
3440
|
-
}).strict().superRefine((envelope, context) => {
|
|
3441
|
-
if (envelope.nonce.length !== AEAD_NONCE_BASE64URL_CHARS) {
|
|
3442
|
-
context.addIssue({
|
|
3443
|
-
code: "custom",
|
|
3444
|
-
message: "Nonce length does not match the authenticated-encryption algorithm",
|
|
3445
|
-
path: ["nonce"]
|
|
3446
|
-
});
|
|
3447
|
-
}
|
|
3448
|
-
if (envelope.authenticationTag.length !== AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS) {
|
|
3449
|
-
context.addIssue({
|
|
3450
|
-
code: "custom",
|
|
3451
|
-
message: "Authentication tag must encode 16 bytes",
|
|
3452
|
-
path: ["authenticationTag"]
|
|
3453
|
-
});
|
|
3454
|
-
}
|
|
3455
|
-
if (envelope.keyVersion !== envelope.aad.keyVersion) {
|
|
3456
|
-
context.addIssue({
|
|
3457
|
-
code: "custom",
|
|
3458
|
-
message: "Envelope key version must be authenticated in associated data",
|
|
3459
|
-
path: ["keyVersion"]
|
|
3460
|
-
});
|
|
3461
|
-
}
|
|
3462
|
-
});
|
|
3463
|
-
var databaseCatalogVaultSchema = external_exports.object({
|
|
3464
|
-
id: vaultIdSchema,
|
|
3465
|
-
label: external_exports.string().trim().min(1).max(256),
|
|
3466
|
-
createdAt: timestampSchema
|
|
3467
|
-
}).strict();
|
|
3468
|
-
var databaseCatalogPayloadSchema = external_exports.object({
|
|
3469
|
-
label: external_exports.string().trim().min(1).max(256),
|
|
3470
|
-
vaults: external_exports.array(databaseCatalogVaultSchema).max(MAX_DATABASE_VAULTS)
|
|
3471
|
-
}).strict().superRefine((catalog, context) => {
|
|
3472
|
-
const vaultIds = /* @__PURE__ */ new Set();
|
|
3473
|
-
for (const [index, vault] of catalog.vaults.entries()) {
|
|
3474
|
-
if (vaultIds.has(vault.id)) {
|
|
3475
|
-
context.addIssue({
|
|
3476
|
-
code: "custom",
|
|
3477
|
-
path: ["vaults", index, "id"],
|
|
3478
|
-
message: "Database catalog vault IDs must be unique"
|
|
3479
|
-
});
|
|
3480
|
-
}
|
|
3481
|
-
vaultIds.add(vault.id);
|
|
3482
|
-
}
|
|
3483
|
-
});
|
|
3484
|
-
var databasePortableKeyDerivationSchema = external_exports.object({
|
|
3485
|
-
algorithm: external_exports.literal("hkdf-sha256"),
|
|
3486
|
-
version: external_exports.literal(1),
|
|
3487
|
-
salt: base64UrlSchema.length(43),
|
|
3488
|
-
context: external_exports.literal("kavrix/database-root-wrap/v1"),
|
|
3489
|
-
outputLength: external_exports.literal(32)
|
|
3490
|
-
}).strict();
|
|
3491
|
-
var databaseRecoveryKeyDerivationSchema = external_exports.object({
|
|
3492
|
-
algorithm: external_exports.literal("hkdf-sha256"),
|
|
3493
|
-
version: external_exports.literal(1),
|
|
3494
|
-
salt: base64UrlSchema.length(43),
|
|
3495
|
-
context: external_exports.literal("kavrix/database-recovery-wrap/v1"),
|
|
3496
|
-
outputLength: external_exports.literal(32)
|
|
3497
|
-
}).strict();
|
|
3498
|
-
var databaseKeySlotBaseSchema = external_exports.object({
|
|
3499
|
-
slotVersion: keySlotVersionSchema,
|
|
3500
|
-
id: keySlotIdSchema,
|
|
3501
|
-
state: external_exports.enum(["active", "revoked"]),
|
|
3502
|
-
keyVersion: keyVersionSchema,
|
|
3503
|
-
wrappedDatabaseRoot: databaseAeadEnvelopeSchema,
|
|
3504
|
-
createdAt: timestampSchema,
|
|
3505
|
-
revokedAt: timestampSchema.optional()
|
|
3506
|
-
});
|
|
3507
|
-
var databasePortableKeySlotSchema = databaseKeySlotBaseSchema.extend({
|
|
3508
|
-
type: external_exports.literal("portable-key"),
|
|
3509
|
-
state: external_exports.literal("active"),
|
|
3510
|
-
derivation: databasePortableKeyDerivationSchema
|
|
3511
|
-
}).strict().superRefine((slot, context) => {
|
|
3512
|
-
if (slot.revokedAt !== void 0) {
|
|
3513
|
-
context.addIssue({
|
|
3514
|
-
code: "custom",
|
|
3515
|
-
path: ["revokedAt"],
|
|
3516
|
-
message: "Active database portable-key slots cannot have a revocation timestamp"
|
|
3517
|
-
});
|
|
3518
|
-
}
|
|
3519
|
-
validateDatabaseRootSlotBinding(slot, context);
|
|
3520
|
-
});
|
|
3521
|
-
var databaseRecoverySlotSchema = databaseKeySlotBaseSchema.extend({
|
|
3522
|
-
type: external_exports.literal("recovery-key"),
|
|
3523
|
-
derivation: databaseRecoveryKeyDerivationSchema
|
|
3524
|
-
}).strict().superRefine((slot, context) => {
|
|
3525
|
-
if (slot.state === "revoked" && slot.revokedAt === void 0) {
|
|
3526
|
-
context.addIssue({
|
|
3527
|
-
code: "custom",
|
|
3528
|
-
path: ["revokedAt"],
|
|
3529
|
-
message: "Revoked database recovery slots require a timestamp"
|
|
3530
|
-
});
|
|
3531
|
-
}
|
|
3532
|
-
if (slot.state === "active" && slot.revokedAt !== void 0) {
|
|
3533
|
-
context.addIssue({
|
|
3534
|
-
code: "custom",
|
|
3535
|
-
path: ["revokedAt"],
|
|
3536
|
-
message: "Active database recovery slots cannot have a revocation timestamp"
|
|
3537
|
-
});
|
|
3538
|
-
}
|
|
3539
|
-
validateDatabaseRootSlotBinding(slot, context);
|
|
3540
|
-
});
|
|
3541
|
-
var encryptedDatabaseDocumentSchema = external_exports.object({
|
|
3542
|
-
format: external_exports.literal(DATABASE_CONTAINER_FORMAT),
|
|
3543
|
-
version: external_exports.literal(CURRENT_DATABASE_CONTAINER_VERSION),
|
|
3544
|
-
id: databaseIdSchema,
|
|
3545
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
3546
|
-
cryptographicVersion: supportedCryptographicVersionSchema,
|
|
3547
|
-
currentKeyVersion: keyVersionSchema,
|
|
3548
|
-
keySlot: databasePortableKeySlotSchema,
|
|
3549
|
-
recoverySlots: external_exports.array(databaseRecoverySlotSchema).max(MAX_DATABASE_RECOVERY_SLOTS),
|
|
3550
|
-
revision: databaseRevisionSchema,
|
|
3551
|
-
encryptedCatalog: databaseAeadEnvelopeSchema,
|
|
3552
|
-
catalogMetadataDigest: sha256DigestSchema,
|
|
3553
|
-
createdAt: timestampSchema,
|
|
3554
|
-
updatedAt: timestampSchema
|
|
3555
|
-
}).strict().superRefine((database, context) => {
|
|
3556
|
-
if (database.keySlot.keyVersion !== database.currentKeyVersion) {
|
|
3557
|
-
context.addIssue({
|
|
3558
|
-
code: "custom",
|
|
3559
|
-
path: ["keySlot", "keyVersion"],
|
|
3560
|
-
message: "Database portable-key slot version must match the current key version"
|
|
3561
|
-
});
|
|
3562
|
-
}
|
|
3563
|
-
if (database.keySlot.wrappedDatabaseRoot.aad.databaseId !== database.id) {
|
|
3564
|
-
context.addIssue({
|
|
3565
|
-
code: "custom",
|
|
3566
|
-
path: ["keySlot", "wrappedDatabaseRoot", "aad", "databaseId"],
|
|
3567
|
-
message: "Database portable-key slot belongs to another database"
|
|
3568
|
-
});
|
|
3569
|
-
}
|
|
3570
|
-
const keySlotIds = /* @__PURE__ */ new Set([database.keySlot.id]);
|
|
3571
|
-
for (const [index, slot] of database.recoverySlots.entries()) {
|
|
3572
|
-
if (keySlotIds.has(slot.id)) {
|
|
3573
|
-
context.addIssue({
|
|
3574
|
-
code: "custom",
|
|
3575
|
-
path: ["recoverySlots", index, "id"],
|
|
3576
|
-
message: "Database key slot IDs must be unique"
|
|
3577
|
-
});
|
|
3578
|
-
}
|
|
3579
|
-
keySlotIds.add(slot.id);
|
|
3580
|
-
if (slot.keyVersion !== database.currentKeyVersion) {
|
|
3581
|
-
context.addIssue({
|
|
3582
|
-
code: "custom",
|
|
3583
|
-
path: ["recoverySlots", index, "keyVersion"],
|
|
3584
|
-
message: "Database recovery slot version must match the current key version"
|
|
3585
|
-
});
|
|
3586
|
-
}
|
|
3587
|
-
if (slot.wrappedDatabaseRoot.aad.databaseId !== database.id) {
|
|
3588
|
-
context.addIssue({
|
|
3589
|
-
code: "custom",
|
|
3590
|
-
path: ["recoverySlots", index, "wrappedDatabaseRoot", "aad", "databaseId"],
|
|
3591
|
-
message: "Database recovery slot belongs to another database"
|
|
3592
|
-
});
|
|
3593
|
-
}
|
|
3594
|
-
}
|
|
3595
|
-
const catalog = database.encryptedCatalog;
|
|
3596
|
-
if (catalog.aad.databaseId !== database.id || catalog.aad.schemaVersion !== database.schemaVersion || catalog.aad.keyVersion !== database.currentKeyVersion || catalog.aad.revision !== database.revision || catalog.aad.metadataDigest !== database.catalogMetadataDigest) {
|
|
3597
|
-
context.addIssue({
|
|
3598
|
-
code: "custom",
|
|
3599
|
-
path: ["encryptedCatalog", "aad"],
|
|
3600
|
-
message: "Encrypted database catalog has invalid associated data"
|
|
3601
|
-
});
|
|
3602
|
-
}
|
|
3603
|
-
});
|
|
3604
|
-
var databaseVaultDocumentSchema = external_exports.object({
|
|
3605
|
-
databaseId: databaseIdSchema,
|
|
3606
|
-
id: vaultIdSchema,
|
|
3607
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
3608
|
-
cryptographicVersion: supportedCryptographicVersionSchema,
|
|
3609
|
-
currentKeyVersion: keyVersionSchema,
|
|
3610
|
-
databaseRevision: databaseRevisionSchema,
|
|
3611
|
-
revision: vaultRevisionSchema,
|
|
3612
|
-
wrappedVaultRoot: databaseAeadEnvelopeSchema,
|
|
3613
|
-
encryptedPayload: aeadEnvelopeSchema,
|
|
3614
|
-
payloadMetadataDigest: sha256DigestSchema,
|
|
3615
|
-
createdAt: timestampSchema,
|
|
3616
|
-
updatedAt: timestampSchema
|
|
3617
|
-
}).strict().superRefine((vault, context) => {
|
|
3618
|
-
const wrappedRoot = vault.wrappedVaultRoot;
|
|
3619
|
-
if (wrappedRoot.aad.databaseId !== vault.databaseId || wrappedRoot.aad.vaultId !== vault.id || wrappedRoot.aad.schemaVersion !== vault.schemaVersion || wrappedRoot.aad.keyVersion !== vault.currentKeyVersion || wrappedRoot.aad.revision !== vault.databaseRevision) {
|
|
3620
|
-
context.addIssue({
|
|
3621
|
-
code: "custom",
|
|
3622
|
-
path: ["wrappedVaultRoot", "aad"],
|
|
3623
|
-
message: "Wrapped vault root has invalid associated data"
|
|
3624
|
-
});
|
|
3625
|
-
}
|
|
3626
|
-
const payload = vault.encryptedPayload;
|
|
3627
|
-
if (payload.aad.vaultId !== vault.id || !isVaultPreferencesPayloadDomain(payload.aad) || payload.aad.entityId !== vault.id || payload.aad.schemaVersion !== vault.schemaVersion || payload.aad.keyVersion !== vault.currentKeyVersion || payload.aad.revision !== vault.revision || payload.aad.metadataDigest !== vault.payloadMetadataDigest) {
|
|
3628
|
-
context.addIssue({
|
|
3629
|
-
code: "custom",
|
|
3630
|
-
path: ["encryptedPayload", "aad"],
|
|
3631
|
-
message: "Encrypted vault payload has invalid associated data"
|
|
3632
|
-
});
|
|
3633
|
-
}
|
|
3634
|
-
});
|
|
3635
|
-
function isVaultPreferencesPayloadDomain(value) {
|
|
3636
|
-
return value.entityType === "vault-preferences" && value.purpose === "vault-preferences";
|
|
3637
|
-
}
|
|
3638
|
-
var fileDatabaseContainerSchema = external_exports.object({
|
|
3639
|
-
format: external_exports.literal(FILE_DATABASE_CONTAINER_FORMAT),
|
|
3640
|
-
version: external_exports.literal(CURRENT_DATABASE_CONTAINER_VERSION),
|
|
3641
|
-
database: encryptedDatabaseDocumentSchema,
|
|
3642
|
-
vaults: external_exports.record(vaultIdSchema, databaseVaultDocumentSchema)
|
|
3643
|
-
}).strict().superRefine((container, context) => {
|
|
3644
|
-
const entries = Object.entries(container.vaults);
|
|
3645
|
-
if (entries.length > MAX_DATABASE_VAULTS) {
|
|
3646
|
-
context.addIssue({
|
|
3647
|
-
code: "custom",
|
|
3648
|
-
path: ["vaults"],
|
|
3649
|
-
message: "Database container contains too many vaults"
|
|
3650
|
-
});
|
|
3651
|
-
}
|
|
3652
|
-
for (const [vaultId, vault] of entries) {
|
|
3653
|
-
if (vaultId !== vault.id) {
|
|
3654
|
-
context.addIssue({
|
|
3655
|
-
code: "custom",
|
|
3656
|
-
path: ["vaults", vaultId],
|
|
3657
|
-
message: "Database container vault map keys must match vault IDs"
|
|
3658
|
-
});
|
|
3659
|
-
}
|
|
3660
|
-
if (vault.databaseId !== container.database.id) {
|
|
3661
|
-
context.addIssue({
|
|
3662
|
-
code: "custom",
|
|
3663
|
-
path: ["vaults", vaultId, "databaseId"],
|
|
3664
|
-
message: "Database container vault belongs to another database"
|
|
3665
|
-
});
|
|
3666
|
-
}
|
|
3667
|
-
}
|
|
3668
|
-
});
|
|
3669
|
-
function validateDatabaseRootSlotBinding(slot, context) {
|
|
3670
|
-
const envelope = slot.wrappedDatabaseRoot;
|
|
3671
|
-
if (envelope.aad.entityId !== slot.id) {
|
|
3672
|
-
context.addIssue({
|
|
3673
|
-
code: "custom",
|
|
3674
|
-
path: ["wrappedDatabaseRoot", "aad", "entityId"],
|
|
3675
|
-
message: "Database root slot envelope is bound to a different slot"
|
|
3676
|
-
});
|
|
3677
|
-
}
|
|
3678
|
-
if (envelope.keyVersion !== slot.keyVersion) {
|
|
3679
|
-
context.addIssue({
|
|
3680
|
-
code: "custom",
|
|
3681
|
-
path: ["wrappedDatabaseRoot", "keyVersion"],
|
|
3682
|
-
message: "Database root slot envelope version must match its slot"
|
|
3683
|
-
});
|
|
3684
|
-
}
|
|
3685
|
-
}
|
|
3686
|
-
|
|
3687
|
-
// ../../packages/schemas/dist/keychain.js
|
|
3688
|
-
var deviceUnlockSecretSchema = external_exports.instanceof(Uint8Array).refine((value) => value.byteLength === 32, {
|
|
3689
|
-
error: "Device unlock secrets must contain exactly 32 bytes"
|
|
3690
|
-
}).brand();
|
|
3691
|
-
var keychainLocatorSchema = external_exports.object({
|
|
3692
|
-
version: external_exports.literal(1),
|
|
3693
|
-
vaultId: vaultIdSchema,
|
|
3694
|
-
deviceId: deviceIdSchema,
|
|
3695
|
-
keySlotId: keySlotIdSchema
|
|
3696
|
-
}).strict();
|
|
3697
|
-
var sessionCredentialSecretSchema = external_exports.instanceof(Uint8Array).refine((value) => value.byteLength === 32, {
|
|
3698
|
-
error: "Session credential secrets must contain exactly 32 bytes"
|
|
3699
|
-
}).brand();
|
|
3700
|
-
var sessionCredentialLocatorSchema = external_exports.object({
|
|
3701
|
-
version: external_exports.literal(1),
|
|
3702
|
-
vaultId: vaultIdSchema,
|
|
3703
|
-
deviceId: deviceIdSchema,
|
|
3704
|
-
purpose: external_exports.literal("api-session")
|
|
3705
|
-
}).strict();
|
|
3706
|
-
|
|
3707
|
-
// ../../packages/schemas/dist/policy.js
|
|
3708
|
-
var MAX_CREDENTIAL_REFERENCE_CHARS = 256;
|
|
3709
|
-
var MAX_COMMANDS_PER_ENTRY = 64;
|
|
3710
|
-
var MAX_STORED_POLICIES = 128;
|
|
3711
|
-
var MAX_STORED_GRANTS = 128;
|
|
3712
|
-
var MAX_RUNTIME_AUDIT_EVENTS = 512;
|
|
3713
|
-
var MAX_PROJECT_POLICIES = 128;
|
|
3714
|
-
var MAX_PROJECT_ENVIRONMENTS = 32;
|
|
3715
|
-
var MAX_SECRETS_PER_ENVIRONMENT = 64;
|
|
3716
|
-
var MAX_PROJECT_AGENTS = 32;
|
|
3717
|
-
var MAX_PERMISSIONS_PER_AGENT = 64;
|
|
3718
|
-
var MAX_CONFIRMATION_TOKENS = 16;
|
|
3719
|
-
var MAX_ARGV_PREVIEW_ENTRIES = 8;
|
|
3720
|
-
var MAX_ARGV_PREVIEW_CHARS = 64;
|
|
3721
|
-
var MAX_POLICY_DURATION_MS = 30 * 24 * 60 * 60 * 1e3;
|
|
3722
|
-
var MAX_AUTHORIZATION_STATE_BYTES = 512 * 1024;
|
|
3723
|
-
var RESERVED_CREDENTIAL_REFERENCES = /* @__PURE__ */ new Set([
|
|
3724
|
-
"__proto__",
|
|
3725
|
-
"constructor",
|
|
3726
|
-
"prototype"
|
|
3727
|
-
]);
|
|
3728
|
-
var credentialReferenceSchema = external_exports.string().min(1).max(MAX_CREDENTIAL_REFERENCE_CHARS).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), {
|
|
3729
|
-
message: "Credential references must not contain control characters"
|
|
3730
|
-
}).refine((value) => value.trim() === value, {
|
|
3731
|
-
message: "Credential references must not start or end with whitespace"
|
|
3732
|
-
}).refine((value) => !RESERVED_CREDENTIAL_REFERENCES.has(value), {
|
|
3733
|
-
message: "Credential reference is reserved"
|
|
3734
|
-
});
|
|
3735
|
-
var environmentNameSchema = external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/u, "Invalid environment name");
|
|
3736
|
-
var ENVIRONMENT_VARIABLE_NAME_PATTERN_SOURCE = "^[A-Za-z_][A-Za-z0-9_]{0,127}$";
|
|
3737
|
-
var environmentVariableNameSchema = external_exports.string().regex(new RegExp(ENVIRONMENT_VARIABLE_NAME_PATTERN_SOURCE), "Invalid environment variable name");
|
|
3738
|
-
var commandNameSchema = external_exports.string().min(1).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._+-]*$/u, "Command names must be bare executable names");
|
|
3739
|
-
var commandTokenSchema = external_exports.string().min(1).max(64).regex(/^[A-Za-z0-9][A-Za-z0-9._=+-]*$/u, "Invalid command token");
|
|
3740
|
-
var opaquePattern = new RegExp(OPAQUE_ID_PATTERN_SOURCE);
|
|
3741
|
-
var opaqueIdentifierSchema = external_exports.string().min(1).max(128).regex(opaquePattern, "Must be an opaque identifier");
|
|
3742
|
-
var sha256HexDigestSchema = external_exports.string().regex(/^[0-9a-f]{64}$/u, "Must be a lowercase hex SHA-256 digest");
|
|
3743
|
-
var DURATION_PATTERN_SOURCE = "^([1-9][0-9]{0,6})([smhd])$";
|
|
3744
|
-
var durationPattern = new RegExp(DURATION_PATTERN_SOURCE);
|
|
3745
|
-
var durationSchema = external_exports.string().regex(durationPattern, "Invalid duration");
|
|
3746
|
-
function parseDurationToMs(value) {
|
|
3747
|
-
if (!durationPattern.test(value))
|
|
3748
|
-
return void 0;
|
|
3749
|
-
const match = durationPattern.exec(value);
|
|
3750
|
-
const amountText = match?.[1];
|
|
3751
|
-
const unit = match?.[2];
|
|
3752
|
-
if (amountText === void 0 || unit === void 0)
|
|
3753
|
-
return void 0;
|
|
3754
|
-
const amount = Number(amountText);
|
|
3755
|
-
if (!Number.isSafeInteger(amount) || amount <= 0)
|
|
3756
|
-
return void 0;
|
|
3757
|
-
const multiplier = UNIT_MULTIPLIERS[unit];
|
|
3758
|
-
if (multiplier === void 0)
|
|
3759
|
-
return void 0;
|
|
3760
|
-
const totalMs = amount * multiplier;
|
|
3761
|
-
return totalMs <= MAX_POLICY_DURATION_MS ? totalMs : void 0;
|
|
3762
|
-
}
|
|
3763
|
-
var UNIT_MULTIPLIERS = Object.freeze({
|
|
3764
|
-
s: 1e3,
|
|
3765
|
-
m: 6e4,
|
|
3766
|
-
h: 36e5,
|
|
3767
|
-
d: 864e5
|
|
3768
|
-
});
|
|
3769
|
-
var confirmationRequirementSchema = external_exports.union([
|
|
3770
|
-
external_exports.boolean(),
|
|
3771
|
-
external_exports.array(commandTokenSchema).min(1).max(MAX_CONFIRMATION_TOKENS)
|
|
3772
|
-
]);
|
|
3773
|
-
var positiveMaxUsesSchema = external_exports.number().int().min(1).max(1e6);
|
|
3774
|
-
var workingDirectorySchema = external_exports.string().min(1).max(1024).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), {
|
|
3775
|
-
message: "Working directories must not contain control characters"
|
|
3776
|
-
});
|
|
3777
|
-
var permissionEntrySchema = external_exports.object({
|
|
3778
|
-
secret: credentialReferenceSchema.optional(),
|
|
3779
|
-
commands: external_exports.array(commandNameSchema).min(1).max(MAX_COMMANDS_PER_ENTRY).optional(),
|
|
3780
|
-
hashes: external_exports.record(commandNameSchema, sha256HexDigestSchema).optional(),
|
|
3781
|
-
env: environmentVariableNameSchema.optional(),
|
|
3782
|
-
reveal: external_exports.boolean().optional(),
|
|
3783
|
-
ttl: durationSchema.optional(),
|
|
3784
|
-
maxUses: positiveMaxUsesSchema.optional(),
|
|
3785
|
-
requireConfirmation: confirmationRequirementSchema.optional(),
|
|
3786
|
-
/** Restricts use to invocations whose working directory is inside this directory subtree. */
|
|
3787
|
-
workingDirectory: workingDirectorySchema.optional(),
|
|
3788
|
-
deny: external_exports.boolean().optional()
|
|
3789
|
-
}).strict().superRefine((entry, context) => {
|
|
3790
|
-
const deny = entry.deny === true;
|
|
3791
|
-
if (!deny) {
|
|
3792
|
-
if (entry.secret === void 0) {
|
|
3793
|
-
context.addIssue({
|
|
3794
|
-
code: "custom",
|
|
3795
|
-
message: "A permission entry requires a secret reference unless it denies",
|
|
3796
|
-
path: ["secret"]
|
|
3797
|
-
});
|
|
3798
|
-
}
|
|
3799
|
-
if (entry.commands === void 0) {
|
|
3800
|
-
context.addIssue({
|
|
3801
|
-
code: "custom",
|
|
3802
|
-
message: "A permission entry requires at least one allowed command",
|
|
3803
|
-
path: ["commands"]
|
|
3804
|
-
});
|
|
3805
|
-
}
|
|
3806
|
-
} else {
|
|
3807
|
-
for (const field of [
|
|
3808
|
-
"commands",
|
|
3809
|
-
"hashes",
|
|
3810
|
-
"ttl",
|
|
3811
|
-
"maxUses",
|
|
3812
|
-
"requireConfirmation",
|
|
3813
|
-
"workingDirectory"
|
|
3814
|
-
]) {
|
|
3815
|
-
if (entry[field] !== void 0) {
|
|
3816
|
-
context.addIssue({
|
|
3817
|
-
code: "custom",
|
|
3818
|
-
message: "A deny entry must not carry allowlist fields",
|
|
3819
|
-
path: [field]
|
|
3820
|
-
});
|
|
3821
|
-
}
|
|
3822
|
-
}
|
|
3823
|
-
}
|
|
3824
|
-
if (entry.hashes === void 0 || entry.commands === void 0)
|
|
3825
|
-
return;
|
|
3826
|
-
const commands = new Set(entry.commands);
|
|
3827
|
-
for (const pinned of Object.keys(entry.hashes)) {
|
|
3828
|
-
if (!commands.has(pinned)) {
|
|
3829
|
-
context.addIssue({
|
|
3830
|
-
code: "custom",
|
|
3831
|
-
message: "Executable pins must reference listed commands",
|
|
3832
|
-
path: ["hashes"]
|
|
3833
|
-
});
|
|
3834
|
-
return;
|
|
3835
|
-
}
|
|
3836
|
-
}
|
|
3837
|
-
});
|
|
3838
|
-
function normalizePermissionEntryAliases(value) {
|
|
3839
|
-
if (!isPlainObject(value))
|
|
3840
|
-
return value;
|
|
3841
|
-
let renamed = false;
|
|
3842
|
-
const output = {};
|
|
3843
|
-
for (const [key, entryValue] of Object.entries(value)) {
|
|
3844
|
-
if (key === "require_confirmation") {
|
|
3845
|
-
output["requireConfirmation"] ??= entryValue;
|
|
3846
|
-
renamed = true;
|
|
3847
|
-
continue;
|
|
3848
|
-
}
|
|
3849
|
-
if (key === "max_uses") {
|
|
3850
|
-
output["maxUses"] ??= entryValue;
|
|
3851
|
-
renamed = true;
|
|
3852
|
-
continue;
|
|
3853
|
-
}
|
|
3854
|
-
output[key] = entryValue;
|
|
3855
|
-
}
|
|
3856
|
-
return renamed ? output : value;
|
|
3857
|
-
}
|
|
3858
|
-
function isPlainObject(value) {
|
|
3859
|
-
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
3860
|
-
}
|
|
3861
|
-
function normalizeProjectConfigAliases(input) {
|
|
3862
|
-
if (!isPlainObject(input))
|
|
3863
|
-
return input;
|
|
3864
|
-
let document = input;
|
|
3865
|
-
let changed = false;
|
|
3866
|
-
const policies = normalizedMap(document["policies"]);
|
|
3867
|
-
if (policies.changed) {
|
|
3868
|
-
document = { ...document, policies: policies.map };
|
|
3869
|
-
changed = true;
|
|
3870
|
-
}
|
|
3871
|
-
if (isPlainObject(document["agents"])) {
|
|
3872
|
-
const agents = {};
|
|
3873
|
-
let agentsChanged = false;
|
|
3874
|
-
for (const [agentId, agent] of Object.entries(document["agents"])) {
|
|
3875
|
-
if (!isPlainObject(agent)) {
|
|
3876
|
-
agents[agentId] = agent;
|
|
3877
|
-
continue;
|
|
3878
|
-
}
|
|
3879
|
-
const permissions = normalizedMap(agent["permissions"]);
|
|
3880
|
-
if (permissions.changed) {
|
|
3881
|
-
agents[agentId] = { ...agent, ["permissions"]: permissions.map };
|
|
3882
|
-
agentsChanged = true;
|
|
3883
|
-
continue;
|
|
3884
|
-
}
|
|
3885
|
-
agents[agentId] = agent;
|
|
3886
|
-
}
|
|
3887
|
-
if (agentsChanged) {
|
|
3888
|
-
document = { ...document, agents };
|
|
3889
|
-
changed = true;
|
|
3890
|
-
}
|
|
3891
|
-
}
|
|
3892
|
-
if (isPlainObject(document["environments"])) {
|
|
3893
|
-
const environments = {};
|
|
3894
|
-
let environmentsChanged = false;
|
|
3895
|
-
for (const [environmentId, environment] of Object.entries(document["environments"])) {
|
|
3896
|
-
if (!isPlainObject(environment)) {
|
|
3897
|
-
environments[environmentId] = environment;
|
|
3898
|
-
continue;
|
|
3899
|
-
}
|
|
3900
|
-
const policies2 = normalizedMap(environment["policies"]);
|
|
3901
|
-
if (policies2.changed) {
|
|
3902
|
-
environments[environmentId] = { ...environment, ["policies"]: policies2.map };
|
|
3903
|
-
environmentsChanged = true;
|
|
3904
|
-
continue;
|
|
3905
|
-
}
|
|
3906
|
-
environments[environmentId] = environment;
|
|
3907
|
-
}
|
|
3908
|
-
if (environmentsChanged) {
|
|
3909
|
-
document = { ...document, environments };
|
|
3910
|
-
changed = true;
|
|
3911
|
-
}
|
|
3912
|
-
}
|
|
3913
|
-
return changed ? document : input;
|
|
3914
|
-
}
|
|
3915
|
-
function normalizedMap(mapValue) {
|
|
3916
|
-
if (!isPlainObject(mapValue))
|
|
3917
|
-
return { changed: false, map: mapValue };
|
|
3918
|
-
const next = {};
|
|
3919
|
-
let changed = false;
|
|
3920
|
-
for (const [key, entry] of Object.entries(mapValue)) {
|
|
3921
|
-
const normalized = normalizePermissionEntryAliases(entry);
|
|
3922
|
-
if (normalized !== entry)
|
|
3923
|
-
changed = true;
|
|
3924
|
-
next[key] = normalized;
|
|
3925
|
-
}
|
|
3926
|
-
return changed ? { changed: true, map: next } : { changed: false, map: mapValue };
|
|
3927
|
-
}
|
|
3928
|
-
var projectEnvironmentSchema = external_exports.object({
|
|
3929
|
-
secrets: external_exports.record(environmentVariableNameSchema, credentialReferenceSchema).optional(),
|
|
3930
|
-
policies: external_exports.record(opaqueIdentifierSchema, permissionEntrySchema).optional()
|
|
3931
|
-
}).strict().superRefine((environment, context) => {
|
|
3932
|
-
if ((environment.secrets === void 0 ? 0 : Object.keys(environment.secrets).length) > MAX_SECRETS_PER_ENVIRONMENT) {
|
|
3933
|
-
context.addIssue({
|
|
3934
|
-
code: "custom",
|
|
3935
|
-
message: "An environment defines too many secret mappings",
|
|
3936
|
-
path: ["secrets"]
|
|
3937
|
-
});
|
|
3938
|
-
}
|
|
3939
|
-
if ((environment.policies === void 0 ? 0 : Object.keys(environment.policies).length) > MAX_PERMISSIONS_PER_AGENT) {
|
|
3940
|
-
context.addIssue({
|
|
3941
|
-
code: "custom",
|
|
3942
|
-
message: "An environment defines too many policies",
|
|
3943
|
-
path: ["policies"]
|
|
3944
|
-
});
|
|
3945
|
-
}
|
|
3946
|
-
});
|
|
3947
|
-
var projectAgentSchema = external_exports.object({
|
|
3948
|
-
permissions: external_exports.record(opaqueIdentifierSchema, permissionEntrySchema)
|
|
3949
|
-
}).strict().superRefine((agent, context) => {
|
|
3950
|
-
if (Object.keys(agent.permissions).length < 1) {
|
|
3951
|
-
context.addIssue({
|
|
3952
|
-
code: "custom",
|
|
3953
|
-
message: "An agent requires at least one permission entry",
|
|
3954
|
-
path: ["permissions"]
|
|
3955
|
-
});
|
|
3956
|
-
}
|
|
3957
|
-
if (Object.keys(agent.permissions).length > MAX_PERMISSIONS_PER_AGENT) {
|
|
3958
|
-
context.addIssue({
|
|
3959
|
-
code: "custom",
|
|
3960
|
-
message: "An agent defines too many permission entries",
|
|
3961
|
-
path: ["permissions"]
|
|
3962
|
-
});
|
|
3963
|
-
}
|
|
3964
|
-
});
|
|
3965
|
-
var projectConfigDocumentSchema = external_exports.object({
|
|
3966
|
-
version: external_exports.literal(1),
|
|
3967
|
-
project: slugSchema.optional(),
|
|
3968
|
-
environments: external_exports.record(environmentNameSchema, projectEnvironmentSchema).optional(),
|
|
3969
|
-
policies: external_exports.record(opaqueIdentifierSchema, permissionEntrySchema).optional(),
|
|
3970
|
-
agents: external_exports.record(opaqueIdentifierSchema, projectAgentSchema).optional()
|
|
3971
|
-
}).strict().superRefine((document, context) => {
|
|
3972
|
-
if ((document.environments === void 0 ? 0 : Object.keys(document.environments).length) > MAX_PROJECT_ENVIRONMENTS) {
|
|
3973
|
-
context.addIssue({
|
|
3974
|
-
code: "custom",
|
|
3975
|
-
message: "The project file defines too many environments",
|
|
3976
|
-
path: ["environments"]
|
|
3977
|
-
});
|
|
3978
|
-
}
|
|
3979
|
-
if ((document.agents === void 0 ? 0 : Object.keys(document.agents).length) > MAX_PROJECT_AGENTS) {
|
|
3980
|
-
context.addIssue({
|
|
3981
|
-
code: "custom",
|
|
3982
|
-
message: "The project file defines too many agents",
|
|
3983
|
-
path: ["agents"]
|
|
3984
|
-
});
|
|
3985
|
-
}
|
|
3986
|
-
const policyCount = (document.policies === void 0 ? 0 : Object.keys(document.policies).length) + Object.values(document.environments ?? {}).reduce((total, environment) => total + (environment.policies === void 0 ? 0 : Object.keys(environment.policies).length), 0);
|
|
3987
|
-
if (policyCount > MAX_PROJECT_POLICIES) {
|
|
3988
|
-
context.addIssue({
|
|
3989
|
-
code: "custom",
|
|
3990
|
-
message: "The project file defines too many policies",
|
|
3991
|
-
path: ["policies"]
|
|
3992
|
-
});
|
|
3993
|
-
}
|
|
3994
|
-
});
|
|
3995
|
-
var grantActorSchema = external_exports.enum(["user", "agent"]);
|
|
3996
|
-
var grantRecordSchema = external_exports.object({
|
|
3997
|
-
grantId: grantIdSchema,
|
|
3998
|
-
secret: credentialReferenceSchema,
|
|
3999
|
-
actor: grantActorSchema,
|
|
4000
|
-
commands: external_exports.array(commandNameSchema).min(1).max(MAX_COMMANDS_PER_ENTRY),
|
|
4001
|
-
hashes: external_exports.record(commandNameSchema, sha256HexDigestSchema).optional(),
|
|
4002
|
-
env: environmentVariableNameSchema.optional(),
|
|
4003
|
-
createdByPolicyId: opaqueIdentifierSchema.optional(),
|
|
4004
|
-
agentPermissionKey: opaqueIdentifierSchema.optional(),
|
|
4005
|
-
createdAt: timestampSchema,
|
|
4006
|
-
expiresAt: timestampSchema.optional(),
|
|
4007
|
-
maxUses: positiveMaxUsesSchema.optional(),
|
|
4008
|
-
usedCount: external_exports.number().int().nonnegative(),
|
|
4009
|
-
lastUsedAt: timestampSchema.optional(),
|
|
4010
|
-
revokedAt: timestampSchema.optional()
|
|
4011
|
-
}).strict().superRefine((grant, context) => {
|
|
4012
|
-
if (grant.maxUses !== void 0 && grant.usedCount > grant.maxUses) {
|
|
4013
|
-
context.addIssue({
|
|
4014
|
-
code: "custom",
|
|
4015
|
-
message: "A grant cannot record more uses than its maximum",
|
|
4016
|
-
path: ["usedCount"]
|
|
4017
|
-
});
|
|
4018
|
-
}
|
|
4019
|
-
if (grant.expiresAt !== void 0 && grant.expiresAt <= grant.createdAt) {
|
|
4020
|
-
context.addIssue({
|
|
4021
|
-
code: "custom",
|
|
4022
|
-
message: "A grant must expire after it was created",
|
|
4023
|
-
path: ["expiresAt"]
|
|
4024
|
-
});
|
|
4025
|
-
}
|
|
4026
|
-
if (grant.revokedAt !== void 0 && grant.revokedAt < grant.createdAt) {
|
|
4027
|
-
context.addIssue({
|
|
4028
|
-
code: "custom",
|
|
4029
|
-
message: "A grant cannot be revoked before it was created",
|
|
4030
|
-
path: ["revokedAt"]
|
|
4031
|
-
});
|
|
4032
|
-
}
|
|
4033
|
-
if (grant.hashes === void 0)
|
|
4034
|
-
return;
|
|
4035
|
-
const commands = new Set(grant.commands);
|
|
4036
|
-
for (const pinned of Object.keys(grant.hashes)) {
|
|
4037
|
-
if (!commands.has(pinned)) {
|
|
4038
|
-
context.addIssue({
|
|
4039
|
-
code: "custom",
|
|
4040
|
-
message: "Executable pins must reference granted commands",
|
|
4041
|
-
path: ["hashes"]
|
|
4042
|
-
});
|
|
4043
|
-
return;
|
|
4044
|
-
}
|
|
4045
|
-
}
|
|
4046
|
-
});
|
|
4047
|
-
var storedPolicyRecordSchema = external_exports.object({
|
|
4048
|
-
definition: permissionEntrySchema,
|
|
4049
|
-
createdAt: timestampSchema
|
|
4050
|
-
}).strict();
|
|
4051
|
-
var ALLOW_DECISION_REASONS = Object.freeze([
|
|
4052
|
-
"no-applicable-policy",
|
|
4053
|
-
"policy-allowed",
|
|
4054
|
-
"grant-allowed"
|
|
4055
|
-
]);
|
|
4056
|
-
var CONFIRM_DECISION_REASONS = Object.freeze([
|
|
4057
|
-
"confirmation-required"
|
|
4058
|
-
]);
|
|
4059
|
-
var DENY_DECISION_REASONS = Object.freeze([
|
|
4060
|
-
"policy-denied",
|
|
4061
|
-
"command-not-allowed",
|
|
4062
|
-
"hash-mismatch",
|
|
4063
|
-
"expired",
|
|
4064
|
-
"exhausted",
|
|
4065
|
-
"revoked",
|
|
4066
|
-
"reveal-forbidden-by-policy",
|
|
4067
|
-
"confirmation-declined",
|
|
4068
|
-
"confirmation-unavailable",
|
|
4069
|
-
"executable-unresolved",
|
|
4070
|
-
"executable-refused",
|
|
4071
|
-
"clock-invalid",
|
|
4072
|
-
"state-corrupt",
|
|
4073
|
-
"no-injection-mapping",
|
|
4074
|
-
"working-directory-mismatch",
|
|
4075
|
-
"invalid-request"
|
|
4076
|
-
]);
|
|
4077
|
-
var authorizationReasonSchema = external_exports.enum([
|
|
4078
|
-
...ALLOW_DECISION_REASONS,
|
|
4079
|
-
...CONFIRM_DECISION_REASONS,
|
|
4080
|
-
...DENY_DECISION_REASONS
|
|
4081
|
-
]);
|
|
4082
|
-
var authorizationDecisionSchema = external_exports.discriminatedUnion("outcome", [
|
|
4083
|
-
external_exports.object({
|
|
4084
|
-
outcome: external_exports.literal("allow"),
|
|
4085
|
-
reason: external_exports.enum(ALLOW_DECISION_REASONS),
|
|
4086
|
-
policyId: opaqueIdentifierSchema.optional(),
|
|
4087
|
-
grantId: opaqueIdentifierSchema.optional(),
|
|
4088
|
-
secret: credentialReferenceSchema.optional()
|
|
4089
|
-
}).strict(),
|
|
4090
|
-
external_exports.object({
|
|
4091
|
-
outcome: external_exports.literal("confirm"),
|
|
4092
|
-
reason: external_exports.enum(CONFIRM_DECISION_REASONS),
|
|
4093
|
-
policyId: opaqueIdentifierSchema.optional(),
|
|
4094
|
-
secret: credentialReferenceSchema.optional()
|
|
4095
|
-
}).strict(),
|
|
4096
|
-
external_exports.object({
|
|
4097
|
-
outcome: external_exports.literal("deny"),
|
|
4098
|
-
reason: external_exports.enum(DENY_DECISION_REASONS),
|
|
4099
|
-
policyId: opaqueIdentifierSchema.optional(),
|
|
4100
|
-
grantId: opaqueIdentifierSchema.optional(),
|
|
4101
|
-
secret: credentialReferenceSchema.optional()
|
|
4102
|
-
}).strict()
|
|
4103
|
-
]);
|
|
4104
|
-
var runtimeAuditActorSchema = external_exports.enum(["user", "agent"]);
|
|
4105
|
-
var runtimeAuditActionSchema = external_exports.enum([
|
|
4106
|
-
"unlock",
|
|
4107
|
-
"policy-created",
|
|
4108
|
-
"policy-updated",
|
|
4109
|
-
"policy-removed",
|
|
4110
|
-
"grant-created",
|
|
4111
|
-
"grant-revoked",
|
|
4112
|
-
"grant-expired",
|
|
4113
|
-
"grant-exhausted",
|
|
4114
|
-
"authorization-allowed",
|
|
4115
|
-
"authorization-denied",
|
|
4116
|
-
"reveal-attempted",
|
|
4117
|
-
"reveal-denied",
|
|
4118
|
-
"confirmation-requested",
|
|
4119
|
-
"confirmation-granted",
|
|
4120
|
-
"confirmation-declined",
|
|
4121
|
-
"execution-completed"
|
|
4122
|
-
]);
|
|
4123
|
-
var sanitizedPreviewTextSchema = external_exports.string().min(1).max(MAX_ARGV_PREVIEW_CHARS).refine((value) => !/[\u0000-\u001f\u007f]/u.test(value), {
|
|
4124
|
-
message: "Audit preview text must not contain control characters"
|
|
4125
|
-
});
|
|
4126
|
-
var runtimeAuditEventSchema = external_exports.object({
|
|
4127
|
-
seq: external_exports.number().int().positive(),
|
|
4128
|
-
occurredAt: timestampSchema,
|
|
4129
|
-
actor: runtimeAuditActorSchema,
|
|
4130
|
-
action: runtimeAuditActionSchema,
|
|
4131
|
-
policyId: opaqueIdentifierSchema.optional(),
|
|
4132
|
-
grantId: opaqueIdentifierSchema.optional(),
|
|
4133
|
-
permissionKey: opaqueIdentifierSchema.optional(),
|
|
4134
|
-
secret: credentialReferenceSchema.optional(),
|
|
4135
|
-
command: commandNameSchema.optional(),
|
|
4136
|
-
argvPreview: external_exports.array(sanitizedPreviewTextSchema).max(MAX_ARGV_PREVIEW_ENTRIES).optional(),
|
|
4137
|
-
exitCode: external_exports.number().int().min(-2147483648).max(2147483647).optional(),
|
|
4138
|
-
reason: authorizationReasonSchema.optional()
|
|
4139
|
-
}).strict();
|
|
4140
|
-
var authorizationScopeKindSchema = external_exports.enum(["database", "vault"]);
|
|
4141
|
-
var authorizationStateDomainSchema = external_exports.literal("kavrix/authorization-state/v1");
|
|
4142
|
-
var authorizationEnvelopeContextSchema = external_exports.object({
|
|
4143
|
-
domain: authorizationStateDomainSchema,
|
|
4144
|
-
scopeKind: authorizationScopeKindSchema,
|
|
4145
|
-
scopeId: opaqueIdentifierSchema,
|
|
4146
|
-
sequence: external_exports.number().int().nonnegative()
|
|
4147
|
-
}).strict();
|
|
4148
|
-
var authorizationStateDocumentSchema = external_exports.object({
|
|
4149
|
-
version: external_exports.literal(1),
|
|
4150
|
-
policies: external_exports.record(opaqueIdentifierSchema, storedPolicyRecordSchema),
|
|
4151
|
-
grants: external_exports.record(grantIdSchema, grantRecordSchema),
|
|
4152
|
-
audit: external_exports.array(runtimeAuditEventSchema).max(MAX_RUNTIME_AUDIT_EVENTS)
|
|
4153
|
-
}).strict().superRefine((state, context) => {
|
|
4154
|
-
if (Object.keys(state.policies).length > MAX_STORED_POLICIES) {
|
|
4155
|
-
context.addIssue({
|
|
4156
|
-
code: "custom",
|
|
4157
|
-
message: "The authorization state holds too many policies",
|
|
4158
|
-
path: ["policies"]
|
|
4159
|
-
});
|
|
4160
|
-
}
|
|
4161
|
-
if (Object.keys(state.grants).length > MAX_STORED_GRANTS) {
|
|
4162
|
-
context.addIssue({
|
|
4163
|
-
code: "custom",
|
|
4164
|
-
message: "The authorization state holds too many grants",
|
|
4165
|
-
path: ["grants"]
|
|
4166
|
-
});
|
|
4167
|
-
}
|
|
4168
|
-
});
|
|
4169
|
-
var authorizationStateFormatSchema = external_exports.literal("kavrix-authorization-state");
|
|
4170
|
-
var authorizationStateEnvelopeSchema = external_exports.object({
|
|
4171
|
-
format: authorizationStateFormatSchema,
|
|
4172
|
-
version: external_exports.literal(1),
|
|
4173
|
-
scopeKind: authorizationScopeKindSchema,
|
|
4174
|
-
scopeId: opaqueIdentifierSchema,
|
|
4175
|
-
sequence: external_exports.number().int().nonnegative(),
|
|
4176
|
-
createdAt: timestampSchema,
|
|
4177
|
-
updatedAt: timestampSchema,
|
|
4178
|
-
nonce: base64UrlSchema.length(AEAD_NONCE_BASE64URL_CHARS),
|
|
4179
|
-
ciphertext: base64UrlSchema,
|
|
4180
|
-
authenticationTag: base64UrlSchema.length(AEAD_AUTHENTICATION_TAG_BASE64URL_CHARS)
|
|
4181
|
-
}).strict();
|
|
4182
|
-
var BASE64_CHUNK_PATTERN = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/u;
|
|
4183
|
-
var MAX_BROKER_ARGV_ENTRIES = 128;
|
|
4184
|
-
var MAX_BROKER_ARG_CHARS = 8192;
|
|
4185
|
-
var MAX_BROKER_FRAME_BYTES = 2 * 1024 * 1024;
|
|
4186
|
-
var agentBrokerRequestSchema = external_exports.object({
|
|
4187
|
-
v: external_exports.literal(1),
|
|
4188
|
-
token: external_exports.string().min(32).max(256),
|
|
4189
|
-
op: external_exports.literal("exec"),
|
|
4190
|
-
permission: opaqueIdentifierSchema,
|
|
4191
|
-
argv: external_exports.array(external_exports.string().min(1).max(MAX_BROKER_ARG_CHARS)).min(1).max(MAX_BROKER_ARGV_ENTRIES)
|
|
4192
|
-
}).strict();
|
|
4193
|
-
var agentBrokerDecisionFrameSchema = external_exports.object({
|
|
4194
|
-
v: external_exports.literal(1),
|
|
4195
|
-
event: external_exports.literal("decision"),
|
|
4196
|
-
outcome: external_exports.enum(["allow", "deny"]),
|
|
4197
|
-
reason: authorizationReasonSchema
|
|
4198
|
-
}).strict();
|
|
4199
|
-
var agentBrokerOutputFrameSchema = external_exports.object({
|
|
4200
|
-
v: external_exports.literal(1),
|
|
4201
|
-
event: external_exports.enum(["stdout", "stderr"]),
|
|
4202
|
-
data: external_exports.string().regex(BASE64_CHUNK_PATTERN, "Frames carry standard base64")
|
|
4203
|
-
}).strict();
|
|
4204
|
-
var agentBrokerExitFrameSchema = external_exports.object({
|
|
4205
|
-
v: external_exports.literal(1),
|
|
4206
|
-
event: external_exports.literal("exit"),
|
|
4207
|
-
exitCode: external_exports.number().int().min(-2147483648).max(2147483647).nullable(),
|
|
4208
|
-
signal: external_exports.string().min(1).max(32).nullable()
|
|
4209
|
-
}).strict();
|
|
4210
|
-
var agentBrokerServerFrameSchema = external_exports.discriminatedUnion("event", [
|
|
4211
|
-
agentBrokerDecisionFrameSchema,
|
|
4212
|
-
agentBrokerOutputFrameSchema,
|
|
4213
|
-
agentBrokerExitFrameSchema
|
|
4214
|
-
]);
|
|
4215
|
-
var agentBrokerClientFrameSchema = external_exports.discriminatedUnion("event", [
|
|
4216
|
-
external_exports.object({
|
|
4217
|
-
v: external_exports.literal(1),
|
|
4218
|
-
event: external_exports.literal("stdin"),
|
|
4219
|
-
data: external_exports.string().regex(BASE64_CHUNK_PATTERN)
|
|
4220
|
-
}).strict(),
|
|
4221
|
-
external_exports.object({ v: external_exports.literal(1), event: external_exports.literal("close-stdin") }).strict()
|
|
4222
|
-
]);
|
|
4223
|
-
|
|
4224
|
-
// ../../packages/schemas/dist/rotation.js
|
|
4225
|
-
var portableKeyRotationStateSchema = external_exports.enum([
|
|
4226
|
-
"prepared",
|
|
4227
|
-
"pending-published",
|
|
4228
|
-
"active-published",
|
|
4229
|
-
"completed"
|
|
4230
|
-
]);
|
|
4231
|
-
var rotationOperationIdSchema = external_exports.string().min(16).max(128).regex(/^[A-Za-z0-9][A-Za-z0-9._~-]*$/u);
|
|
4232
|
-
var portableKeyRotationCheckpointPayloadSchema = external_exports.object({
|
|
4233
|
-
version: external_exports.literal(1),
|
|
4234
|
-
vaultId: vaultIdSchema,
|
|
4235
|
-
operationId: rotationOperationIdSchema,
|
|
4236
|
-
sourceSlotId: keySlotIdSchema,
|
|
4237
|
-
replacementSlotId: keySlotIdSchema,
|
|
4238
|
-
sourceRevision: vaultRevisionSchema,
|
|
4239
|
-
remoteRevision: vaultRevisionSchema,
|
|
4240
|
-
sourceSlotDigest: sha256DigestSchema,
|
|
4241
|
-
replacementSlotDigest: sha256DigestSchema,
|
|
4242
|
-
transcriptDigest: sha256DigestSchema,
|
|
4243
|
-
state: portableKeyRotationStateSchema
|
|
4244
|
-
}).strict().superRefine((payload, context) => {
|
|
4245
|
-
if (payload.sourceSlotId === payload.replacementSlotId) {
|
|
4246
|
-
context.addIssue({
|
|
4247
|
-
code: "custom",
|
|
4248
|
-
path: ["replacementSlotId"],
|
|
4249
|
-
message: "A rotation must use distinct source and replacement slots"
|
|
4250
|
-
});
|
|
4251
|
-
}
|
|
4252
|
-
const offset = {
|
|
4253
|
-
prepared: 0,
|
|
4254
|
-
"pending-published": 1,
|
|
4255
|
-
"active-published": 2,
|
|
4256
|
-
completed: 3
|
|
4257
|
-
}[payload.state];
|
|
4258
|
-
if (payload.sourceRevision + offset !== payload.remoteRevision) {
|
|
4259
|
-
context.addIssue({
|
|
4260
|
-
code: "custom",
|
|
4261
|
-
path: ["remoteRevision"],
|
|
4262
|
-
message: "The checkpoint revision does not match its lifecycle state"
|
|
4263
|
-
});
|
|
4264
|
-
}
|
|
4265
|
-
});
|
|
4266
|
-
var portableKeyRotationCheckpointSchema = external_exports.object({
|
|
4267
|
-
payload: portableKeyRotationCheckpointPayloadSchema,
|
|
4268
|
-
authenticationTag: sha256DigestSchema
|
|
4269
|
-
}).strict();
|
|
4270
|
-
var portableKeyRotationSourceKindSchema = external_exports.enum([
|
|
4271
|
-
"generated-file",
|
|
4272
|
-
"imported-file"
|
|
4273
|
-
]);
|
|
4274
|
-
var portableSlotSchema = keySlotSchema.refine((slot) => slot.type === "portable-key", {
|
|
4275
|
-
error: "Portable-key rotation requires portable-key slots"
|
|
4276
|
-
});
|
|
4277
|
-
var portableKeyRotationJournalRecordSchema = external_exports.object({
|
|
4278
|
-
version: external_exports.literal(1),
|
|
4279
|
-
kind: external_exports.literal("portable-key-rotation"),
|
|
4280
|
-
operationId: rotationOperationIdSchema,
|
|
4281
|
-
vaultId: vaultIdSchema,
|
|
4282
|
-
deviceId: deviceIdSchema,
|
|
4283
|
-
state: portableKeyRotationStateSchema,
|
|
4284
|
-
sourceKind: portableKeyRotationSourceKindSchema,
|
|
4285
|
-
sourceSlot: portableSlotSchema,
|
|
4286
|
-
replacementSlot: portableSlotSchema,
|
|
4287
|
-
sourceRevision: vaultRevisionSchema,
|
|
4288
|
-
createdAt: timestampSchema,
|
|
4289
|
-
updatedAt: timestampSchema,
|
|
4290
|
-
checkpoint: portableKeyRotationCheckpointSchema
|
|
4291
|
-
}).strict().superRefine((record, context) => {
|
|
4292
|
-
const expectedReplacementState = record.state === "prepared" || record.state === "pending-published" ? "pending" : "active";
|
|
4293
|
-
if (record.sourceSlot.state !== "active" || record.replacementSlot.state !== expectedReplacementState || record.sourceSlot.id === record.replacementSlot.id || record.sourceSlot.keyVersion !== record.replacementSlot.keyVersion || record.sourceRevision !== record.checkpoint.payload.sourceRevision || record.checkpoint.payload.vaultId !== record.vaultId || record.checkpoint.payload.operationId !== record.operationId || record.checkpoint.payload.sourceSlotId !== record.sourceSlot.id || record.checkpoint.payload.replacementSlotId !== record.replacementSlot.id || record.checkpoint.payload.state !== record.state) {
|
|
4294
|
-
context.addIssue({
|
|
4295
|
-
code: "custom",
|
|
4296
|
-
path: ["checkpoint"],
|
|
4297
|
-
message: "The rotation journal record and checkpoint must agree"
|
|
4298
|
-
});
|
|
4299
|
-
}
|
|
4300
|
-
});
|
|
4301
|
-
var PORTABLE_KEY_ROTATION_JOURNAL_MAX_SERIALIZED_BYTES = 64 * 1024;
|
|
4302
|
-
|
|
4303
|
-
// ../../packages/schemas/dist/session-lifetime.js
|
|
4304
|
-
var MIN_SESSION_TIMEOUT_MS = 1e3;
|
|
4305
|
-
var MAX_SESSION_TIMEOUT_MS = 864e5;
|
|
4306
|
-
var DEFAULT_INVOCATION_TIMEOUT_MS = 9e5;
|
|
4307
|
-
var DEFAULT_IDLE_TIMEOUT_MS = 12e4;
|
|
4308
|
-
var DEFAULT_REAUTHENTICATION_WINDOW_MS = 12e4;
|
|
4309
|
-
var sessionExpiryReasonSchema = external_exports.enum([
|
|
4310
|
-
/** The whole invocation reached its wall-clock limit. */
|
|
4311
|
-
"invocation-timeout",
|
|
4312
|
-
/** No activity was recorded within the inactivity limit. */
|
|
4313
|
-
"idle-timeout",
|
|
4314
|
-
/** The operator interrupted the invocation (SIGINT). */
|
|
4315
|
-
"interrupted",
|
|
4316
|
-
/** The supervisor asked the process to stop (SIGTERM). */
|
|
4317
|
-
"terminated",
|
|
4318
|
-
/** The controlling terminal went away (SIGHUP). */
|
|
4319
|
-
"hangup",
|
|
4320
|
-
/** The monotonic clock moved backward, so deadlines are unenforceable. */
|
|
4321
|
-
"clock-regression"
|
|
4322
|
-
]);
|
|
4323
|
-
var sessionLifetimePolicySchema = external_exports.object({
|
|
4324
|
-
invocationTimeoutMs: external_exports.number().int().min(MIN_SESSION_TIMEOUT_MS).max(MAX_SESSION_TIMEOUT_MS),
|
|
4325
|
-
idleTimeoutMs: external_exports.number().int().min(MIN_SESSION_TIMEOUT_MS).max(MAX_SESSION_TIMEOUT_MS),
|
|
4326
|
-
reauthenticationWindowMs: external_exports.number().int().min(MIN_SESSION_TIMEOUT_MS).max(MAX_SESSION_TIMEOUT_MS)
|
|
4327
|
-
}).strict().superRefine((policy, context) => {
|
|
4328
|
-
if (policy.idleTimeoutMs > policy.invocationTimeoutMs) {
|
|
4329
|
-
context.addIssue({
|
|
4330
|
-
code: "custom",
|
|
4331
|
-
message: "An inactivity limit cannot exceed the invocation limit",
|
|
4332
|
-
path: ["idleTimeoutMs"]
|
|
4333
|
-
});
|
|
4334
|
-
}
|
|
4335
|
-
if (policy.reauthenticationWindowMs > policy.invocationTimeoutMs) {
|
|
4336
|
-
context.addIssue({
|
|
4337
|
-
code: "custom",
|
|
4338
|
-
message: "A reauthentication window cannot exceed the invocation limit",
|
|
4339
|
-
path: ["reauthenticationWindowMs"]
|
|
4340
|
-
});
|
|
4341
|
-
}
|
|
4342
|
-
});
|
|
4343
|
-
var DEFAULT_SESSION_LIFETIME_POLICY = Object.freeze({
|
|
4344
|
-
invocationTimeoutMs: DEFAULT_INVOCATION_TIMEOUT_MS,
|
|
4345
|
-
idleTimeoutMs: DEFAULT_IDLE_TIMEOUT_MS,
|
|
4346
|
-
reauthenticationWindowMs: DEFAULT_REAUTHENTICATION_WINDOW_MS
|
|
4347
|
-
});
|
|
4348
|
-
|
|
4349
|
-
// ../../packages/schemas/dist/transfer.js
|
|
4350
|
-
var DEFAULT_MAX_TRANSFER_DOCUMENTS = 2e4;
|
|
4351
|
-
var MAX_SUPPORTED_TRANSFER_BYTES = 512 * 1024 * 1024;
|
|
4352
|
-
var canonical32ByteValueSchema2 = base64UrlSchema.length(43).refine((value) => Buffer.from(value, "base64url").byteLength === 32, {
|
|
4353
|
-
error: "Value must canonically encode exactly 32 bytes"
|
|
4354
|
-
});
|
|
4355
|
-
var transferKeySaltSchema = canonical32ByteValueSchema2.brand();
|
|
4356
|
-
var transferAuthenticationTagSchema = canonical32ByteValueSchema2.brand();
|
|
4357
|
-
var transferProtectionSchema = external_exports.object({
|
|
4358
|
-
algorithm: external_exports.literal("argon2id+hkdf-sha256+xchacha20-poly1305-ietf"),
|
|
4359
|
-
derivation: passphraseDerivationSchema,
|
|
4360
|
-
expansionSalt: transferKeySaltSchema
|
|
4361
|
-
}).strict();
|
|
4362
|
-
var encryptedTransferHeaderSchema = external_exports.object({
|
|
4363
|
-
type: external_exports.literal("header"),
|
|
4364
|
-
format: external_exports.literal("kavrix-encrypted-transfer"),
|
|
4365
|
-
version: external_exports.literal(1),
|
|
4366
|
-
vaultId: vaultIdSchema,
|
|
4367
|
-
schemaVersion: supportedSchemaVersionSchema,
|
|
4368
|
-
createdAt: timestampSchema,
|
|
4369
|
-
protection: transferProtectionSchema
|
|
4370
|
-
}).strict();
|
|
4371
|
-
var transferWithholdingReasonSchema = external_exports.enum([
|
|
4372
|
-
/** The field definition sets `exportPolicy: 'never'`. */
|
|
4373
|
-
"export-policy",
|
|
4374
|
-
/** The value points at attachment content, which this format does not carry. */
|
|
4375
|
-
"attachment-unsupported",
|
|
4376
|
-
/** The value points at an item outside the exported set. */
|
|
4377
|
-
"unresolved-reference"
|
|
4378
|
-
]);
|
|
4379
|
-
var transferWithholdingSchema = external_exports.object({
|
|
4380
|
-
stableKey: stableFieldKeySchema,
|
|
4381
|
-
scope: external_exports.enum(["template", "item"]),
|
|
4382
|
-
reason: transferWithholdingReasonSchema
|
|
4383
|
-
}).strict();
|
|
4384
|
-
var transferWithholdingsSchema = external_exports.array(transferWithholdingSchema).max(2e3).superRefine((withholdings, context) => {
|
|
4385
|
-
const seen = /* @__PURE__ */ new Set();
|
|
4386
|
-
for (const [index, withheld] of withholdings.entries()) {
|
|
4387
|
-
const key = `${withheld.scope}:${withheld.stableKey}`;
|
|
4388
|
-
if (seen.has(key)) {
|
|
4389
|
-
context.addIssue({
|
|
4390
|
-
code: "custom",
|
|
4391
|
-
message: "A withholding manifest cannot name the same field twice",
|
|
4392
|
-
path: [index, "stableKey"]
|
|
4393
|
-
});
|
|
4394
|
-
}
|
|
4395
|
-
seen.add(key);
|
|
4396
|
-
}
|
|
4397
|
-
});
|
|
4398
|
-
var encryptedTransferEntrySchema = external_exports.discriminatedUnion("kind", [
|
|
4399
|
-
external_exports.object({
|
|
4400
|
-
kind: external_exports.literal("group"),
|
|
4401
|
-
groupId: groupIdSchema,
|
|
4402
|
-
envelope: aeadEnvelopeSchema
|
|
4403
|
-
}).strict(),
|
|
4404
|
-
external_exports.object({
|
|
4405
|
-
kind: external_exports.literal("item"),
|
|
4406
|
-
groupId: groupIdSchema,
|
|
4407
|
-
itemId: itemIdSchema,
|
|
4408
|
-
envelope: aeadEnvelopeSchema,
|
|
4409
|
-
withheld: transferWithholdingsSchema
|
|
4410
|
-
}).strict()
|
|
4411
|
-
]);
|
|
4412
|
-
var encryptedTransferFooterSchema = external_exports.object({
|
|
4413
|
-
type: external_exports.literal("footer"),
|
|
4414
|
-
version: external_exports.literal(1),
|
|
4415
|
-
groupCount: external_exports.number().int().nonnegative().max(DEFAULT_MAX_TRANSFER_DOCUMENTS),
|
|
4416
|
-
itemCount: external_exports.number().int().nonnegative().max(DEFAULT_MAX_TRANSFER_DOCUMENTS),
|
|
4417
|
-
transcriptSha256: canonical32ByteValueSchema2,
|
|
4418
|
-
authenticationTag: transferAuthenticationTagSchema
|
|
4419
|
-
}).strict();
|
|
4420
|
-
var transferLimitsSchema = external_exports.object({
|
|
4421
|
-
maximumBytes: external_exports.number().int().positive().max(MAX_SUPPORTED_TRANSFER_BYTES),
|
|
4422
|
-
maximumDocuments: external_exports.number().int().positive().max(DEFAULT_MAX_TRANSFER_DOCUMENTS)
|
|
4423
|
-
}).strict();
|
|
4424
|
-
var transferCollisionStrategySchema = external_exports.enum(["fail", "skip", "rename"]);
|
|
4425
|
-
var transferImportSummarySchema = external_exports.object({
|
|
4426
|
-
vaultId: vaultIdSchema,
|
|
4427
|
-
createdAt: timestampSchema,
|
|
4428
|
-
groupsCreated: external_exports.number().int().nonnegative(),
|
|
4429
|
-
groupsSkipped: external_exports.number().int().nonnegative(),
|
|
4430
|
-
itemsCreated: external_exports.number().int().nonnegative(),
|
|
4431
|
-
withheldValues: external_exports.number().int().nonnegative()
|
|
4432
|
-
}).strict();
|
|
4433
|
-
|
|
4434
|
-
export {
|
|
4435
|
-
vaultIdSchema,
|
|
4436
|
-
databaseIdSchema,
|
|
4437
|
-
profileIdSchema,
|
|
4438
|
-
keySlotIdSchema,
|
|
4439
|
-
itemIdSchema,
|
|
4440
|
-
attachmentIdSchema,
|
|
4441
|
-
policyIdSchema,
|
|
4442
|
-
grantIdSchema,
|
|
4443
|
-
MAX_CIPHERTEXT_CHARS,
|
|
4444
|
-
CURRENT_SCHEMA_VERSION,
|
|
4445
|
-
CURRENT_CRYPTOGRAPHIC_VERSION,
|
|
4446
|
-
timestampSchema,
|
|
4447
|
-
keyVersionSchema,
|
|
4448
|
-
supportedSchemaVersionSchema,
|
|
4449
|
-
supportedCryptographicVersionSchema,
|
|
4450
|
-
vaultRevisionSchema,
|
|
4451
|
-
secretValueSchema,
|
|
4452
|
-
sha256DigestSchema,
|
|
4453
|
-
associatedDataSchema,
|
|
4454
|
-
aeadEnvelopeSchema,
|
|
4455
|
-
portableKeyDerivationSchema,
|
|
4456
|
-
passphraseDerivationSchema,
|
|
4457
|
-
recoveryKeyDerivationSchema,
|
|
4458
|
-
keySlotSchema,
|
|
4459
|
-
canonicalJson,
|
|
4460
|
-
CLI_EXIT_CODES,
|
|
4461
|
-
cliErrorCodeSchema,
|
|
4462
|
-
exitCodeForCliError,
|
|
4463
|
-
MAX_DATABASE_VAULTS,
|
|
4464
|
-
databaseRevisionSchema,
|
|
4465
|
-
databaseAssociatedDataSchema,
|
|
4466
|
-
databaseAeadEnvelopeSchema,
|
|
4467
|
-
databaseCatalogPayloadSchema,
|
|
4468
|
-
databasePortableKeySlotSchema,
|
|
4469
|
-
databaseRecoverySlotSchema,
|
|
4470
|
-
encryptedDatabaseDocumentSchema,
|
|
4471
|
-
databaseVaultDocumentSchema,
|
|
4472
|
-
fileDatabaseContainerSchema,
|
|
4473
|
-
fieldValueElementIdSchema,
|
|
4474
|
-
fieldScalarValueSchema,
|
|
4475
|
-
fieldValueMatchesDefinition,
|
|
4476
|
-
itemPayloadSchema,
|
|
4477
|
-
CURRENT_LOCAL_VAULT_VERSION,
|
|
4478
|
-
MAX_LOCAL_RECOVERY_SLOTS,
|
|
4479
|
-
localVaultPayloadSchema,
|
|
4480
|
-
localVaultDocumentSchema,
|
|
4481
|
-
MAX_AUTHORIZATION_STATE_BYTES,
|
|
4482
|
-
environmentVariableNameSchema,
|
|
4483
|
-
parseDurationToMs,
|
|
4484
|
-
permissionEntrySchema,
|
|
4485
|
-
normalizeProjectConfigAliases,
|
|
4486
|
-
projectConfigDocumentSchema,
|
|
4487
|
-
grantRecordSchema,
|
|
4488
|
-
authorizationReasonSchema,
|
|
4489
|
-
authorizationDecisionSchema,
|
|
4490
|
-
runtimeAuditEventSchema,
|
|
4491
|
-
authorizationStateDomainSchema,
|
|
4492
|
-
authorizationEnvelopeContextSchema,
|
|
4493
|
-
authorizationStateDocumentSchema,
|
|
4494
|
-
authorizationStateEnvelopeSchema,
|
|
4495
|
-
agentBrokerRequestSchema,
|
|
4496
|
-
agentBrokerServerFrameSchema,
|
|
4497
|
-
agentBrokerClientFrameSchema
|
|
4498
|
-
};
|
|
4499
|
-
//# sourceMappingURL=data:application/json;base64,ewogICJ2ZXJzaW9uIjogMywKICAic291cmNlcyI6IFsiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvaWRlbnRpZmllcnMudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvcHJpbWl0aXZlcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9lbmNyeXB0ZWQtcmVjb3Jkcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9jb250ZW50LWhhc2gudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvZmllbGRzLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL25vdGVzLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3RlbXBsYXRlcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9wYXlsb2Fkcy50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9sb2NhbC12YXVsdC50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9hdXRob3JpemF0aW9uLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3N5bmMudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvYXBpLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL2F1ZGl0LnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL2JhY2t1cC50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9jbGktY29udHJhY3QudHMiLCAiLi4vLi4vLi4vLi4vcGFja2FnZXMvc2NoZW1hcy9zcmMvZGF0YWJhc2UtY29udGFpbmVyLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL2tleWNoYWluLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3BvbGljeS50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9yb3RhdGlvbi50cyIsICIuLi8uLi8uLi8uLi9wYWNrYWdlcy9zY2hlbWFzL3NyYy9zZXNzaW9uLWxpZmV0aW1lLnRzIiwgIi4uLy4uLy4uLy4uL3BhY2thZ2VzL3NjaGVtYXMvc3JjL3RyYW5zZmVyLnRzIl0sCiAgIm1hcHBpbmdzIjogIjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7O0FBRU8sSUFBTSxzQkFBc0I7QUFDNUIsSUFBTSxzQkFBc0I7QUFDNUIsSUFBTSwyQkFBMkI7QUFFeEMsSUFBTSxrQkFBa0IsSUFBSSxPQUFPLHdCQUF3QjtBQUMzRCxJQUFNLFdBQVcsaUJBQ2QsT0FBTSxFQUNOLElBQUksbUJBQW1CLEVBQ3ZCLElBQUksbUJBQW1CLEVBQ3ZCLE1BQU0saUJBQWlCLDhCQUE4QjtBQUVqRCxJQUFNLGdCQUFnQixTQUFTLE1BQUs7QUFDcEMsSUFBTSxtQkFBbUIsU0FBUyxNQUFLO0FBQ3ZDLElBQU0sa0JBQWtCLFNBQVMsTUFBSztBQUN0QyxJQUFNLGtCQUFrQixTQUFTLE1BQUs7QUFDdEMsSUFBTSxnQkFBZ0IsU0FBUyxNQUFLO0FBQ3BDLElBQU0sZUFBZSxTQUFTLE1BQUs7QUFDbkMsSUFBTSxnQkFBZ0IsU0FBUyxNQUFLO0FBQ3BDLElBQU0sZUFBZSxTQUFTLE1BQUs7QUFDbkMsSUFBTSxtQkFBbUIsU0FBUyxNQUFLO0FBQ3ZDLElBQU0sNEJBQTRCLFNBQVMsTUFBSztBQUNoRCxJQUFNLGlCQUFpQixTQUFTLE1BQUs7QUFDckMsSUFBTSxpQkFBaUIsU0FBUyxNQUFLO0FBQ3JDLElBQU0scUJBQXFCLFNBQVMsTUFBSztBQUN6QyxJQUFNLHFCQUFxQixTQUFTLE1BQUs7QUFDekMsSUFBTSxrQkFBa0IsU0FBUyxNQUFLO0FBQ3RDLElBQU0saUJBQWlCLFNBQVMsTUFBSztBQUNyQyxJQUFNLGlCQUFpQixTQUFTLE1BQUs7QUFDckMsSUFBTSxnQkFBZ0IsU0FBUyxNQUFLOzs7QUM1QnBDLElBQU0saUJBQWlCO0FBQ3ZCLElBQU0sdUJBQXVCO0FBQzdCLElBQU0sdUJBQXVCO0FBQzdCLElBQU0sd0JBQXdCLE9BQU87QUFFNUMsSUFBTSxjQUFjLElBQUksWUFBVztBQUc3QixTQUFVLGVBQWUsT0FBYTtBQUMxQyxTQUFPLFlBQVksT0FBTyxLQUFLLEVBQUU7QUFDbkM7QUFHTyxJQUFNLHFCQUFxQixpQkFBRSxPQUFNLEVBQUcsWUFBWSxDQUFDLE9BQU8sWUFBVztBQUcxRSxNQUFJLE1BQU0sU0FBUyxrQkFBa0IsZUFBZSxLQUFLLElBQUksZ0JBQWdCO0FBQzNFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixRQUFRO01BQ1IsU0FBUztNQUNULFdBQVc7TUFDWCxTQUFTLHNDQUFzQyxPQUFPLGNBQWMsQ0FBQztLQUN0RTtFQUNIO0FBQ0YsQ0FBQztBQUVNLElBQU0seUJBQXlCO0FBQy9CLElBQU0sNEJBQTRCLE9BQU8sT0FBTztFQUNyRDtDQUNRO0FBQ0gsSUFBTSxnQ0FBZ0M7QUFDdEMsSUFBTSxtQ0FBbUMsT0FBTyxPQUFPO0VBQzVEO0NBQ1E7QUFDSCxJQUFNLHdCQUF3QjtBQUM5QixJQUFNLDJCQUEyQixPQUFPLE9BQU8sQ0FBQyxxQkFBcUIsQ0FBVTtBQUUvRSxJQUFNLHFDQUNYO0FBQ0ssSUFBTSw0QkFBNEI7QUFDbEMsSUFBTSxxQ0FDWDtBQUNLLElBQU0sZ0NBQWdDO0FBRTdDLElBQU0sNEJBQTRCLElBQUksT0FBTyxrQ0FBa0M7QUFDL0UsSUFBTSw0QkFBNEIsSUFBSSxPQUFPLGtDQUFrQztBQUUvRSxTQUFTLGtDQUFrQyxPQUFhO0FBQ3RELE1BQUksTUFBTSxXQUFXO0FBQUcsV0FBTztBQUMvQixRQUFNLFlBQVksTUFBTSxTQUFTO0FBQ2pDLE1BQUksY0FBYztBQUFHLFdBQU87QUFJNUIsUUFBTSxhQUFhLGNBQWMsSUFBSSxLQUFLLElBQUksTUFBTSxRQUFRLENBQUMsSUFBSTtBQUNqRSxTQUFPLDBCQUEwQixLQUFLLE1BQU0sTUFBTSxDQUFDLFVBQVUsQ0FBQztBQUNoRTtBQUVPLElBQU0sa0JBQWtCLGlCQUFFLElBQzlCLFNBQVMsRUFBRSxRQUFRLE9BQU8sV0FBVyxFQUFDLENBQUUsRUFDeEMsT0FBTyx5QkFBeUIsRUFDaEMsTUFBTSx5QkFBeUI7QUFDM0IsSUFBTSxpQkFBaUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXLEVBQUcsTUFBSztBQUMzRCxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTSxFQUNOLElBQUcsRUFDSCxTQUFRLEVBQ1IsSUFBSSxvQkFBb0IsRUFDeEIsTUFBSztBQUNSLElBQU0sd0JBQXdCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsU0FBUSxFQUFHLElBQUksb0JBQW9CO0FBQ2xGLElBQU0seUJBQXlCLGlCQUM1QixPQUFNLEVBQ04sSUFBRyxFQUNILFlBQVcsRUFDWCxJQUFJLHFCQUFxQjtBQU1yQixJQUFNLHNCQUFzQixzQkFBc0IsTUFBSztBQUN2RCxJQUFNLG1CQUFtQixzQkFBc0IsTUFBSztBQUNwRCxJQUFNLHdCQUF3QixzQkFBc0IsTUFBSztBQUV6RCxJQUFNLHFCQUFxQixzQkFBc0IsTUFBSztBQUV0RCxJQUFNLDZCQUNYLHNCQUFzQixNQUFLO0FBQ3RCLElBQU0sK0JBQStCLG9CQUFvQixPQUM5RCxDQUFDLFVBQVUsMEJBQTBCLEtBQUssQ0FBQyxjQUFjLFVBQVUsU0FBUyxHQUM1RSxFQUFFLE9BQU8sNkJBQTRCLENBQUU7QUFFbEMsSUFBTSxzQ0FBc0MsMkJBQTJCLE9BQzVFLENBQUMsVUFBVSxpQ0FBaUMsS0FBSyxDQUFDLGNBQWMsVUFBVSxTQUFTLEdBQ25GLEVBQUUsT0FBTyxvQ0FBbUMsQ0FBRTtBQUV6QyxJQUFNLDhCQUE4QixtQkFBbUIsT0FDNUQsQ0FBQyxVQUFVLHlCQUF5QixLQUFLLENBQUMsY0FBYyxVQUFVLFNBQVMsR0FDM0UsRUFBRSxPQUFPLDRCQUEyQixDQUFFO0FBRWpDLElBQU0sdUJBQXVCLHVCQUF1QixNQUFLO0FBQ3pELElBQU0sc0JBQXNCLHVCQUF1QixNQUFLO0FBQ3hELElBQU0sdUJBQXVCLHVCQUF1QixNQUFLO0FBQ3pELElBQU0sd0JBQXdCLGlCQUFFLFFBQVEsQ0FBQyxFQUFFLE1BQUs7QUFDaEQsSUFBTSw4QkFBOEIsaUJBQ3hDLFFBQVEsQ0FBQyxFQUNULE1BQUs7QUFDRCxJQUFNLHVCQUF1QixpQkFBRSxRQUFRLENBQUMsRUFBRSxNQUFLO0FBQy9DLElBQU0sa0JBQWtCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVztBQUNwRCxJQUFNLHFCQUFxQixpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztBQUMzRCxJQUFNLHNCQUFzQjtBQUM1QixJQUFNLG9CQUFvQixtQkFBbUIsTUFBSztBQUNsRCxJQUFNLG9CQUFvQixpQkFDOUIsV0FBVyxVQUFVLEVBQ3JCLE9BQU8sQ0FBQyxVQUFVLE1BQU0sYUFBYSxLQUFLLE1BQU0sY0FBYyxnQkFBZ0I7RUFDN0UsT0FBTztDQUNSLEVBQ0EsTUFBSztBQUVELElBQU0sa0JBQWtCLGlCQUM1QixPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxvQkFBb0IsRUFDeEIsTUFBTSxvQkFBb0Isc0NBQXNDLEVBQ2hFLE9BQU8sbUNBQW1DO0VBQ3pDLE9BQU87Q0FDUixFQUNBLE9BQU8sQ0FBQyxVQUFVLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRSxTQUFTLFdBQVcsTUFBTSxPQUFPO0VBQ2xGLE9BQU87Q0FDUjtBQUVJLElBQU0scUJBQXFCLGdCQUMvQixPQUFPLDZCQUE2QixFQUNwQyxPQUFPLENBQUMsVUFBVSxPQUFPLEtBQUssT0FBTyxXQUFXLEVBQUUsZUFBZSxJQUFJO0VBQ3BFLE9BQU87Q0FDUixFQUNBLE1BQUs7QUFFRCxJQUFNLGFBQWEsaUJBQ3ZCLE9BQU0sRUFDTixLQUFJLEVBQ0osSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFBTSwrQ0FBK0MsY0FBYzs7O0FDdEgvRCxJQUFNLDRCQUE0QixpQkFBRSxLQUFLO0VBQzlDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRU0sSUFBTSxnQ0FBZ0MsaUJBQUUsS0FBSztFQUNsRDtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQUVNLElBQU0sNkJBQTZCO0FBQ25DLElBQU0sMENBQTBDO0FBRXZELElBQU0sMkJBQTJCLGlCQUM5QixPQUFPO0VBQ04sU0FBUztFQUNULGVBQWU7RUFDZixZQUFZO0VBQ1osU0FBUztFQUNULFVBQVUsb0JBQW9CLFNBQVE7RUFDdEMsZ0JBQWdCLG1CQUFtQixTQUFRO0NBQzVDLEVBQ0EsT0FBTTtBQUVULElBQU0sd0JBQXdCO0VBQzVCLFNBQVMsaUJBQUUsVUFBUyxFQUFHLFNBQVE7RUFDL0IsVUFBVSxpQkFBRSxVQUFTLEVBQUcsU0FBUTs7QUFPM0IsSUFBTSx1QkFBdUIsaUJBQUUsbUJBQW1CLGNBQWM7RUFDckUseUJBQXlCLE9BQU87SUFDOUIsWUFBWSxpQkFBRSxRQUFRLG1CQUFtQjtJQUN6QyxVQUFVO0lBQ1YsU0FBUyxpQkFBRSxRQUFRLG1CQUFtQjtJQUN0QyxHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsT0FBTztJQUM3QixVQUFVO0lBQ1YsU0FBUyxpQkFBRSxRQUFRLGVBQWU7SUFDbEMsR0FBRztHQUNKO0VBQ0QseUJBQXlCLE9BQU87SUFDOUIsWUFBWSxpQkFBRSxRQUFRLE1BQU07SUFDNUIsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxjQUFjO0lBQ2pDLFNBQVM7SUFDVCxVQUFVLGlCQUFFLFVBQVMsRUFBRyxTQUFRO0dBQ2pDO0VBQ0QseUJBQXlCLE9BQU87SUFDOUIsWUFBWSxpQkFBRSxRQUFRLFlBQVk7SUFDbEMsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxxQkFBcUI7SUFDeEMsU0FBUztJQUNULFVBQVU7R0FDWDtFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSxrQkFBa0I7SUFDeEMsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxrQkFBa0I7SUFDckMsU0FBUztJQUNULFVBQVU7R0FDWDtFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSxhQUFhO0lBQ25DLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsYUFBYTtJQUNoQyxHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsU0FBUztJQUMvQixVQUFVO0lBQ1YsU0FBUyxpQkFBRSxRQUFRLGVBQWU7SUFDbEMsU0FBUztJQUNULFVBQVU7R0FDWDtFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSxjQUFjO0lBQ3BDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsY0FBYztJQUNqQyxHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsa0JBQWtCO0lBQ3hDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsVUFBVTtJQUM3QixHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsbUJBQW1CO0lBQ3pDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsV0FBVztJQUM5QixHQUFHO0dBQ0o7RUFDRCx5QkFBeUIsT0FBTztJQUM5QixZQUFZLGlCQUFFLFFBQVEsa0JBQWtCO0lBQ3hDLFVBQVU7SUFDVixTQUFTLGlCQUFFLFFBQVEsVUFBVTtJQUM3QixTQUFTO0lBQ1QsVUFBVSxpQkFBRSxVQUFTLEVBQUcsU0FBUTtHQUNqQztFQUNELHlCQUF5QixPQUFPO0lBQzlCLFlBQVksaUJBQUUsUUFBUSx3QkFBd0I7SUFDOUMsVUFBVTtJQUNWLFNBQVMsaUJBQUUsUUFBUSxnQkFBZ0I7SUFDbkMsU0FBUztJQUNULFVBQVU7R0FDWDtDQUNGO0FBRUQsSUFBTSw4QkFBOEIscUJBQXFCLFlBQ3ZELENBQUMsZ0JBQWdCLFlBQVc7QUFDMUIsTUFBSSxDQUFDLDZCQUE2QixVQUFVLGVBQWUsYUFBYSxFQUFFLFNBQVM7QUFDakYsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZUFBZTtLQUN2QjtFQUNIO0FBQ0YsQ0FBQztBQUdJLElBQU0scUJBQXFCLGlCQUMvQixPQUFPO0VBQ04sU0FBUztFQUNULFdBQVcsaUJBQUUsUUFBUSx5QkFBeUI7RUFDOUMsT0FBTztFQUNQLFlBQVk7RUFDWixtQkFBbUI7RUFDbkIsS0FBSztFQUNMLFlBQVk7Q0FDYixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLE1BQUksU0FBUyxNQUFNLFdBQVcsNEJBQTRCO0FBQ3hELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLE9BQU87S0FDZjtFQUNIO0FBQ0EsTUFBSSxTQUFTLGtCQUFrQixXQUFXLHlDQUF5QztBQUNqRixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxtQkFBbUI7S0FDM0I7RUFDSDtBQUNBLE1BQUksU0FBUyxlQUFlLFNBQVMsSUFBSSxZQUFZO0FBQ25ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLDhDQUE4QztBQUVwRCxJQUFNLDZCQUE2QixtQkFBbUIsWUFDM0QsQ0FBQyxVQUFVLFlBQVc7QUFDcEIsTUFBSSxTQUFTLFdBQVcsU0FBUyw2Q0FBNkM7QUFDNUUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsWUFBWTtLQUNwQjtFQUNIO0FBQ0EsTUFBSSxTQUFTLElBQUksZUFBZSxnQkFBZ0I7QUFDOUMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsS0FBSztLQUNiO0VBQ0g7QUFDRixDQUFDO0FBR0ksSUFBTSx1Q0FBdUMsSUFBSSxPQUFPO0FBQ3hELElBQU0sb0NBQW9DO0FBQzFDLElBQU0sd0JBQXdCO0FBQzlCLElBQU0sd0NBQXdDLElBQUksT0FBTyxPQUFPO0FBQ2hFLElBQU0sd0NBQ1gsdUNBQXVDO0FBQ2xDLElBQU0seUNBQ1gsd0NBQ0Esd0JBQXdCO0FBQ25CLElBQU0sc0NBQXNDO0FBQzVDLElBQU0sd0NBQXdDLEtBQUssS0FDdkQsb0NBQW9DLElBQUssQ0FBQztBQUV0QyxJQUFNLHdDQUF3QyxLQUFLLEtBQ3ZELHdDQUF3QyxJQUFLLENBQUM7QUFHakQsSUFBTSwyQkFBMkIsZ0JBQzlCLE9BQU8sbUNBQW1DLEVBQzFDLE9BQU8sQ0FBQyxVQUFVLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRSxlQUFlLElBQUk7RUFDcEUsT0FBTztDQUNSO0FBQ0ksSUFBTSxrQ0FBa0MsZ0JBQzVDLElBQUkscUNBQXFDLEVBQ3pDLElBQUkscUNBQXFDLEVBQ3pDLE9BQ0MsQ0FBQyxVQUFTO0FBQ1IsUUFBTSxhQUFhLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRTtBQUNuRCxTQUNFLGNBQWMscUNBQ2QsY0FBYztBQUVsQixHQUNBLEVBQUUsT0FBTyxtRUFBa0UsQ0FBRSxFQUU5RSxNQUFLO0FBRVIsSUFBTSx1Q0FBdUMsaUJBQUUsT0FBTztFQUNwRCxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixXQUFXLGlCQUFFLFFBQVEsaUNBQWlDO0VBQ3RELGVBQWUsaUJBQUUsUUFBUSxDQUFDO0VBQzFCLGVBQWU7RUFDZixZQUFZO0VBQ1osU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsY0FBYztDQUNmO0FBRU0sSUFBTSwyQ0FDWCxxQ0FDRyxPQUFPO0VBQ04sWUFBWSxpQkFBRSxRQUFRLFFBQVE7RUFDOUIsUUFBUTtDQUNULEVBQ0EsT0FBTTtBQUVKLElBQU0sMENBQ1gscUNBQ0csT0FBTztFQUNOLFlBQVksaUJBQUUsUUFBUSxPQUFPO0VBQzdCLE9BQU8saUJBQ0osT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSx3QkFBd0IsQ0FBQztFQUNoQyxZQUFZO0VBQ1osS0FBSyxpQkFBRSxLQUFLLENBQUMsV0FBVyxPQUFPLENBQUM7Q0FDakMsRUFDQSxPQUFNO0FBRUosSUFBTSxxQ0FBcUMsaUJBQUUsbUJBQW1CLGNBQWM7RUFDbkY7RUFDQTtDQUNEO0FBRU0sSUFBTSx3Q0FBd0MsaUJBQ2xELE9BQU87RUFDTixZQUFZLGlCQUFFLFFBQVEsbUJBQW1CO0VBQ3pDLFFBQVE7RUFDUixnQkFBZ0I7RUFDaEIsYUFBYTtFQUNiLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNO0FBRUYsSUFBTSx1Q0FBdUMsaUJBQ2pELE9BQU87RUFDTixZQUFZLGlCQUFFLFFBQVEsa0JBQWtCO0VBQ3hDLFFBQVE7RUFDUixnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxvQ0FBb0M7RUFDM0MsZ0JBQWdCO0VBQ2hCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxrQkFBa0IsT0FBTyxLQUM3QixNQUFNLE9BQU8sWUFDYixXQUFXLEVBQ1g7QUFDRixNQUFJLG9CQUFvQixNQUFNLGlCQUFpQixtQ0FBbUM7QUFDaEYsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZ0JBQWdCO0tBQ3hCO0VBQ0g7QUFDRixDQUFDO0FBSUksSUFBTSx1Q0FBdUMscUNBQ2pELE9BQU87RUFDTixpQkFBaUIsaUJBQUUsUUFBUSxDQUFDO0VBQzVCLFFBQVE7RUFDUixZQUFZLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsU0FBUSxFQUFHLElBQUkscUJBQXFCO0VBQ2pFLHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxxQ0FBcUM7RUFDNUMsaUJBQWlCO0NBQ2xCLEVBQ0EsT0FBTTtBQUVGLElBQU0sNEJBQTRCO0FBQ2xDLElBQU0sZ0NBQWdDO0FBQ3RDLElBQU0sOEJBQThCO0FBQ3BDLElBQU0sd0JBQXdCO0FBQzlCLElBQU0sd0JBQXdCO0FBQzlCLElBQU0sb0JBQW9CO0FBQzFCLElBQU0sb0JBQW9CO0FBQzFCLElBQU0seUJBQXlCO0FBQy9CLElBQU0seUJBQXlCO0FBQy9CLElBQU0sZ0NBQWdDO0FBRTdDLElBQU0saUJBQWlCLGdCQUFnQixPQUFPLHlCQUF5QjtBQUN2RSxJQUFNLHFCQUFxQixnQkFBZ0IsT0FBTyw2QkFBNkI7QUFFeEUsSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixXQUFXLGlCQUFFLFFBQVEsYUFBYTtFQUNsQyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixNQUFNO0VBQ04sU0FBUyxpQkFBRSxRQUFRLGdDQUFnQztFQUNuRCxjQUFjLGlCQUFFLFFBQVEsMkJBQTJCO0NBQ3BELEVBQ0EsT0FBTTtBQUVGLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sV0FBVyxpQkFBRSxRQUFRLFVBQVU7RUFDL0IsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsTUFBTTtFQUNOLFdBQVcsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLHFCQUFxQixFQUFFLElBQUkscUJBQXFCO0VBQ2hGLFFBQVEsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLGlCQUFpQixFQUFFLElBQUksaUJBQWlCO0VBQ3JFLGFBQWEsaUJBQ1YsT0FBTSxFQUNOLElBQUcsRUFDSCxJQUFJLHNCQUFzQixFQUMxQixJQUFJLHNCQUFzQjtFQUM3QixjQUFjLGlCQUFFLFFBQVEsMkJBQTJCO0NBQ3BELEVBQ0EsT0FBTTtBQUVGLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sV0FBVyxpQkFBRSxRQUFRLGFBQWE7RUFDbEMsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsTUFBTTtFQUNOLFNBQVMsaUJBQUUsUUFBUSxnQ0FBZ0M7RUFDbkQsY0FBYyxpQkFBRSxRQUFRLDJCQUEyQjtDQUNwRCxFQUNBLE9BQU07QUFFRixJQUFNLDRCQUE0QixpQkFDdEMsT0FBTztFQUNOLFdBQVcsaUJBQUUsUUFBUSxhQUFhO0VBQ2xDLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLE1BQU07RUFDTixTQUFTLGlCQUFFLFFBQVEsOEJBQThCO0VBQ2pELGNBQWMsaUJBQUUsUUFBUSwyQkFBMkI7RUFDbkQsVUFBVSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSw2QkFBNkI7Q0FDOUQsRUFDQSxPQUFNO0FBRUYsSUFBTSxzQkFBc0I7QUFDNUIsSUFBTSxzQkFBc0I7QUFFbkMsSUFBTSxvQkFBb0IsaUJBQUUsT0FBTztFQUNqQyxhQUFhO0VBQ2IsSUFBSTtFQUNKLE9BQU8saUJBQUUsS0FBSyxDQUFDLFdBQVcsVUFBVSxjQUFjLFNBQVMsQ0FBQztFQUM1RCxZQUFZO0VBQ1osZ0JBQWdCO0VBQ2hCLFdBQVc7RUFDWCxjQUFjLGdCQUFnQixTQUFRO0VBQ3RDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEM7QUFFTSxJQUFNLGdCQUFnQixpQkFDMUIsbUJBQW1CLFFBQVE7RUFDMUIsa0JBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxjQUFjO0lBQzlCLFlBQVk7R0FDYixFQUNBLE9BQU07RUFDVCxrQkFDRyxPQUFPO0lBQ04sTUFBTSxpQkFBRSxRQUFRLFlBQVk7SUFDNUIsWUFBWTtHQUNiLEVBQ0EsT0FBTTtFQUNULGtCQUNHLE9BQU87SUFDTixNQUFNLGlCQUFFLFFBQVEsY0FBYztJQUM5QixZQUFZO0dBQ2IsRUFDQSxPQUFNO0VBQ1Qsa0JBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxZQUFZO0lBQzVCLFlBQVk7SUFDWixVQUFVO0dBQ1gsRUFDQSxPQUFNO0NBQ1YsRUFDQSxZQUFZLENBQUMsTUFBTSxZQUFXO0FBQzdCLE1BQUksS0FBSyxlQUFlLElBQUksZUFBZSxvQkFBb0I7QUFDN0QsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsa0JBQWtCLE9BQU8sWUFBWTtLQUM3QztFQUNIO0FBQ0EsTUFBSSxLQUFLLGVBQWUsSUFBSSxhQUFhLEtBQUssSUFBSTtBQUNoRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxrQkFBa0IsT0FBTyxVQUFVO0tBQzNDO0VBQ0g7QUFDQSxNQUFJLEtBQUssZUFBZSxlQUFlLEtBQUssWUFBWTtBQUN0RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxrQkFBa0IsWUFBWTtLQUN0QztFQUNIO0FBQ0EsTUFBSSxLQUFLLFVBQVUsYUFBYSxLQUFLLGNBQWMsUUFBVztBQUM1RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLEtBQUssVUFBVSxhQUFhLEtBQUssY0FBYyxRQUFXO0FBQzVELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFdBQVc7S0FDbkI7RUFDSDtBQUNBLE1BQUksS0FBSyxVQUFVLGdCQUFnQixLQUFLLGlCQUFpQixRQUFXO0FBQ2xFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGNBQWM7S0FDdEI7RUFDSDtBQUNBLE1BQUksS0FBSyxVQUFVLGdCQUFnQixLQUFLLGlCQUFpQixRQUFXO0FBQ2xFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGNBQWM7S0FDdEI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLG9CQUFvQixpQkFDOUIsT0FBTztFQUNOLElBQUk7RUFDSixlQUFlO0VBQ2Ysc0JBQXNCO0VBQ3RCLFVBQVUsaUJBQUUsTUFBTSxhQUFhLEVBQUUsSUFBSSxtQkFBbUIsRUFBRSxJQUFJLG1CQUFtQjtFQUNqRixtQkFBbUI7RUFDbkIsVUFBVTtFQUNWLHNCQUFzQjtFQUN0QixXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxNQUFNLG9CQUFJLElBQUc7QUFDbkIsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLE1BQU0sU0FBUyxRQUFPLEdBQUk7QUFDcEQsUUFBSSxLQUFLLGVBQWUsSUFBSSxZQUFZLE1BQU0sSUFBSTtBQUNoRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxZQUFZLE9BQU8sa0JBQWtCLE9BQU8sU0FBUztPQUM3RDtJQUNIO0FBQ0EsUUFBSSxLQUFLLGVBQWUsSUFBSSxrQkFBa0IsTUFBTSxlQUFlO0FBQ2pFLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFlBQVksT0FBTyxrQkFBa0IsT0FBTyxlQUFlO09BQ25FO0lBQ0g7QUFDQSxRQUFJLElBQUksSUFBSSxLQUFLLEVBQUUsR0FBRztBQUNwQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxZQUFZLE9BQU8sSUFBSTtPQUMvQjtJQUNIO0FBQ0EsUUFBSSxJQUFJLEtBQUssRUFBRTtFQUNqQjtBQUNBLE1BQUksQ0FBQyxNQUFNLFNBQVMsS0FBSyxDQUFDLFNBQVMsS0FBSyxVQUFVLFFBQVEsR0FBRztBQUMzRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxVQUFVO0tBQ2xCO0VBQ0g7QUFDQSxNQUNFLENBQUMsTUFBTSxTQUFTLEtBQ2QsQ0FBQyxTQUNDLEtBQUssVUFBVSxZQUFZLEtBQUssZUFBZSxNQUFNLGlCQUFpQixHQUUxRTtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLG1CQUFtQjtLQUMzQjtFQUNIO0FBQ0EsTUFDRSxNQUFNLHFCQUFxQixJQUFJLFlBQVksTUFBTSxNQUNqRCxNQUFNLHFCQUFxQixJQUFJLGVBQWUsdUJBQzlDLE1BQU0scUJBQXFCLElBQUksYUFBYSxNQUFNLE1BQ2xELE1BQU0scUJBQXFCLElBQUksa0JBQWtCLE1BQU0sZUFDdkQ7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyx3QkFBd0IsS0FBSztLQUNyQztFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sSUFBSTtFQUNKLFNBQVM7RUFDVCxlQUFlO0VBQ2YsaUJBQWlCO0VBQ2pCLGtCQUFrQjtFQUNsQixpQkFBaUI7RUFDakIsZ0JBQWdCO0VBQ2hCLFdBQVc7RUFDWCxXQUFXO0VBQ1gsY0FBYyxnQkFBZ0IsU0FBUTtDQUN2QyxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLDBCQUNFLFNBQ0EsT0FBTyxrQkFDUCxPQUFPLFNBQ1AsT0FBTyxlQUNQLFNBQ0EsT0FBTyxFQUFFO0FBRVgsMEJBQ0UsU0FDQSxPQUFPLGlCQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1AscUJBQ0EsT0FBTyxFQUFFO0FBRWIsQ0FBQztBQUVJLElBQU0sNEJBQTRCLGlCQUN0QyxPQUFPO0VBQ04sSUFBSTtFQUNKLFNBQVM7RUFDVCxTQUFTO0VBQ1QsZUFBZTtFQUNmLGdCQUFnQjtFQUNoQixrQkFBa0I7RUFDbEIsZ0JBQWdCO0VBQ2hCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsV0FBVztFQUNYLGNBQWMsZ0JBQWdCLFNBQVE7Q0FDdkMsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFFBQVEsWUFBVztBQUMvQiwwQkFDRSxTQUNBLE9BQU8sa0JBQ1AsT0FBTyxTQUNQLE9BQU8sZUFDUCxRQUNBLE9BQU8sSUFDUCxPQUFPLE9BQU87QUFFaEIsMEJBQ0UsU0FDQSxPQUFPLGdCQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1Asb0JBQ0EsT0FBTyxJQUNQLE9BQU8sT0FBTztBQUVsQixDQUFDO0FBRUksSUFBTSxrQ0FBa0MsaUJBQzVDLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsZUFBZTtFQUNmLHNCQUFzQjtFQUN0QixtQkFBbUI7RUFDbkIsWUFBWSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVEsRUFBRyxJQUFJLHFCQUFxQjtFQUNqRSxnQkFBZ0I7RUFDaEIsV0FBVztFQUNYLFdBQVc7RUFDWCxjQUFjLGdCQUFnQixTQUFRO0NBQ3ZDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsMEJBQ0UsU0FDQSxPQUFPLG1CQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1AsY0FDQSxPQUFPLElBQ1AsT0FBTyxTQUNQLE9BQU8sTUFBTTtBQUVmLDBCQUNFLFNBQ0EsT0FBTyxzQkFDUCxPQUFPLFNBQ1AsT0FBTyxlQUNQLDBCQUNBLE9BQU8sSUFDUCxPQUFPLFNBQ1AsT0FBTyxNQUFNO0FBRWYsTUFDRSxPQUFPLHFCQUFxQixlQUFlLE9BQU8sa0JBQWtCLFlBQ3BFO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyx3QkFBd0IsWUFBWTtNQUMzQyxTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLDZCQUE2QixpQkFDdkMsT0FBTztFQUNOLElBQUk7RUFDSixTQUFTO0VBQ1QsZUFBZTtFQUNmLGtCQUFrQjtFQUNsQixnQkFBZ0I7RUFDaEIsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsMEJBQ0UsU0FDQSxPQUFPLGtCQUNQLE9BQU8sU0FDUCxPQUFPLGVBQ1AsZUFDQSxPQUFPLEVBQUU7QUFFYixDQUFDO0FBRUksSUFBTSwrQkFBK0IsaUJBQ3pDLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsZUFBZTtFQUNmLGtCQUFrQjtFQUNsQixvQkFBb0I7RUFDcEIsZ0JBQWdCO0VBQ2hCLFdBQVc7Q0FDWixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLDBCQUNFLFNBQ0EsT0FBTyxrQkFDUCxPQUFPLFNBQ1AsT0FBTyxlQUNQLFdBQ0EsT0FBTyxJQUNQLE9BQU8sU0FDUCxPQUFPLE1BQU07QUFFakIsQ0FBQztBQUVJLElBQU0sd0JBQXdCLGlCQUFFLE1BQU07RUFDM0M7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRUQsU0FBUyx3QkFDUCxTQUNBLFVBQ0EsU0FDQSxlQUNBLFlBQ0EsVUFDQSxTQUNBLFVBQWlCO0FBRWpCLE1BQ0UsU0FBUyxJQUFJLFlBQVksV0FDekIsU0FBUyxJQUFJLGtCQUFrQixpQkFDL0IsU0FBUyxJQUFJLGVBQWUsY0FDNUIsU0FBUyxJQUFJLGFBQWEsWUFDMUIsU0FBUyxJQUFJLFlBQVksV0FDekIsU0FBUyxJQUFJLGFBQWEsVUFDMUI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxLQUFLO0tBQ2I7RUFDSDtBQUNGOzs7QUNqeEJBLFNBQVMsWUFBWSx1QkFBdUI7QUFpQjVDLElBQU0sK0JBQStCLE9BQU8sS0FDMUMsbUNBQ0EsTUFBTTtBQTZERixTQUFVLGNBQWMsT0FBYztBQUMxQyxNQUFJLFVBQVU7QUFBTSxXQUFPO0FBQzNCLE1BQUksT0FBTyxVQUFVLFlBQVksT0FBTyxVQUFVLFdBQVc7QUFDM0QsV0FBTyxLQUFLLFVBQVUsS0FBSztFQUM3QjtBQUNBLE1BQUksT0FBTyxVQUFVLFVBQVU7QUFDN0IsUUFBSSxDQUFDLE9BQU8sU0FBUyxLQUFLLEdBQUc7QUFDM0IsWUFBTSxJQUFJLFVBQVUsNENBQTRDO0lBQ2xFO0FBQ0EsV0FBTyxLQUFLLFVBQVUsS0FBSztFQUM3QjtBQUNBLE1BQUksTUFBTSxRQUFRLEtBQUssR0FBRztBQUN4QixXQUFPLElBQUksTUFBTSxJQUFJLENBQUMsVUFBVSxjQUFjLEtBQUssQ0FBQyxFQUFFLEtBQUssR0FBRyxDQUFDO0VBQ2pFO0FBQ0EsTUFBSSxPQUFPLFVBQVUsVUFBVTtBQUM3QixVQUFNLElBQUksVUFBVSwwQ0FBMEM7RUFDaEU7QUFFQSxRQUFNLFlBQVksT0FBTyxlQUFlLEtBQUs7QUFDN0MsTUFBSSxjQUFjLE9BQU8sYUFBYSxjQUFjLE1BQU07QUFDeEQsVUFBTSxJQUFJLFVBQVUsMkNBQTJDO0VBQ2pFO0FBQ0EsUUFBTSxTQUFTO0FBQ2YsU0FBTyxJQUFJLE9BQU8sS0FBSyxNQUFNLEVBQzFCLEtBQUksRUFDSixPQUFPLENBQUMsUUFBUSxPQUFPLEdBQUcsTUFBTSxNQUFTLEVBQ3pDLElBQUksQ0FBQyxRQUFRLEdBQUcsS0FBSyxVQUFVLEdBQUcsQ0FBQyxJQUFJLGNBQWMsT0FBTyxHQUFHLENBQUMsQ0FBQyxFQUFFLEVBQ25FLEtBQUssR0FBRyxDQUFDO0FBQ2Q7QUF3Qk0sU0FBVSw0QkFDZCxRQUF1QztBQUV2QyxTQUFPLG1CQUFtQixNQUN4QixXQUFXLFFBQVEsRUFDaEIsT0FBTyxjQUFjLE9BQU8sTUFBTSxHQUFHLE1BQU0sRUFDM0MsT0FBTyxXQUFXLENBQUM7QUFFMUI7OztBQzNITyxJQUFNLGtCQUFrQixpQkFBRSxLQUFLO0VBQ3BDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQUVELElBQU0sc0JBQXNCLG9CQUFJLElBQXFDO0VBQ25FO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFSyxTQUFVLHFCQUNkLFdBQTBDO0FBRTFDLFNBQU8sb0JBQW9CLElBQUksU0FBUztBQUMxQztBQUVPLElBQU0sbUJBQW1CLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFdBQVcsU0FBUyxDQUFDO0FBQy9ELElBQU0scUJBQXFCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFNBQVMsU0FBUyxDQUFDO0FBQy9ELElBQU0sK0JBQStCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLGNBQWMsUUFBUSxDQUFDO0FBQzdFLElBQU0scUJBQXFCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLGtCQUFrQixTQUFTLENBQUM7QUFHeEUsSUFBTSx3QkFBd0IsaUJBQUUsS0FBSztFQUMxQztFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQUVNLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPO0VBQ04sV0FBVyxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO0VBQ2xELFdBQVcsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxPQUFTLEVBQUUsU0FBUTtFQUM5RCxpQkFBaUIsc0JBQXNCLFNBQVE7RUFDL0MsS0FBSyxpQkFBRSxPQUFNLEVBQUcsU0FBUTtFQUN4QixLQUFLLGlCQUFFLE9BQU0sRUFBRyxTQUFRO0VBQ3hCLGdCQUFnQixpQkFBRSxNQUFNLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsQ0FBQyxFQUFFLElBQUksRUFBRSxFQUFFLFNBQVE7Q0FDcEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixNQUNFLE1BQU0sY0FBYyxVQUNwQixNQUFNLGNBQWMsVUFDcEIsTUFBTSxZQUFZLE1BQU0sV0FDeEI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLE1BQU0sUUFBUSxVQUFhLE1BQU0sUUFBUSxVQUFhLE1BQU0sTUFBTSxNQUFNLEtBQUs7QUFDL0UsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsS0FBSztLQUNiO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSxxQkFBcUIsaUJBQy9CLE9BQU87RUFDTixPQUFPLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUc7RUFDaEMsT0FBTztDQUNSLEVBQ0EsT0FBTTtBQUVULElBQU0sMkJBQTJCLGlCQUM5QixPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFBTSxpQ0FBaUMsOEJBQThCO0FBRWpFLElBQU0sNEJBQ1gseUJBQXlCLE1BQUs7QUFFaEMsSUFBTSwwQkFBMEIsb0JBQW9CLE9BQ2xELENBQUMsVUFBVSxNQUFNLFNBQVMsR0FDMUIsRUFBRSxPQUFPLHNDQUFxQyxDQUFFO0FBRWxELElBQU0sNEJBQTRCLGtCQUFrQixPQUNsRCxDQUFDLFVBQVUsTUFBTSxTQUFTLEdBQzFCLEVBQUUsT0FBTyx3Q0FBdUMsQ0FBRTtBQUc3QyxJQUFNLHlCQUF5QixpQkFBRSxtQkFBbUIsUUFBUTtFQUNqRSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLE1BQU0sR0FBRyxPQUFPLHdCQUF1QixDQUFFLEVBQUUsT0FBTTtFQUM1RSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFFBQVEsR0FBRyxPQUFPLDBCQUF5QixDQUFFLEVBQUUsT0FBTTtFQUNoRixpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFFBQVEsR0FBRyxPQUFPLGlCQUFFLE9BQU0sRUFBRSxDQUFFLEVBQUUsT0FBTTtFQUNqRSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFNBQVMsR0FBRyxPQUFPLGlCQUFFLFFBQU8sRUFBRSxDQUFFLEVBQUUsT0FBTTtFQUNuRSxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLGdCQUFnQixHQUFHLFFBQVEsYUFBWSxDQUFFLEVBQUUsT0FBTTtFQUM1RSxpQkFDRyxPQUFPO0lBQ04sTUFBTSxpQkFBRSxRQUFRLHNCQUFzQjtJQUN0QyxjQUFjO0dBQ2YsRUFDQSxPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxtQkFBbUI7SUFDbkMsS0FBSyxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO0lBQzlCLE9BQU8saUJBQUUsbUJBQW1CLGtCQUFrQjtNQUM1QyxpQkFDRyxPQUFPO1FBQ04sZ0JBQWdCLGlCQUFFLFFBQVEsTUFBTTtRQUNoQyxPQUFPO09BQ1IsRUFDQSxPQUFNO01BQ1QsaUJBQ0csT0FBTztRQUNOLGdCQUFnQixpQkFBRSxRQUFRLFFBQVE7UUFDbEMsT0FBTztPQUNSLEVBQ0EsT0FBTTtLQUNWO0dBQ0YsRUFDQSxPQUFNO0NBQ1Y7QUFFTSxJQUFNLG1DQUFtQyxpQkFBRSxtQkFBbUIsVUFBVTtFQUM3RSxpQkFDRyxPQUFPO0lBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7SUFDcEIsUUFBUSxpQkFBRSxRQUFRLFdBQVc7SUFDN0IsUUFBUSxpQkFBRSxVQUFTLEVBQUcsU0FBUTtHQUMvQixFQUNBLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7SUFDcEIsUUFBUSxpQkFBRSxRQUFRLE1BQU07SUFDeEIsUUFBUTtHQUNULEVBQ0EsT0FBTTtDQUNWO0FBRU0sSUFBTSwwQkFBMEIsaUJBQ3BDLE9BQU87RUFDTixJQUFJO0VBQ0osT0FBTztFQUNQLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLDBCQUEwQixpQkFDcEMsbUJBQW1CLGVBQWU7RUFDakMsaUJBQ0csT0FBTztJQUNOLGFBQWEsaUJBQUUsUUFBUSxRQUFRO0lBQy9CLE9BQU87R0FDUixFQUNBLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sYUFBYSxpQkFBRSxRQUFRLFVBQVU7SUFDakMsVUFBVSxpQkFBRSxNQUFNLHVCQUF1QixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksR0FBTTtHQUM3RCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsU0FBUyxZQUFXO0FBQ2hDLFVBQU0sTUFBTSxvQkFBSSxJQUFHO0FBQ25CLFVBQU0sa0JBQWtCLG9CQUFJLElBQUc7QUFDL0IsZUFBVyxDQUFDLE9BQU8sT0FBTyxLQUFLLFFBQVEsU0FBUyxRQUFPLEdBQUk7QUFDekQsVUFBSSxJQUFJLElBQUksUUFBUSxFQUFFLEdBQUc7QUFDdkIsZ0JBQVEsU0FBUztVQUNmLE1BQU07VUFDTixTQUFTO1VBQ1QsTUFBTSxDQUFDLFlBQVksT0FBTyxJQUFJO1NBQy9CO01BQ0g7QUFDQSxVQUFJLElBQUksUUFBUSxFQUFFO0FBQ2xCLFVBQUksUUFBUSxNQUFNLFNBQVMscUJBQXFCO0FBQzlDLFlBQUksZ0JBQWdCLElBQUksUUFBUSxNQUFNLEdBQUcsR0FBRztBQUMxQyxrQkFBUSxTQUFTO1lBQ2YsTUFBTTtZQUNOLFNBQVM7WUFDVCxNQUFNLENBQUMsWUFBWSxPQUFPLFNBQVMsS0FBSztXQUN6QztRQUNIO0FBQ0Esd0JBQWdCLElBQUksUUFBUSxNQUFNLEdBQUc7TUFDdkM7SUFDRjtFQUNGLENBQUM7Q0FDSixFQUNBLE9BQ0MsQ0FBQyxVQUFVLElBQUksWUFBVyxFQUFHLE9BQU8sS0FBSyxVQUFVLEtBQUssQ0FBQyxFQUFFLGNBQWMsU0FDekUsRUFBRSxPQUFPLHVEQUFzRCxDQUFFO0FBRzlELElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPLEVBQUUsU0FBUyxpQkFBRSxRQUFRLENBQUMsR0FBRyxPQUFPLGlCQUFFLFFBQVEsU0FBUyxFQUFDLENBQUUsRUFDN0QsT0FBTTtBQUNGLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPLEVBQUUsU0FBUyxpQkFBRSxRQUFRLENBQUMsR0FBRyxPQUFPLGlCQUFFLFFBQVEsT0FBTyxFQUFDLENBQUUsRUFDM0QsT0FBTTtBQUNGLElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsT0FBTyxpQkFBRSxRQUFRLGNBQWM7RUFDL0IsUUFBUSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRyxFQUFFLFNBQVE7Q0FDbkQsRUFDQSxPQUFNO0FBQ0YsSUFBTSw2QkFBNkIsaUJBQ3ZDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixPQUFPLGlCQUFFLFFBQVEsWUFBWTtFQUM3QixRQUFRLGlCQUFFLEtBQUs7SUFDYjtJQUNBO0lBQ0E7SUFDQTtHQUNEO0NBQ0YsRUFDQSxPQUFNO0FBQ0YsSUFBTSwwQkFBMEIsaUJBQ3BDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixPQUFPLGlCQUFFLFFBQVEsU0FBUztFQUMxQixTQUFTO0NBQ1YsRUFDQSxPQUFNO0FBQ0YsSUFBTSx5QkFBeUIsaUJBQUUsbUJBQW1CLFNBQVM7RUFDbEU7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBQ00sSUFBTSwyQkFBMkIsaUJBQ3JDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixPQUFPLGlCQUFFLFFBQVEsVUFBVTtFQUMzQixlQUFlO0NBQ2hCLEVBQ0EsT0FBTTtBQUVGLElBQU0sbUJBQW1CLGlCQUM3QixtQkFBbUIsU0FBUztFQUMzQjtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7Q0FDRCxFQUNBLE9BQ0MsQ0FBQyxVQUFVLElBQUksWUFBVyxFQUFHLE9BQU8sS0FBSyxVQUFVLEtBQUssQ0FBQyxFQUFFLGNBQWMsU0FDekUsRUFBRSxPQUFPLCtDQUE4QyxDQUFFO0FBR3RELElBQU0sdUJBQXVCLGlCQUNqQyxPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFBTSx1Q0FBdUMsMEJBQTBCO0FBRW5FLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPO0VBQ04sSUFBSTtFQUNKLFdBQVc7RUFDWCxPQUFPO0VBQ1AsYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDbEQsTUFBTTtFQUNOLFVBQVUsaUJBQUUsUUFBTztFQUNuQixXQUFXLGlCQUFFLFFBQU87RUFDcEIsWUFBWSxpQkFBRSxRQUFPO0VBQ3JCLFVBQVUsaUJBQUUsUUFBTztFQUNuQixtQkFBbUIsaUJBQUUsUUFBTztFQUM1QixlQUFlLGlCQUFFLFFBQU87RUFDeEIsY0FBYyx3QkFBd0IsU0FBUTtFQUM5QyxhQUFhLGlCQUFFLE9BQU0sRUFBRyxJQUFJLEdBQUcsRUFBRSxTQUFRO0VBQ3pDLGlCQUFpQixzQkFBc0IsU0FBUTtFQUMvQyxlQUFlLGlCQUFFLE1BQU0sa0JBQWtCLEVBQUUsSUFBSSxHQUFLLEVBQUUsU0FBUTtFQUM5RCx5QkFBeUIsaUJBQ3RCLE9BQU0sRUFDTixNQUFNLDBCQUEwQixFQUNoQyxJQUFJLEdBQUcsRUFDUCxTQUFRO0VBQ1gsWUFBWTtFQUNaLGNBQWM7RUFDZCx3QkFBd0I7RUFDeEIsY0FBYztFQUNkLFdBQVc7RUFDWCxXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsTUFBSSxNQUFNLGNBQWMsTUFBTSxlQUFlLFVBQVU7QUFDckQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsWUFBWTtLQUNwQjtFQUNIO0FBQ0EsTUFBSSxNQUFNLGFBQWEsTUFBTSxpQkFBaUIsUUFBVztBQUN2RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxjQUFjO0tBQ3RCO0VBQ0g7QUFDQSxNQUFJLHFCQUFxQixNQUFNLElBQUksS0FBSyxDQUFDLE1BQU0sV0FBVztBQUN4RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLE1BQU0sYUFBYSxNQUFNLGVBQWU7QUFDMUMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZUFBZTtLQUN2QjtFQUNIO0FBQ0EsTUFBSSxNQUFNLGFBQWEsTUFBTSwyQkFBMkIsU0FBUztBQUMvRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyx3QkFBd0I7S0FDaEM7RUFDSDtBQUNBLE1BQUksQ0FBQyxNQUFNLGFBQWEsTUFBTSxpQkFBaUIsU0FBUztBQUN0RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxjQUFjO0tBQ3RCO0VBQ0g7QUFDQSxRQUFNLFdBQVcsTUFBTSxTQUFTLFlBQVksTUFBTSxTQUFTO0FBQzNELE1BQUksYUFBYSxDQUFDLE1BQU0saUJBQWlCLE1BQU0sY0FBYyxXQUFXLElBQUk7QUFDMUUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZUFBZTtLQUN2QjtFQUNIO0FBQ0EsTUFBSSxDQUFDLFlBQVksTUFBTSxrQkFBa0IsUUFBVztBQUNsRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxNQUNFLE1BQU0saUJBQWlCLFVBQ3ZCLENBQUMsNEJBQTRCLE9BQU8sTUFBTSxZQUFZLEdBQ3REO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsY0FBYztLQUN0QjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0seUJBQXlCLGlCQUNuQyxPQUFPO0VBQ04sU0FBUztFQUNULFdBQVc7RUFDWCxPQUFPO0VBQ1AsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQVVGLElBQU0saUNBQWlDLGlCQUFFLEtBQUs7RUFDbkQ7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLFlBQVk7RUFDWixPQUFPO0VBQ1Asa0JBQWtCO0VBQ2xCLHVCQUF1QjtFQUN2QixZQUFZO0VBQ1osUUFBUTtDQUNULEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxVQUFVLFlBQVc7QUFDakMsTUFDRSxDQUFDLDRCQUE0QixTQUFTLFlBQVksU0FBUyxNQUFNLGFBQWEsR0FDOUU7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxTQUFTLGVBQWU7S0FDaEM7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHNCQUFzQixpQkFDaEMsT0FBTztFQUNOLFFBQVE7RUFDUixjQUFjLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO0NBQy9DLEVBQ0EsT0FBTTtBQUVULElBQU0sdUJBQXVCLG9CQUFJLElBQWU7RUFDOUM7RUFDQTtFQUNBO0VBQ0E7Q0FDRDtBQVFLLFNBQVUsMkJBQTJCLE9BQXNCO0FBQy9ELFNBQU8sTUFBTSxjQUFjLHFCQUFxQixJQUFJLE1BQU0sSUFBSTtBQUNoRTtBQUVNLFNBQVUsNEJBQ2QsT0FDQSxPQUFpQjtBQUVqQixNQUFJLE1BQU0sVUFBVTtBQUFZLFdBQU87QUFDdkMsTUFBSSxNQUFNLFVBQVU7QUFBVyxXQUFPLENBQUMsTUFBTTtBQUU3QyxRQUFNLGtCQUFrQiwyQkFBMkIsS0FBSztBQUN4RCxNQUFJLHFCQUFxQixNQUFNLFFBQVEsZ0JBQWdCO0FBQWEsV0FBTztBQUMzRSxRQUFNLFdBQ0osTUFBTSxRQUFRLGdCQUFnQixhQUFhLE1BQU0sUUFBUSxXQUFXO0FBQ3RFLE1BQ0UsTUFBTSxTQUFTLHdCQUNmLFVBQVUsS0FBSyxDQUFDLEVBQUUsVUFBUyxNQUFPLFVBQVUsV0FBVyxNQUFNLE1BQU0sTUFDbkU7QUFDQSxXQUFPO0VBQ1Q7QUFDQSxRQUFNLGFBQ0osTUFBTSxRQUFRLGdCQUFnQixhQUMxQixNQUFNLFFBQVEsU0FBUyxJQUFJLENBQUMsRUFBRSxPQUFPLFVBQVMsTUFBTyxTQUFTLElBQzlELENBQUMsTUFBTSxRQUFRLEtBQUs7QUFDMUIsU0FBTyxXQUFXLE1BQ2hCLENBQUMsY0FDQyx1QkFBdUIsT0FBTyxTQUFTLEtBQUssa0JBQWtCLE9BQU8sU0FBUyxDQUFDO0FBRXJGO0FBRUEsU0FBUyx1QkFDUCxPQUNBLE9BQXVCO0FBRXZCLFVBQVEsTUFBTSxNQUFNO0lBQ2xCLEtBQUs7QUFDSCxhQUFPLE1BQU0sU0FBUztJQUN4QixLQUFLO0FBQ0gsYUFDRSxNQUFNLFNBQVMsWUFDZixPQUFPLFVBQVUsTUFBTSxLQUFLLEtBQzVCLE1BQU0sU0FBUyxLQUNmLE1BQU0sU0FBUztJQUVuQixLQUFLO0FBQ0gsYUFBTyxNQUFNLFNBQVM7SUFDeEIsS0FBSztBQUNILGFBQU8sTUFBTSxTQUFTO0lBQ3hCLEtBQUs7QUFDSCxhQUFPLE1BQU0sU0FBUztJQUN4QixLQUFLO0FBQ0gsYUFDRSxNQUFNLFNBQVMsdUJBQ2YsTUFBTSxNQUFNLG9CQUFvQixNQUFNLFlBQVksV0FBVztJQUVqRSxLQUFLO0FBQ0gsVUFBSSxDQUFDLG1CQUFtQixPQUFPLEtBQUs7QUFBRyxlQUFPO0FBQzlDLFVBQUk7QUFDRixhQUFLLE1BQU0sTUFBTSxLQUFLO0FBQ3RCLGVBQU87TUFDVCxRQUFRO0FBQ04sZUFBTztNQUNUO0lBQ0YsS0FBSztJQUNMLEtBQUs7QUFDSCxhQUFPLG1CQUFtQixPQUFPLEtBQUssS0FBSyxrQkFBa0IsT0FBTyxNQUFNLEtBQUs7SUFDakYsS0FBSztBQUNILGFBQU8sbUJBQW1CLE9BQU8sS0FBSyxLQUFLLGNBQWMsTUFBTSxLQUFLO0lBQ3RFLEtBQUs7QUFDSCxVQUFJLENBQUMsbUJBQW1CLE9BQU8sS0FBSztBQUFHLGVBQU87QUFDOUMsVUFBSTtBQUNGLGNBQU0sU0FBUyxJQUFJLElBQUksTUFBTSxLQUFLO0FBQ2xDLGNBQU0sVUFBVSxNQUFNLGlCQUFpQjtBQUN2QyxlQUFPLFlBQVksVUFBYSxRQUFRLFNBQVMsT0FBTyxTQUFTLE1BQU0sR0FBRyxFQUFFLENBQUM7TUFDL0UsUUFBUTtBQUNOLGVBQU87TUFDVDtJQUNGO0FBQ0UsYUFBTyxtQkFBbUIsT0FBTyxLQUFLO0VBQzFDO0FBQ0Y7QUFFQSxTQUFTLG1CQUNQLE9BQ0EsT0FBdUI7QUFFdkIsU0FBTyxNQUFNLFlBQVksTUFBTSxTQUFTLFdBQVcsTUFBTSxTQUFTO0FBQ3BFO0FBRUEsU0FBUyxrQkFBa0IsT0FBd0IsT0FBdUI7QUFDeEUsUUFBTSxRQUFRLE1BQU07QUFDcEIsTUFBSSxVQUFVO0FBQVcsV0FBTztBQUNoQyxNQUFJLE1BQU0sU0FBUyxVQUFVLE1BQU0sU0FBUyxVQUFVO0FBQ3BELFFBQUksTUFBTSxjQUFjLFVBQWEsTUFBTSxNQUFNLFNBQVMsTUFBTTtBQUM5RCxhQUFPO0FBQ1QsUUFBSSxNQUFNLGNBQWMsVUFBYSxNQUFNLE1BQU0sU0FBUyxNQUFNO0FBQzlELGFBQU87QUFDVCxRQUNFLE1BQU0sb0JBQW9CLFVBQzFCLENBQUMsdUJBQXVCLE1BQU0saUJBQWlCLE1BQU0sS0FBSztBQUUxRCxhQUFPO0VBQ1g7QUFDQSxNQUFJLE1BQU0sU0FBUyxVQUFVO0FBQzNCLFFBQUksTUFBTSxRQUFRLFVBQWEsTUFBTSxRQUFRLE1BQU07QUFBSyxhQUFPO0FBQy9ELFFBQUksTUFBTSxRQUFRLFVBQWEsTUFBTSxRQUFRLE1BQU07QUFBSyxhQUFPO0VBQ2pFO0FBQ0EsU0FBTztBQUNUO0FBRU0sU0FBVSx1QkFDZCxZQUNBLE9BQWE7QUFFYixVQUFRLFlBQVk7SUFDbEIsS0FBSztBQUNILGFBQU8sY0FBYyxPQUFPLENBQUMsU0FBUyxRQUFRLEdBQUk7SUFDcEQsS0FBSztBQUNILGFBQU8sY0FDTCxPQUNBLENBQUMsU0FDRSxRQUFRLE1BQVEsUUFBUSxPQUN4QixRQUFRLE1BQVEsUUFBUSxNQUN6QixTQUFTLE1BQ1QsU0FBUyxFQUFJO0lBRW5CLEtBQUs7QUFDSCxhQUFPLGNBQ0wsT0FDQSxDQUFDLFNBQ0UsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsR0FBSztJQUVwQyxLQUFLO0FBQ0gsYUFBTyxXQUFXLEtBQUs7SUFDekIsS0FBSztBQUNILGFBQU8sT0FBTyxLQUFLO0lBQ3JCLEtBQUs7QUFDSCxhQUFPLGNBQ0wsT0FDQSxDQUFDLFNBQ0UsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsTUFDeEIsUUFBUSxNQUFRLFFBQVEsT0FDekIsU0FBUyxNQUNULFNBQVMsRUFBSTtFQUVyQjtBQUNGO0FBRUEsU0FBUyxjQUFjLE9BQWUsV0FBb0M7QUFDeEUsTUFBSSxNQUFNLFdBQVc7QUFBRyxXQUFPO0FBQy9CLFdBQVMsUUFBUSxHQUFHLFFBQVEsTUFBTSxRQUFRLFNBQVMsR0FBRztBQUNwRCxRQUFJLENBQUMsVUFBVSxNQUFNLFdBQVcsS0FBSyxDQUFDO0FBQUcsYUFBTztFQUNsRDtBQUNBLFNBQU87QUFDVDtBQUVBLFNBQVMsV0FBVyxPQUFhO0FBQy9CLE1BQUksTUFBTSxXQUFXLEtBQUssTUFBTSxTQUFTO0FBQUssV0FBTztBQUNyRCxRQUFNLFNBQVMsTUFBTSxNQUFNLEdBQUc7QUFDOUIsU0FBTyxPQUFPLE1BQU0sQ0FBQyxVQUFTO0FBQzVCLFFBQUksTUFBTSxXQUFXLEtBQUssTUFBTSxTQUFTO0FBQUksYUFBTztBQUNwRCxRQUFJLE1BQU0sV0FBVyxHQUFHLEtBQUssTUFBTSxTQUFTLEdBQUc7QUFBRyxhQUFPO0FBQ3pELFdBQU8sY0FDTCxPQUNBLENBQUMsU0FDRSxRQUFRLE1BQVEsUUFBUSxNQUN4QixRQUFRLE1BQVEsUUFBUSxNQUN4QixRQUFRLE1BQVEsUUFBUSxPQUN6QixTQUFTLEVBQUk7RUFFbkIsQ0FBQztBQUNIO0FBRUEsU0FBUyxPQUFPLE9BQWE7QUFDM0IsUUFBTSxRQUFRLE1BQU0sTUFBTSxHQUFHO0FBQzdCLE1BQUksTUFBTSxXQUFXO0FBQUcsV0FBTztBQUMvQixTQUFPLE1BQU0sTUFBTSxDQUFDLFNBQVE7QUFDMUIsUUFBSSxLQUFLLFdBQVcsS0FBSyxLQUFLLFNBQVM7QUFBRyxhQUFPO0FBQ2pELFFBQUksS0FBSyxTQUFTLEtBQUssS0FBSyxXQUFXLEdBQUc7QUFBRyxhQUFPO0FBQ3BELFFBQUksQ0FBQyxjQUFjLE1BQU0sQ0FBQyxTQUFTLFFBQVEsTUFBUSxRQUFRLEVBQUk7QUFBRyxhQUFPO0FBQ3pFLFVBQU0sUUFBUSxPQUFPLElBQUk7QUFDekIsV0FBTyxTQUFTLEtBQUssU0FBUztFQUNoQyxDQUFDO0FBQ0g7QUFFQSxTQUFTLGNBQWMsT0FBYTtBQUNsQyxRQUFNLEtBQUssTUFBTSxRQUFRLEdBQUc7QUFDNUIsTUFBSSxNQUFNLEtBQUssT0FBTyxNQUFNLFlBQVksR0FBRztBQUFHLFdBQU87QUFDckQsUUFBTSxTQUFTLE1BQU0sTUFBTSxLQUFLLENBQUM7QUFDakMsU0FBTyxPQUFPLFNBQVMsR0FBRyxLQUFLLENBQUMsTUFBTSxTQUFTLEdBQUcsS0FBSyxDQUFDLE1BQU0sU0FBUyxHQUFJO0FBQzdFO0FBRUEsU0FBUyxrQkFBa0IsT0FBd0IsT0FBYTtBQUM5RCxTQUFPLE1BQU0sZUFBZSxLQUFLLENBQUMsV0FBVyxPQUFPLFVBQVUsS0FBSyxNQUFNO0FBQzNFOzs7QUM3cEJPLElBQU0sYUFBYSxpQkFDdkIsT0FBTztFQUNOLElBQUk7RUFDSixPQUFPO0VBQ1AsU0FBUztFQUNULGFBQWEsaUJBQUUsUUFBTztFQUN0QixVQUFVLGlCQUFFLFFBQU87RUFDbkIsTUFBTSxpQkFBRSxNQUFNLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHLENBQUMsRUFBRSxJQUFJLEdBQUc7RUFDeEQsV0FBVztFQUNYLFdBQVc7RUFDWCxXQUFXO0VBQ1gsWUFBWSxnQkFBZ0IsU0FBUTtDQUNyQyxFQUNBLE9BQU07QUFFRixJQUFNLHVCQUF1QixpQkFDakMsTUFBTSxVQUFVLEVBQ2hCLElBQUksR0FBTSxFQUNWLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxNQUFNLG9CQUFJLElBQUc7QUFDbkIsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLE1BQU0sUUFBTyxHQUFJO0FBQzNDLFFBQUksSUFBSSxJQUFJLEtBQUssRUFBRSxHQUFHO0FBQ3BCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLE9BQU8sSUFBSTtPQUNuQjtJQUNIO0FBQ0EsUUFBSSxJQUFJLEtBQUssRUFBRTtFQUNqQjtBQUNGLENBQUM7OztBQ3RCSSxJQUFNLDJCQUEyQixpQkFBRSxLQUFLO0VBQzdDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLHNCQUFzQixpQkFDaEMsT0FBTztFQUNOLElBQUk7RUFDSixNQUFNO0VBQ04sYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDbEQsWUFBWSx5QkFBeUIsU0FBUTtFQUM3QyxTQUFTO0VBQ1QsUUFBUSxpQkFBRSxNQUFNLHFCQUFxQixFQUFFLElBQUksR0FBSztFQUNoRCxXQUFXO0VBQ1gsV0FBVztDQUNaLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxVQUFVLFlBQVc7QUFDakMsUUFBTSxNQUFNLG9CQUFJLElBQUc7QUFDbkIsUUFBTSxPQUFPLG9CQUFJLElBQUc7QUFDcEIsUUFBTSxTQUFTLG9CQUFJLElBQUc7QUFDdEIsYUFBVyxDQUFDLE9BQU8sS0FBSyxLQUFLLFNBQVMsT0FBTyxRQUFPLEdBQUk7QUFDdEQsUUFBSSxJQUFJLElBQUksTUFBTSxFQUFFLEdBQUc7QUFDckIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsVUFBVSxPQUFPLElBQUk7T0FDN0I7SUFDSDtBQUNBLFFBQUksS0FBSyxJQUFJLE1BQU0sU0FBUyxHQUFHO0FBQzdCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFVBQVUsT0FBTyxXQUFXO09BQ3BDO0lBQ0g7QUFDQSxRQUFJLE9BQU8sSUFBSSxNQUFNLFNBQVMsR0FBRztBQUMvQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxVQUFVLE9BQU8sV0FBVztPQUNwQztJQUNIO0FBQ0EsUUFBSSxJQUFJLE1BQU0sRUFBRTtBQUNoQixTQUFLLElBQUksTUFBTSxTQUFTO0FBQ3hCLFdBQU8sSUFBSSxNQUFNLFNBQVM7RUFDNUI7QUFDRixDQUFDO0FBRUgsSUFBTSwwQkFBMEIsaUJBQUUsT0FBTztFQUN2QyxtQkFBbUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQy9DLHNCQUFzQixpQkFBRSxRQUFPO0NBQ2hDO0FBRU0sSUFBTSw4QkFBOEIsaUJBQUUsbUJBQW1CLFFBQVE7RUFDdEUsd0JBQXdCLE9BQU87SUFDN0IsTUFBTSxpQkFBRSxRQUFRLFdBQVc7SUFDM0IsT0FBTztHQUNSO0VBQ0Qsd0JBQXdCLE9BQU87SUFDN0IsTUFBTSxpQkFBRSxRQUFRLGVBQWU7SUFDL0IsT0FBTztHQUNSO0VBQ0Qsd0JBQXdCLE9BQU87SUFDN0IsTUFBTSxpQkFBRSxRQUFRLGNBQWM7SUFDOUIsU0FBUztJQUNULFdBQVc7SUFDWCxTQUFTO0dBQ1Y7RUFDRCx3QkFBd0IsT0FBTztJQUM3QixNQUFNLGlCQUFFLFFBQVEsZUFBZTtJQUMvQixTQUFTO0lBQ1QsZUFBZTtJQUNmLGFBQWE7R0FDZDtFQUNELHdCQUF3QixPQUFPO0lBQzdCLE1BQU0saUJBQUUsUUFBUSxpQkFBaUI7SUFDakMsU0FBUztJQUNULGNBQWMsaUJBQUUsUUFBTztJQUN2QixZQUFZLGlCQUFFLFFBQU87SUFDckIsbUJBQW1CLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVztHQUNoRDtFQUNELHdCQUF3QixPQUFPO0lBQzdCLE1BQU0saUJBQUUsUUFBUSxxQkFBcUI7SUFDckMsU0FBUztJQUNULFdBQVc7SUFDWCxTQUFTO0dBQ1Y7RUFDRCx3QkFBd0IsT0FBTztJQUM3QixNQUFNLGlCQUFFLFFBQVEsY0FBYztJQUM5QixTQUFTO0lBQ1QsV0FBVztJQUNYLFNBQVM7SUFDVCxVQUFVO0lBQ1YsUUFBUTtJQUNSLFVBQVUsaUJBQUUsS0FBSztNQUNmO01BQ0E7TUFDQTtNQUNBO01BQ0E7TUFDQTtLQUNEO0lBQ0Qsd0JBQXdCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVztHQUNyRDtFQUNELHdCQUF3QixPQUFPO0lBQzdCLE1BQU0saUJBQUUsUUFBUSxlQUFlO0lBQy9CLE9BQU87R0FDUjtDQUNGO0FBRU0sSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixJQUFJO0VBQ0osYUFBYTtFQUNiLFdBQVc7RUFDWCxnQkFBZ0I7RUFDaEIsZ0JBQWdCO0VBQ2hCLGVBQWUsaUJBQ1osTUFDQyxpQkFDRyxPQUFPO0lBQ04sUUFBUTtJQUNSLFVBQVU7R0FDWCxFQUNBLE9BQU0sQ0FBRSxFQUVaLElBQUksR0FBUztFQUNoQixPQUFPLGlCQUFFLE1BQU0sMkJBQTJCLEVBQUUsSUFBSSxHQUFLO0VBQ3JELFFBQVEsaUJBQUUsS0FBSyxDQUFDLFdBQVcsV0FBVyxXQUFXLENBQUM7RUFDbEQsZUFBZSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVc7RUFDM0MsWUFBWSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVc7RUFDeEMsY0FBYztFQUNkLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixNQUFJLEtBQUssYUFBYSxLQUFLLGFBQWE7QUFDdEMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsV0FBVztLQUNuQjtFQUNIO0FBQ0EsTUFBSSxLQUFLLGVBQWUsWUFBWSxLQUFLLFdBQVc7QUFDbEQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsa0JBQWtCLFNBQVM7S0FDbkM7RUFDSDtBQUNBLE1BQUksS0FBSyxlQUFlLFlBQVksS0FBSyxhQUFhO0FBQ3BELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGtCQUFrQixTQUFTO0tBQ25DO0VBQ0g7QUFDQSxNQUFJLEtBQUssZUFBZSxPQUFPLEtBQUssZUFBZSxJQUFJO0FBQ3JELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGtCQUFrQixJQUFJO0tBQzlCO0VBQ0g7QUFDQSxNQUFJLEtBQUssY0FBYyxXQUFXLEtBQUssWUFBWTtBQUNqRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxRQUFNLGNBQWMsb0JBQUksSUFBRztBQUMzQixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssS0FBSyxjQUFjLFFBQU8sR0FBSTtBQUM1RCxRQUFJLFlBQVksSUFBSSxTQUFTLE1BQU0sR0FBRztBQUNwQyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxRQUFRO09BQ3hDO0lBQ0g7QUFDQSxnQkFBWSxJQUFJLFNBQVMsTUFBTTtFQUNqQztBQUNBLE1BQUksS0FBSyxnQkFBZ0IsS0FBSyxZQUFZO0FBQ3hDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLGVBQWU7S0FDdkI7RUFDSDtBQUNBLE1BQUksS0FBSyxXQUFXLGVBQWUsS0FBSyxrQkFBa0IsS0FBSyxZQUFZO0FBQ3pFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFFBQVE7S0FDaEI7RUFDSDtBQUNGLENBQUM7OztBQ3BNSCxJQUFNLGdCQUFnQixpQkFBRSxNQUFNLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHLENBQUMsRUFBRSxJQUFJLEdBQUc7QUFDeEUsSUFBTSxhQUFhLGlCQUFFLE1BQU0saUJBQUUsT0FBTSxFQUFHLEtBQUksRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUcsQ0FBQyxFQUFFLElBQUksR0FBRztBQUNyRSxJQUFNLHVCQUF1QixpQkFDMUIsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksR0FBRyxFQUNQLE1BQU0sK0JBQStCLEVBQ3JDLE1BQUs7QUFFRCxJQUFNLHFCQUFxQixpQkFDL0IsT0FBTztFQUNOLElBQUk7RUFDSixNQUFNO0VBQ04sV0FBVyxpQkFBRSxNQUFNLG9CQUFvQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztDQUN4RCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLFFBQU0sT0FBTyxvQkFBSSxJQUFHO0FBQ3BCLGFBQVcsQ0FBQyxPQUFPLEdBQUcsS0FBSyxTQUFTLFVBQVUsUUFBTyxHQUFJO0FBQ3ZELFFBQUksS0FBSyxJQUFJLEdBQUcsR0FBRztBQUNqQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxhQUFhLEtBQUs7T0FDMUI7SUFDSDtBQUNBLFNBQUssSUFBSSxHQUFHO0VBQ2Q7QUFDRixDQUFDO0FBRUksSUFBTSxxQkFBcUIsaUJBQy9CLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULE1BQU07RUFDTixNQUFNLFdBQVcsU0FBUTtFQUN6QixTQUFTO0VBQ1QsYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDbEQsTUFBTSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxFQUFFLEVBQUUsU0FBUTtFQUNqQyxZQUFZLGlCQUFFLE9BQU0sRUFBRyxJQUFJLEVBQUUsRUFBRSxTQUFRO0VBQ3ZDLE1BQU07RUFDTixPQUFPO0VBQ1AsVUFBVTtFQUNWLFdBQVc7RUFDWCxVQUFVO0VBQ1YsV0FBVztFQUNYLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEMsRUFDQSxPQUFNO0FBRUYsSUFBTSxzQkFBc0IsaUJBQ2hDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixJQUFJO0VBQ0osU0FBUztFQUNULFNBQVM7RUFDVCxZQUFZO0VBQ1osT0FBTztFQUNQLE1BQU0sV0FBVyxTQUFRO0VBQ3pCLFNBQVM7RUFDVCxVQUFVLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxHQUFHLEVBQUUsU0FBUTtFQUM3QyxpQkFBaUI7RUFDakIsZ0JBQWdCLGlCQUFFLE1BQU0sc0JBQXNCLEVBQUUsSUFBSSxHQUFLO0VBQ3pELFlBQVksaUJBQUUsTUFBTSxxQkFBcUIsRUFBRSxJQUFJLEdBQUs7RUFDcEQsWUFBWSxpQkFBRSxNQUFNLHNCQUFzQixFQUFFLElBQUksR0FBSztFQUNyRCxxQkFBcUIsaUJBQUUsTUFBTSx3QkFBd0IsRUFBRSxJQUFJLEdBQU07RUFDakUsT0FBTztFQUNQLE1BQU07RUFDTixVQUFVLGlCQUFFLFFBQU87RUFDbkIsYUFBYSxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksR0FBRyxFQUFFLFNBQVE7RUFDaEQsT0FBTyxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRyxFQUFFLFNBQVE7RUFDakQsU0FBUyxpQkFBRSxPQUFNLEVBQUcsS0FBSSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksSUFBSyxFQUFFLFNBQVE7RUFDckQscUJBQXFCLGlCQUFFLFFBQU87RUFDOUIsV0FBVyxnQkFBZ0IsU0FBUTtFQUNuQyxzQkFBc0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxLQUFNLEVBQUUsU0FBUTtFQUN0RSxlQUFlLGdCQUFnQixTQUFRO0VBQ3ZDLGdCQUFnQixnQkFBZ0IsU0FBUTtFQUN4QyxnQkFBZ0IsaUJBQUUsTUFBTSxZQUFZLEVBQUUsSUFBSSxHQUFLO0VBQy9DLGVBQWUsaUJBQUUsTUFBTSxrQkFBa0IsRUFBRSxJQUFJLEdBQUs7RUFDcEQsZUFBZSxpQkFBRSxNQUFNLGtCQUFrQixFQUFFLElBQUksR0FBRztFQUNsRCxVQUFVO0VBQ1YsV0FBVztFQUNYLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEMsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixRQUFNLFdBQVcsb0JBQUksSUFBRztBQUN4QixRQUFNLGFBQWEsb0JBQUksSUFBRztBQUMxQixRQUFNLG1CQUFtQixvQkFBSSxJQUFHO0FBQ2hDLFFBQU0scUJBQXFCLG9CQUFJLElBQUc7QUFDbEMsYUFBVyxDQUFDLE9BQU8sS0FBSyxLQUFLO0lBQzNCLEdBQUcsS0FBSztJQUNSLEdBQUcsS0FBSztJQUNSLFFBQU8sR0FBSTtBQUNYLFFBQUksU0FBUyxJQUFJLE1BQU0sT0FBTyxLQUFLLFdBQVcsSUFBSSxNQUFNLFNBQVMsR0FBRztBQUNsRSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxrQkFBa0IsS0FBSztPQUMvQjtJQUNIO0FBQ0EsYUFBUyxJQUFJLE1BQU0sT0FBTztBQUMxQixlQUFXLElBQUksTUFBTSxTQUFTO0FBQzlCLFFBQUksUUFBUSxLQUFLLGVBQWUsUUFBUTtBQUN0Qyx1QkFBaUIsSUFBSSxNQUFNLE9BQU87QUFDbEMseUJBQW1CLElBQUksTUFBTSxTQUFTO0lBQ3hDO0VBQ0Y7QUFFQSxRQUFNLHNCQUFzQixvQkFBSSxJQUFHO0FBQ25DLFFBQU0scUJBQXFCLG9CQUFJLElBQUc7QUFDbEMsYUFBVyxDQUFDLE9BQU8sVUFBVSxLQUFLLEtBQUssV0FBVyxRQUFPLEdBQUk7QUFDM0QsUUFDRSxvQkFBb0IsSUFBSSxXQUFXLEVBQUUsS0FDckMsbUJBQW1CLElBQUksV0FBVyxTQUFTLEtBQzNDLGlCQUFpQixJQUFJLFdBQVcsRUFBRSxLQUNsQyxtQkFBbUIsSUFBSSxXQUFXLFNBQVMsR0FDM0M7QUFDQSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FDRTtRQUNGLE1BQU0sQ0FBQyxjQUFjLEtBQUs7T0FDM0I7SUFDSDtBQUNBLHdCQUFvQixJQUFJLFdBQVcsSUFBSSxVQUFVO0FBQ2pELHVCQUFtQixJQUFJLFdBQVcsU0FBUztFQUM3QztBQUNBLFFBQU0sZUFBZSxvQkFBSSxJQUFHO0FBQzVCLGFBQVcsQ0FBQyxPQUFPLEtBQUssS0FBSyxLQUFLLFdBQVcsUUFBTyxHQUFJO0FBQ3RELFVBQU0sYUFBYSxvQkFBb0IsSUFBSSxNQUFNLE9BQU87QUFDeEQsVUFBTSxvQkFDSixZQUFZLGNBQWMsTUFBTSxhQUNoQyw0QkFBNEIsWUFBWSxNQUFNLEtBQUs7QUFDckQsUUFBSSxhQUFhLElBQUksTUFBTSxPQUFPLEtBQUssQ0FBQyxtQkFBbUI7QUFDekQsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsY0FBYyxLQUFLO09BQzNCO0lBQ0g7QUFDQSxpQkFBYSxJQUFJLE1BQU0sT0FBTztFQUNoQztBQUNBLGFBQVcsQ0FBQyxPQUFPLFVBQVUsS0FBSyxLQUFLLFdBQVcsUUFBTyxHQUFJO0FBQzNELFVBQU0sU0FBUyxLQUFLLFdBQVcsS0FBSyxDQUFDLFVBQVUsTUFBTSxZQUFZLFdBQVcsRUFBRTtBQUM5RSxRQUNFLFdBQVcsYUFDVixXQUFXLFVBQWEsQ0FBQyw0QkFBNEIsWUFBWSxPQUFPLEtBQUssSUFDOUU7QUFDQSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxjQUFjLEtBQUs7T0FDM0I7SUFDSDtFQUNGO0FBRUEsUUFBTSxzQkFBc0Isb0JBQUksSUFBSTtJQUNsQyxHQUFHLEtBQUssZUFBZSxJQUFJLENBQUMsRUFBRSxRQUFPLE1BQU8sT0FBTztJQUNuRCxHQUFHLEtBQUssV0FBVyxJQUFJLENBQUMsRUFBRSxHQUFFLE1BQU8sRUFBRTtHQUN0QztBQUNELFFBQU0sdUJBQXVCLG9CQUFJLElBQUk7SUFDbkMsR0FBRyxLQUFLLGVBQWUsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7SUFDdkQsR0FBRyxLQUFLLFdBQVcsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7R0FDcEQ7QUFDRCxRQUFNLGNBQWMsb0JBQUksSUFBRztBQUMzQixRQUFNLGVBQWUsb0JBQUksSUFBRztBQUM1QixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssS0FBSyxvQkFBb0IsUUFBTyxHQUFJO0FBQ2xFLFFBQ0UsWUFBWSxJQUFJLFNBQVMsV0FBVyxFQUFFLEtBQ3RDLGFBQWEsSUFBSSxTQUFTLFdBQVcsU0FBUyxLQUM5QyxvQkFBb0IsSUFBSSxTQUFTLFdBQVcsRUFBRSxLQUM5QyxxQkFBcUIsSUFBSSxTQUFTLFdBQVcsU0FBUyxHQUN0RDtBQUNBLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUNFO1FBQ0YsTUFBTSxDQUFDLHVCQUF1QixLQUFLO09BQ3BDO0lBQ0g7QUFDQSxnQkFBWSxJQUFJLFNBQVMsV0FBVyxFQUFFO0FBQ3RDLGlCQUFhLElBQUksU0FBUyxXQUFXLFNBQVM7RUFDaEQ7QUFFQSxRQUFNLGlCQUFpQixvQkFBSSxJQUFHO0FBQzlCLGFBQVcsQ0FBQyxPQUFPLGFBQWEsS0FBSyxLQUFLLGVBQWUsUUFBTyxHQUFJO0FBQ2xFLFFBQUksa0JBQWtCLEtBQUssTUFBTSxlQUFlLElBQUksYUFBYSxHQUFHO0FBQ2xFLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUNFO1FBQ0YsTUFBTSxDQUFDLGtCQUFrQixLQUFLO09BQy9CO0lBQ0g7QUFDQSxtQkFBZSxJQUFJLGFBQWE7RUFDbEM7QUFDQSxRQUFNLGdCQUFnQixvQkFBSSxJQUFHO0FBQzdCLGFBQVcsQ0FBQyxPQUFPLFlBQVksS0FBSyxLQUFLLGNBQWMsUUFBTyxHQUFJO0FBQ2hFLFFBQUksY0FBYyxJQUFJLFlBQVksR0FBRztBQUNuQyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsS0FBSztPQUM5QjtJQUNIO0FBQ0Esa0JBQWMsSUFBSSxZQUFZO0VBQ2hDO0FBRUEsYUFBVyxDQUFDLGdCQUFnQixNQUFNLEtBQUs7SUFDckMsQ0FBQyxrQkFBa0IsS0FBSyxjQUFjO0lBQ3RDLENBQUMsY0FBYyxLQUFLLFVBQVU7S0FDcEI7QUFDVixlQUFXLENBQUMsWUFBWSxNQUFNLEtBQUssT0FBTyxRQUFPLEdBQUk7QUFDbkQsaUJBQVcsYUFBYSxtQkFBbUIsT0FBTyxLQUFLLEdBQUc7QUFDeEQsY0FBTSxRQUNKLFVBQVUsU0FBUyxtQkFDZixlQUFlLElBQUksVUFBVSxNQUFNLElBQ25DLGNBQWMsSUFBSSxVQUFVLFlBQVk7QUFDOUMsWUFBSSxDQUFDLE9BQU87QUFDVixrQkFBUSxTQUFTO1lBQ2YsTUFBTTtZQUNOLFNBQVM7WUFDVCxNQUFNLENBQUMsZ0JBQWdCLFlBQVksT0FBTztXQUMzQztRQUNIO01BQ0Y7SUFDRjtFQUNGO0FBRUEsUUFBTSxhQUFhLG9CQUFJLElBQUk7SUFDekIsR0FBRyxLQUFLLGVBQWUsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7SUFDdkQsR0FBRyxLQUFLLFdBQVcsSUFBSSxDQUFDLEVBQUUsVUFBUyxNQUFPLFNBQVM7R0FDcEQ7QUFDRCxRQUFNLGNBQWMsb0JBQUksSUFBRztBQUMzQixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssS0FBSyxjQUFjLFFBQU8sR0FBSTtBQUM1RCxRQUFJLFlBQVksSUFBSSxTQUFTLEVBQUUsR0FBRztBQUNoQyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxJQUFJO09BQ3BDO0lBQ0g7QUFDQSxnQkFBWSxJQUFJLFNBQVMsRUFBRTtBQUMzQixRQUFJLFNBQVMsVUFBVSxLQUFLLENBQUMsUUFBUSxDQUFDLFdBQVcsSUFBSSxHQUFHLENBQUMsR0FBRztBQUMxRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxXQUFXO09BQzNDO0lBQ0g7RUFDRjtBQUNGLENBQUM7QUFFSSxJQUFNLG9CQUFvQjtBQUVqQyxTQUFTLG1CQUNQLE9BQXVCO0FBS3ZCLE1BQUksTUFBTSxVQUFVO0FBQVcsV0FBTyxDQUFBO0FBQ3RDLFFBQU0sVUFDSixNQUFNLFFBQVEsZ0JBQWdCLFdBQzFCLENBQUMsTUFBTSxRQUFRLEtBQUssSUFDcEIsTUFBTSxRQUFRLFNBQVMsSUFBSSxDQUFDLEVBQUUsT0FBTyxPQUFNLE1BQU8sTUFBTTtBQUM5RCxRQUFNLGFBR0EsQ0FBQTtBQUNOLGFBQVcsVUFBVSxTQUFTO0FBQzVCLFFBQUksT0FBTyxTQUFTO0FBQWtCLGlCQUFXLEtBQUssTUFBTTtBQUM1RCxRQUFJLE9BQU8sU0FBUztBQUF3QixpQkFBVyxLQUFLLE1BQU07RUFDcEU7QUFDQSxTQUFPO0FBQ1Q7QUFFTyxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLGNBQWM7RUFDZCxnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksRUFBRSxFQUNOLE1BQU0sa0JBQWtCO0VBQzNCLHVCQUF1QixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksSUFBSztFQUN4RCxtQkFBbUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLElBQUs7RUFDcEQsc0JBQXNCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxLQUFNO0VBQ3hELGtCQUFrQixpQkFBRSxRQUFRLEtBQUs7Q0FDbEMsRUFDQSxPQUFNOzs7QUNwVEYsSUFBTSx5QkFBeUIsaUJBQUUsUUFBUSxvQkFBb0I7QUFDN0QsSUFBTSw4QkFBOEI7QUFDcEMsSUFBTSwwQkFBMEIsaUJBQUUsUUFBUSwyQkFBMkI7QUFDckUsSUFBTSwyQkFBMkI7QUFFakMsSUFBTSw2QkFBNkIsY0FBYyxPQUN0RCxDQUFDLFNBQVMsS0FBSyxTQUFTLGdCQUN4QixFQUFFLE9BQU8scURBQW9ELENBQUU7QUFHMUQsSUFBTSx3QkFBd0IsaUJBQ2xDLE9BQU87RUFDTixPQUFPO0VBQ1AsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQUVGLElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxPQUFPLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUcsR0FBRyxxQkFBcUI7Q0FDcEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFNBQVMsWUFBVztBQUNoQyxNQUFJLE9BQU8sS0FBSyxRQUFRLE9BQU8sRUFBRSxTQUFTLEtBQVE7QUFDaEQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsU0FBUztLQUNqQjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sMkJBQTJCLGlCQUNyQyxPQUFPO0VBQ04sUUFBUTtFQUNSLFNBQVM7RUFDVCxJQUFJO0VBQ0osZUFBZTtFQUNmLHNCQUFzQjtFQUN0QixtQkFBbUI7RUFDbkIsU0FBUztFQUNULGVBQWUsaUJBQ1osTUFBTSwwQkFBMEIsRUFDaEMsSUFBSSx3QkFBd0IsRUFDNUIsUUFBUSxDQUFBLENBQUU7RUFDYixVQUFVO0VBQ1Ysa0JBQWtCO0VBQ2xCLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFVBQVUsWUFBVztBQUNqQyxNQUFJLFNBQVMsa0JBQWtCLHdCQUF3QjtBQUNyRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxNQUFJLFNBQVMseUJBQXlCLCtCQUErQjtBQUNuRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxzQkFBc0I7S0FDOUI7RUFDSDtBQUVBLE1BQUksU0FBUyxRQUFRLFNBQVMsZ0JBQWdCO0FBQzVDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFdBQVcsTUFBTTtLQUN6QjtFQUNILE9BQU87QUFDTCxRQUFJLFNBQVMsUUFBUSxVQUFVLFVBQVU7QUFDdkMsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsV0FBVyxPQUFPO09BQzFCO0lBQ0g7QUFDQSxRQUFJLFNBQVMsUUFBUSxlQUFlLFNBQVMsbUJBQW1CO0FBQzlELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFdBQVcsWUFBWTtPQUMvQjtJQUNIO0FBQ0EsUUFBSSxTQUFTLFFBQVEsZUFBZSxJQUFJLFlBQVksU0FBUyxJQUFJO0FBQy9ELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFdBQVcsa0JBQWtCLE9BQU8sU0FBUztPQUNyRDtJQUNIO0VBQ0Y7QUFFQSxRQUFNLFVBQVUsb0JBQUksSUFBSSxDQUFDLFNBQVMsUUFBUSxFQUFFLENBQUM7QUFDN0MsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLFNBQVMsY0FBYyxRQUFPLEdBQUk7QUFDNUQsUUFBSSxRQUFRLElBQUksS0FBSyxFQUFFLEdBQUc7QUFDeEIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsaUJBQWlCLE9BQU8sSUFBSTtPQUNwQztJQUNIO0FBQ0EsWUFBUSxJQUFJLEtBQUssRUFBRTtBQUNuQixRQUFJLEtBQUssZUFBZSxTQUFTLG1CQUFtQjtBQUNsRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxZQUFZO09BQzVDO0lBQ0g7QUFDQSxRQUFJLEtBQUssZUFBZSxJQUFJLFlBQVksU0FBUyxJQUFJO0FBQ25ELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLGlCQUFpQixPQUFPLGtCQUFrQixPQUFPLFNBQVM7T0FDbEU7SUFDSDtBQUNBLFFBQUksS0FBSyxlQUFlLElBQUksa0JBQWtCLFNBQVMsZUFBZTtBQUNwRSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxrQkFBa0IsT0FBTyxlQUFlO09BQ3hFO0lBQ0g7QUFDQSxRQUFJLEtBQUssVUFBVSxZQUFZLEtBQUssVUFBVSxXQUFXO0FBQ3ZELGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLGlCQUFpQixPQUFPLE9BQU87T0FDdkM7SUFDSDtFQUNGO0FBRUEsUUFBTSxNQUFNLFNBQVMsaUJBQWlCO0FBQ3RDLE1BQ0UsSUFBSSxhQUFhLFVBQ2pCLElBQUksbUJBQW1CLFVBQ3ZCLElBQUksYUFBYSxTQUFTLFVBQzFCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsb0JBQW9CLEtBQUs7S0FDakM7RUFDSDtBQUNBLE1BQ0UsSUFBSSxZQUFZLFNBQVMsTUFDekIsSUFBSSxhQUFhLFNBQVMsTUFDMUIsSUFBSSxrQkFBa0IsU0FBUyxpQkFDL0IsSUFBSSxlQUFlLFNBQVMsbUJBQzVCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsb0JBQW9CLEtBQUs7S0FDakM7RUFDSDtBQUNGLENBQUM7OztBQzlLSSxJQUFNLG1CQUFtQixPQUFPLE9BQU87RUFDNUM7RUFDQTtFQUNBO0NBQ1E7QUFDSCxJQUFNLGlCQUFpQjtBQUN2QixJQUFNLGlCQUFpQixpQkFBaUI7QUFFeEMsSUFBTSxpQkFBaUIsaUJBQUUsS0FBSyxnQkFBZ0I7QUFDOUMsSUFBTSxrQkFBa0IsaUJBQzVCLE1BQU0sY0FBYyxFQUNwQixJQUFJLGNBQWMsRUFDbEIsSUFBSSxjQUFjLEVBQ2xCLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsTUFBSSxJQUFJLElBQUksTUFBTSxFQUFFLFNBQVMsT0FBTyxRQUFRO0FBQzFDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7OztBQ2FJLElBQU0sNEJBQTRCO0FBQ2xDLElBQU0sNEJBQTRCO0FBRWxDLElBQU0sdUJBQXVCLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFNBQVMsUUFBUSxZQUFZLENBQUM7QUFDNUUsSUFBTSxzQkFBc0IsaUJBQUUsS0FBSyxDQUFDLFVBQVUsYUFBYSxXQUFXLE9BQU8sQ0FBQztBQUVyRixJQUFNLHlCQUF5QixpQkFDNUIsT0FBTztFQUNOLElBQUk7RUFDSixTQUFTO0VBQ1QsZ0JBQWdCO0VBQ2hCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsZ0JBQWdCLG1CQUFtQixTQUFRO0VBQzNDLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLHFCQUFxQixpQkFDL0IsbUJBQW1CLGNBQWM7RUFDaEMsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLE9BQU87SUFDN0IsVUFBVTtHQUNYO0VBQ0QsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLE9BQU87SUFDN0IsVUFBVTtHQUNYO0VBQ0QsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLE1BQU07SUFDNUIsVUFBVTtHQUNYO0VBQ0QsdUJBQXVCLE9BQU87SUFDNUIsWUFBWSxpQkFBRSxRQUFRLFlBQVk7SUFDbEMsVUFBVTtHQUNYO0NBQ0YsRUFDQSxZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLE1BQUksT0FBTyxtQkFBbUIsR0FBRztBQUMvQixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxnQkFBZ0I7S0FDeEI7RUFDSDtBQUNBLE1BQUksT0FBTyxjQUFjLFdBQVcsT0FBTyxtQkFBbUIsUUFBVztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxnQkFBZ0I7S0FDeEI7RUFDSDtBQUNBLE1BQUksT0FBTyxlQUFlLFdBQVcsT0FBTyxhQUFhLE9BQU8sU0FBUztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxVQUFVO0tBQ2xCO0VBQ0g7QUFDRixDQUFDO0FBRUgsSUFBTSxpQ0FBaUMsaUJBQ3BDLE9BQU87RUFDTixJQUFJO0VBQ0osU0FBUztFQUNULGVBQWU7RUFDZixjQUFjO0VBQ2QsZ0JBQWdCLDJCQUEyQixTQUFRO0VBQ25ELFFBQVE7RUFDUixXQUFXO0VBQ1gsWUFBWSxnQkFBZ0IsU0FBUTtFQUNwQyxXQUFXLGdCQUFnQixTQUFRO0NBQ3BDLEVBQ0EsT0FBTTtBQUVULFNBQVMsc0JBQ1AsUUFDQSxTQUF3QjtBQUV4QixNQUNFLE9BQU8sbUJBQW1CLFdBQ3pCLE9BQU8sZUFBZSxJQUFJLFlBQVksT0FBTyxXQUM1QyxPQUFPLGVBQWUsSUFBSSxrQkFBa0IsT0FBTyxpQkFDbkQsT0FBTyxlQUFlLElBQUksZUFBZSxrQkFDekMsT0FBTyxlQUFlLElBQUksYUFBYSxPQUFPLEtBQ2hEO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsa0JBQWtCLEtBQUs7S0FDL0I7RUFDSDtBQUNGO0FBR08sSUFBTSwyQkFDWCwrQkFBK0IsWUFBWSxxQkFBcUI7QUFHM0QsSUFBTSxxQkFBcUIsK0JBQy9CLE9BQU8sRUFBRSxXQUFXLG1CQUFrQixDQUFFLEVBQ3hDLFlBQVkscUJBQXFCO0FBRTdCLElBQU0sZ0NBQWdDLGlCQUFFLEtBQUs7RUFDbEQ7RUFDQTtDQUNEO0FBRUQsSUFBTSx5Q0FBeUMsaUJBQzVDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixNQUFNO0VBQ04scUJBQXFCLGlCQUNsQixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsYUFBYTtFQUNiLGNBQWM7RUFDZCx1QkFBdUI7RUFDdkIsMEJBQTBCO0VBQzFCLCtCQUErQjtDQUNoQyxFQUNBLE9BQU07QUFFVCxTQUFTLDRCQUNQLGFBQ0EsU0FBd0I7QUFFeEIsTUFDRSxZQUFZLGdDQUFnQyxZQUFZLDBCQUN4RDtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLCtCQUErQjtLQUN2QztFQUNIO0FBQ0Y7QUFFTyxJQUFNLG1DQUNYLHVDQUF1QyxZQUFZLDJCQUEyQjtBQUV6RSxJQUFNLDRCQUE0Qix1Q0FDdEMsT0FBTyxFQUFFLGVBQWUsbUJBQWtCLENBQUUsRUFDNUMsT0FBTSxFQUNOLFlBQVksMkJBQTJCO0FBRW5DLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUztFQUNULFVBQVU7RUFDViwwQkFBMEI7RUFDMUIsV0FBVztFQUNYLHFCQUFxQiwwQkFBMEIsU0FBUTtFQUN2RCw0QkFBNEIsbUJBQW1CLFNBQVE7Q0FDeEQsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixNQUNFLE1BQU0sd0JBQXdCLFVBQzlCLE1BQU0sb0JBQW9CLHdCQUF3QixNQUFNLDBCQUN4RDtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLDBCQUEwQjtLQUNsQztFQUNIO0FBQ0YsQ0FBQztBQUVILElBQU0sNEJBQTRCLGlCQUMvQixPQUFPO0VBQ04sU0FBUztFQUNULE9BQU8saUJBQUUsS0FBSyxDQUFDLFdBQVcsVUFBVSxDQUFDO0VBQ3JDLG1CQUFtQjtFQUNuQixvQkFBb0I7RUFDcEIsb0JBQW9CO0VBQ3BCLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFlBQVksZ0JBQWdCLFNBQVE7Q0FDckMsRUFDQSxPQUFNO0FBRUYsSUFBTSx3QkFBd0IsaUJBQ2xDLG1CQUFtQixjQUFjO0VBQ2hDLDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxPQUFPO0lBQzdCLFVBQVU7R0FDWDtFQUNELDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxPQUFPO0lBQzdCLFVBQVU7R0FDWDtFQUNELDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxNQUFNO0lBQzVCLFVBQVU7R0FDWDtFQUNELDBCQUEwQixPQUFPO0lBQy9CLFlBQVksaUJBQUUsUUFBUSxZQUFZO0lBQ2xDLFVBQVU7R0FDWDtDQUNGLEVBQ0EsWUFBWSxDQUFDLFdBQVcsWUFBVztBQUNsQyxNQUFJLFVBQVUscUJBQXFCLFVBQVUsb0JBQW9CO0FBQy9ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLG1CQUFtQjtLQUMzQjtFQUNIO0FBQ0EsTUFBSSxVQUFVLGVBQWUsV0FBVyxVQUFVLGFBQWEsVUFBVSxTQUFTO0FBQ2hGLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVU7S0FDbEI7RUFDSDtBQUNBLE1BQUksVUFBVSxVQUFVLGNBQWMsVUFBVSxlQUFlLFFBQVc7QUFDeEUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsWUFBWTtLQUNwQjtFQUNIO0FBQ0EsTUFBSSxVQUFVLFVBQVUsYUFBYSxVQUFVLGVBQWUsUUFBVztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxZQUFZO0tBQ3BCO0VBQ0g7QUFDQSxNQUFJLFVBQVUsVUFBVSxjQUFjLFVBQVUsZUFBZSxRQUFXO0FBQ3hFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHVCQUF1QixpQkFBRSxtQkFBbUIsY0FBYztFQUNyRSxpQkFDRyxPQUFPO0lBQ04sWUFBWSxpQkFBRSxRQUFRLE9BQU87SUFDN0IsdUJBQXVCLG9CQUFvQixTQUFRO0lBQ25ELGdCQUFnQixpQkFDYixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7SUFDaEMsUUFBUTtHQUNULEVBQ0EsT0FBTTtFQUNULGlCQUNHLE9BQU87SUFDTixZQUFZLGlCQUFFLFFBQVEsT0FBTztJQUM3Qix3QkFBd0IscUJBQXFCLFNBQVE7SUFDckQsZ0JBQWdCLGlCQUNiLE9BQU0sRUFDTixJQUFJLHlCQUF5QixFQUM3QixJQUFJLHlCQUF5QjtJQUNoQyxRQUFRO0dBQ1QsRUFDQSxPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLFlBQVksaUJBQUUsUUFBUSxNQUFNO0lBQzVCLHdCQUF3QixxQkFBcUIsU0FBUTtJQUNyRCxnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0lBQ2hDLFFBQVE7R0FDVCxFQUNBLE9BQU07Q0FDVjtBQUVNLElBQU0sbUNBQW1DLGlCQUM3QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsZ0JBQWdCLGlCQUNiLE9BQU0sRUFDTixJQUFJLHlCQUF5QixFQUM3QixJQUFJLHlCQUF5QjtFQUNoQyw0QkFBNEIscUJBQXFCLFNBQVE7RUFDekQsUUFBUTtDQUNULEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxzQkFDSixNQUFNLCtCQUErQixPQUNqQyxJQUNBLE1BQU0sNkJBQTZCO0FBQ3pDLE1BQUksTUFBTSxPQUFPLG1CQUFtQixxQkFBcUI7QUFDdkQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQ0U7TUFDRixNQUFNLENBQUMsVUFBVSxnQkFBZ0I7S0FDbEM7RUFDSDtBQUNBLE1BQUksNEJBQTRCLE1BQU0sTUFBTSxNQUFNLE1BQU0sT0FBTyxhQUFhO0FBQzFFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVUsYUFBYTtLQUMvQjtFQUNIO0FBQ0YsQ0FBQztBQUVILElBQU0seUNBQXlDLGlCQUFFLE9BQU87RUFDdEQsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsZ0JBQWdCLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVyxFQUFHLElBQUkscUJBQXFCO0VBQ3hFLHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxxQ0FBcUM7RUFDNUMsc0JBQXNCLGlCQUNuQixPQUFNLEVBQ04sSUFBRyxFQUNILFlBQVcsRUFDWCxJQUFJLHNDQUFzQztDQUM5QztBQUVNLElBQU0saUNBQWlDLGlCQUMzQyxtQkFBbUIsU0FBUztFQUMzQix1Q0FDRyxPQUFPO0lBQ04sT0FBTyxpQkFBRSxRQUFRLE9BQU87SUFDeEIsZ0JBQWdCLGlCQUFFLFFBQVEsQ0FBQztJQUMzQixxQkFBcUIsaUJBQUUsUUFBUSxDQUFDO0lBQ2hDLHNCQUFzQixpQkFBRSxRQUFRLENBQUM7R0FDbEMsRUFDQSxPQUFNO0VBQ1QsdUNBQ0csT0FBTztJQUNOLE9BQU8saUJBQUUsUUFBUSxTQUFTO0lBQzFCLGdCQUFnQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVEsRUFBRyxJQUFJLHFCQUFxQjtJQUNyRSxnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSx3QkFBd0IsQ0FBQztJQUNoQyx5QkFBeUI7SUFDekIseUJBQXlCLGlCQUN0QixPQUFNLEVBQ04sSUFBRyxFQUNILFlBQVcsRUFDWCxJQUFJLG9DQUFvQztHQUM1QyxFQUNBLE9BQU07RUFDVCx1Q0FDRyxPQUFPO0lBQ04sT0FBTyxpQkFBRSxRQUFRLG1CQUFtQjtJQUNwQyxnQkFBZ0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxxQkFBcUI7SUFDckUsZ0JBQWdCLGlCQUNiLE9BQU0sRUFDTixJQUFHLEVBQ0gsWUFBVyxFQUNYLElBQUksd0JBQXdCLENBQUM7SUFDaEMseUJBQXlCO0lBQ3pCLHlCQUF5QixpQkFDdEIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSxvQ0FBb0M7R0FDNUMsRUFDQSxPQUFNO0NBQ1YsRUFDQSxZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLE1BQUksU0FBUyxVQUFVO0FBQVM7QUFDaEMsTUFDRSxTQUFTLFVBQVUsYUFDbkIsU0FBUyxtQkFBbUIsdUJBQzVCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsT0FBTztLQUNmO0VBQ0g7QUFDQSxNQUFJLFNBQVMsbUJBQW1CLFNBQVMsaUJBQWlCLEdBQUc7QUFDM0QsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsZ0JBQWdCO0tBQ3hCO0VBQ0g7QUFDQSxNQUNFLFNBQVMseUJBQ1QsU0FBUyxzQkFDUCxTQUFTLGlCQUFpQixtQ0FDNUI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxzQkFBc0I7S0FDOUI7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHNDQUFzQyxpQkFDaEQsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFFRixJQUFNLG1CQUFtQixpQkFDN0IsT0FBTztFQUNOLFNBQVM7RUFDVCxnQkFBZ0I7RUFDaEIsMEJBQTBCO0NBQzNCLEVBQ0EsT0FBTTtBQUVGLElBQU0sa0JBQWtCLGlCQUFFLEtBQUs7RUFDcEM7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRU0sSUFBTSx1Q0FBdUMsaUJBQUUsS0FBSztFQUN6RDtFQUNBO0NBQ0Q7QUFFTSxJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFVBQVU7RUFDVixpQkFBaUIsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXLEVBQUcsSUFBSSxPQUFPLGdCQUFnQjtFQUMzRSwyQkFBMkIsaUJBQUUsT0FBTSxFQUFHLFNBQVE7RUFDOUMsWUFBWTtDQUNiLEVBQ0EsT0FBTTs7O0FDN2FGLElBQU0sdUJBQXVCLGlCQUFFLE9BQU8sRUFBRSxRQUFRLGlCQUFFLFFBQVEsSUFBSSxFQUFDLENBQUUsRUFBRSxPQUFNO0FBQ3pFLElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPLEVBQUUsUUFBUSxpQkFBRSxLQUFLLENBQUMsU0FBUyxXQUFXLENBQUMsRUFBQyxDQUFFLEVBQ2pELE9BQU07QUFFRixJQUFNLDhCQUE4QjtBQUNwQyxJQUFNLGlDQUFpQztBQUN2QyxJQUFNLDZCQUE2QjtBQUNuQyxJQUFNLGdDQUFnQztBQUN0QyxJQUFNLDBCQUEwQjtBQUNoQyxJQUFNLGlDQUFpQztBQUN2QyxJQUFNLDZCQUE2QjtBQUcxQyxJQUFNLHFDQUFxQyxpQkFDeEMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSwyQkFBMkI7RUFDOUMsU0FBUztFQUNULFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLGlDQUFpQyxpQkFBRSxtQkFBbUIsWUFBWTtFQUM3RSxtQ0FDRyxPQUFPO0lBQ04sVUFBVSxpQkFBRSxRQUFRLFNBQVM7SUFDN0IsSUFBSTtHQUNMLEVBQ0EsT0FBTTtFQUNULG1DQUNHLE9BQU87SUFDTixVQUFVLGlCQUFFLFFBQVEsU0FBUztJQUM3QixJQUFJO0dBQ0wsRUFDQSxPQUFNO0NBQ1Y7QUFFRCxJQUFNLGlDQUFpQyxpQkFDcEMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksNkJBQTZCLEVBQ2pDLEtBQUssZUFBZSxFQUNwQixNQUFLO0FBRUYsU0FBVSx3QkFDZCxTQUF1RDtBQUV2RCxRQUFNLGdCQUFnQiwrQkFBK0IsTUFBTSxPQUFPO0FBQ2xFLFNBQU8sK0JBQStCLE1BQ3BDLE9BQU8sS0FBSyxjQUFjLGFBQWEsR0FBRyxNQUFNLEVBQUUsU0FBUyxXQUFXLENBQUM7QUFFM0U7QUFFQSxTQUFTLGlDQUNQLFFBQWU7QUFFZixNQUFJO0FBQ0YsVUFBTSxlQUFlLCtCQUErQixNQUFNLE1BQU07QUFDaEUsVUFBTSxPQUFPLElBQUksWUFBWSxTQUFTLEVBQUUsT0FBTyxLQUFJLENBQUUsRUFBRSxPQUNyRCxPQUFPLEtBQUssY0FBYyxXQUFXLENBQUM7QUFFeEMsVUFBTSxVQUFVLCtCQUErQixNQUFNLEtBQUssTUFBTSxJQUFJLENBQVk7QUFDaEYsUUFBSSx3QkFBd0IsT0FBTyxNQUFNLGNBQWM7QUFDckQsWUFBTSxJQUFJLFVBQVUsa0NBQWtDO0lBQ3hEO0FBQ0EsV0FBTztFQUNULFFBQVE7QUFDTixVQUFNLElBQUksVUFBVSw2QkFBNkI7RUFDbkQ7QUFDRjtBQUVNLFNBQVUsd0JBQ2QsUUFBYztBQUVkLFNBQU8saUNBQWlDLE1BQU07QUFDaEQ7QUFFTyxJQUFNLDBCQUEwQiwrQkFBK0IsWUFDcEUsQ0FBQyxRQUFRLFlBQVc7QUFDbEIsTUFBSTtBQUNGLHFDQUFpQyxNQUFNO0VBQ3pDLFFBQVE7QUFDTixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBR0ksSUFBTSx1QkFBdUIsaUJBQ2pDLE9BQU0sRUFDTixPQUFPLEVBQUUsRUFDVCxNQUFNLG9CQUFvQixnREFBZ0QsRUFDMUUsT0FBTyxDQUFDLFVBQVUsT0FBTyxLQUFLLE9BQU8sV0FBVyxFQUFFLFNBQVMsV0FBVyxNQUFNLE9BQU87RUFDbEYsT0FBTztDQUNSLEVBQ0EsTUFBSztBQUVELElBQU0seUJBQXlCLGlCQUNuQyxPQUFPO0VBQ04sT0FBTyxpQkFDSixPQUFPO0lBQ04sTUFBTSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxFQUFFO0lBQzlCLFNBQVMsaUJBQUUsT0FBTSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztJQUNsQyxVQUFVLGlCQUNQLE9BQU87TUFDTixZQUFZLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFNBQVMsUUFBUSxZQUFZLENBQUM7TUFDM0QsVUFBVSxpQkFBRSxPQUFNLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO01BQ25DLGtCQUFrQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO01BQ3pELGlCQUFpQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO0tBQ3pELEVBQ0EsT0FBTSxFQUNOLFNBQVE7R0FDWixFQUNBLE9BQU07Q0FDVixFQUNBLE9BQU07QUFFRixJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLFFBQVE7RUFDUixrQkFBa0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLEVBQUUsRUFBRSxJQUFJLEtBQU07Q0FDdEQsRUFDQSxPQUFNO0FBRUYsSUFBTSw0QkFBNEIsaUJBQ3RDLE9BQU87RUFDTixVQUFVO0VBQ1YsYUFBYTtFQUNiLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLElBQUk7RUFDSixTQUFTO0VBQ1Qsa0JBQWtCO0VBQ2xCLFFBQVE7RUFDUixPQUFPLGlCQUFFLEtBQUssQ0FBQyxVQUFVLFlBQVksV0FBVyxTQUFTLENBQUM7RUFDMUQsV0FBVztFQUNYLFdBQVc7RUFDWCxZQUFZLGdCQUFnQixTQUFRO0VBQ3BDLFdBQVcsZ0JBQWdCLFNBQVE7Q0FDcEMsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFFBQVEsWUFBVztBQUMvQixNQUFLLE9BQU8sVUFBVSxnQkFBaUIsT0FBTyxlQUFlLFNBQVk7QUFDdkUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxZQUFZO01BQ25CLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSyxPQUFPLFVBQVUsZUFBZ0IsT0FBTyxjQUFjLFNBQVk7QUFDckUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxXQUFXO01BQ2xCLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxNQUFNLHdCQUF3QixFQUFFLElBQUksMEJBQTBCO0VBQ3pFLFlBQVksd0JBQXdCLFNBQVE7Q0FDN0MsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QiwwQkFBd0IsV0FBVyxLQUFLLFNBQVMsS0FBSyxZQUFZLE9BQU87QUFDM0UsQ0FBQztBQUVJLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPLEVBQUUsU0FBUyxlQUFlLFVBQVUsZUFBYyxDQUFFLEVBQzNELE9BQU07QUFFRixJQUFNLDZCQUE2QixpQkFDdkMsT0FBTztFQUNOLFNBQVM7RUFDVCxXQUFXO0VBQ1gsT0FBTztDQUNSLEVBQ0EsT0FBTSxFQUNOLE9BQU8sQ0FBQyxhQUFhLFNBQVMsTUFBTSxPQUFPLFNBQVMsU0FBUztFQUM1RCxNQUFNLENBQUMsU0FBUyxJQUFJO0VBQ3BCLE9BQU87Q0FDUjtBQUVJLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sU0FBUztFQUNULFVBQVU7RUFDVixlQUFlO0VBQ2YsZ0JBQWdCLDJCQUEyQixTQUFRO0NBQ3BELEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsNkJBQ0UsUUFBUSxnQkFDUixRQUFRLFNBQ1IsUUFBUSxVQUNSLFFBQVEsZUFDUixTQUNBLENBQUMsa0JBQWtCLEtBQUssQ0FBQztBQUU3QixDQUFDO0FBRUksSUFBTSxtQ0FBbUMsaUJBQzdDLE9BQU87RUFDTixTQUFTO0VBQ1QsVUFBVTtDQUNYLEVBQ0EsT0FBTTtBQUVGLElBQU0sMkJBQTJCLGlCQUNyQyxPQUFPO0VBQ04sU0FBUztFQUNULFVBQVU7RUFDVixRQUFRO0NBQ1QsRUFDQSxPQUFNO0FBT0YsSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixPQUFPO0VBQ1AsUUFBUSxpQkFDTCxPQUFPO0lBQ04sSUFBSTtJQUNKLGVBQWU7SUFDZixnQkFBZ0IsMkJBQTJCLFNBQVE7R0FDcEQsRUFDQSxPQUFNO0NBQ1YsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFNBQVMsWUFBVztBQUNoQyxNQUFJLFFBQVEsTUFBTSxhQUFhLEdBQUc7QUFDaEMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxTQUFTLFVBQVU7TUFDMUIsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLFFBQVEsTUFBTSxjQUFjLFFBQVEsTUFBTSxXQUFXO0FBQ3ZELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsU0FBUyxXQUFXO01BQzNCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxRQUFRLE9BQU8sa0JBQWtCLFFBQVEsTUFBTSxlQUFlO0FBQ2hFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsVUFBVSxlQUFlO01BQ2hDLFNBQVM7S0FDVjtFQUNIO0FBQ0EsNkJBQ0UsUUFBUSxPQUFPLGdCQUNmLFFBQVEsTUFBTSxJQUNkLFFBQVEsT0FBTyxJQUNmLFFBQVEsT0FBTyxlQUNmLFNBQ0EsQ0FBQyxVQUFVLGtCQUFrQixLQUFLLENBQUM7QUFFdkMsQ0FBQztBQUVJLElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUztFQUNULFVBQVU7Q0FDWCxFQUNBLE9BQU07QUFJRixJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLFNBQVMsaUJBQUUsTUFBTSx3QkFBd0IsRUFBRSxJQUFJLDBCQUEwQjtFQUN6RSxZQUFZLHdCQUF3QixTQUFRO0NBQzdDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxNQUFNLFlBQVc7QUFDN0IsMEJBQXdCLFdBQVcsS0FBSyxTQUFTLEtBQUssWUFBWSxPQUFPO0FBQzNFLENBQUM7QUFFSSxJQUFNLGtCQUFrQixpQkFBRSxPQUFPLEVBQUUsU0FBUyxjQUFhLENBQUUsRUFBRSxPQUFNO0FBQ25FLElBQU0sd0JBQXdCLGlCQUNsQyxPQUFPLEVBQUUsU0FBUyxlQUFlLFVBQVUsZUFBYyxDQUFFLEVBQzNELE9BQU07QUFDRixJQUFNLHlCQUF5QixpQkFDbkMsT0FBTyxFQUFFLFNBQVMsZUFBZSxRQUFRLGdCQUFlLENBQUUsRUFDMUQsT0FBTTtBQUVGLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sdUJBQXVCO0VBQ3ZCLGdCQUFnQixpQkFDYixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsUUFBUTs7RUFFUixPQUFPLDJCQUEyQixTQUFRO0NBQzNDLEVBQ0EsT0FBTSxFQUNOLE9BQU8sQ0FBQyxVQUFVLE1BQU0sT0FBTyxhQUFhLE1BQU0sd0JBQXdCLEdBQUc7RUFDNUUsTUFBTSxDQUFDLFVBQVUsVUFBVTtFQUMzQixPQUFPO0NBQ1I7QUFFSCxJQUFNLDRCQUE0QixpQkFDL0IsT0FBTSxFQUNOLE1BQU0sdUJBQXVCLHlDQUF5QyxFQUN0RSxVQUFVLENBQUMsT0FBTyxZQUFXO0FBQzVCLFFBQU0sU0FBUyxPQUFPLEtBQUs7QUFDM0IsTUFBSSxDQUFDLE9BQU8sY0FBYyxNQUFNLEdBQUc7QUFDakMsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7S0FDVjtBQUNELFdBQU8saUJBQUU7RUFDWDtBQUNBLFNBQU87QUFDVCxDQUFDO0FBRUgsSUFBTSxvQ0FBb0MsaUJBQ3ZDLE9BQU0sRUFDTixJQUFHLEVBQ0gsSUFBSSxDQUFDLEVBQ0wsSUFBSSwwQkFBMEI7QUFFMUIsSUFBTSwrQkFBK0IsaUJBQ3pDLE9BQU87RUFDTixPQUFPLGtDQUFrQyxRQUFRLDhCQUE4QjtFQUMvRSxRQUFRLHdCQUF3QixTQUFRO0NBQ3pDLEVBQ0EsT0FBTTtBQUVULElBQU0sa0NBQWtDLDBCQUEwQixLQUNoRSxpQ0FBaUM7QUFHNUIsSUFBTSw2QkFBNkIsaUJBQ3ZDLE9BQU87RUFDTixPQUFPLGdDQUFnQyxTQUFRO0VBQy9DLFFBQVEsd0JBQXdCLFNBQVE7Q0FDekMsRUFDQSxPQUFNLEVBQ04sVUFBVSxDQUFDLFVBQVUsNkJBQTZCLE1BQU0sS0FBSyxDQUFDO0FBRTFELElBQU0sK0JBQStCLGlCQUN6QyxPQUFPO0VBQ04sU0FBUztFQUNULFNBQVM7RUFDVCxRQUFRO0VBQ1IsY0FBYztDQUNmLEVBQ0EsT0FBTTtBQUVGLElBQU0sNEJBQTRCLDZCQUN0QyxPQUFPLEVBQUUsWUFBWSwwQkFBeUIsQ0FBRSxFQUNoRCxPQUFNLEVBQ04sT0FBTyxDQUFDLFNBQVMsS0FBSyxhQUFhLHVCQUF1QjtFQUN6RCxNQUFNLENBQUMsWUFBWTtFQUNuQixPQUFPO0NBQ1I7QUFFSSxJQUFNLG9DQUFvQyxpQkFDOUMsT0FBTztFQUNOLE9BQU87RUFDUCxPQUFPO0NBQ1IsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFNBQVMsWUFBVztBQUNoQyxzQ0FDRSxRQUFRLE9BQ1IsUUFBUSxNQUFNLFFBQ2QsUUFBUSxNQUFNLGdCQUNkLFNBQ0EsQ0FBQyxPQUFPLENBQUM7QUFFYixDQUFDO0FBRUksSUFBTSxrQ0FBa0MsaUJBQzVDLE9BQU87RUFDTixPQUFPO0VBQ1AsVUFBVTtDQUNYLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsc0NBQ0UsUUFBUSxPQUNSLFFBQVEsU0FBUyxRQUNqQixRQUFRLFNBQVMsT0FBTyxnQkFDeEIsU0FDQSxDQUFDLFlBQVksUUFBUSxDQUFDO0FBRTFCLENBQUM7QUFJSSxJQUFNLHNCQUFzQixpQkFDaEMsT0FBTztFQUNOLGdCQUFnQiwwQkFBMEIsUUFBUSxDQUFDO0VBQ25ELDBCQUEwQjtFQUMxQixPQUFPLDBCQUEwQixRQUFRLEdBQUc7Q0FDN0MsRUFDQSxPQUFNLEVBQ04sVUFBVSxDQUFDLFdBQVc7RUFDckIsZ0JBQWdCLHFCQUFxQixNQUFNLE1BQU0sY0FBYztFQUMvRCwwQkFBMEIsb0JBQW9CLE1BQU0sTUFBTSx3QkFBd0I7RUFDbEYsT0FBTyxNQUFNO0VBQ2IsRUFDRCxPQUFPLENBQUMsVUFBVSxNQUFNLFNBQVMsS0FBSyxNQUFNLFNBQVMsNEJBQTRCO0VBQ2hGLE1BQU0sQ0FBQyxPQUFPO0VBQ2QsT0FBTztDQUNSO0FBRUksSUFBTSx5QkFBeUIsaUJBQUUsTUFBTTtFQUM1QztFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLFFBQVE7RUFDUixRQUFRLHVCQUF1QixTQUFRO0NBQ3hDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsUUFBTSxFQUFFLFFBQVEsT0FBTSxJQUFLO0FBQzNCLE1BQUksT0FBTyxjQUFjLFNBQVM7QUFDaEMsUUFBSSxXQUFXLE1BQU07QUFDbkIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxRQUFRO1FBQ2YsU0FBUztPQUNWO0lBQ0g7QUFDQTtFQUNGO0FBQ0EsTUFDRSxXQUFXLFFBQ1gsa0JBQWtCLE1BQU0sTUFBTSxPQUFPLFdBQ3JDLHFCQUFxQixNQUFNLE1BQU0sT0FBTyxjQUN4QyxhQUFhLE1BQU0sTUFBTSxPQUFPLFlBQ2hDLG1CQUFtQixNQUFNLE1BQU0sT0FBTyxnQkFDdEM7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7QUFDRDtFQUNGO0FBQ0EsTUFDRSxPQUFPLGNBQWMsZ0JBQ3BCLENBQUMsa0JBQWtCLE1BQU0sS0FBSyxPQUFPLFVBQVUsWUFDaEQ7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE9BQ0csT0FBTyxjQUFjLFlBQVksT0FBTyxjQUFjLGNBQ3ZELENBQUMsc0JBQXNCLE1BQU0sR0FDN0I7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFFSSxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLFNBQVM7RUFDVCxxQkFBcUI7RUFDckIsU0FBUyxpQkFBRSxNQUFNLHNCQUFzQixFQUFFLElBQUksMEJBQTBCO0VBQ3ZFLFlBQVk7RUFDWixTQUFTLGlCQUFFLFFBQU87Q0FDbkIsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixNQUNFLEtBQUssV0FBVyxZQUFZLEtBQUssV0FDakMsS0FBSyxXQUFXLDZCQUE2QixLQUFLLHFCQUNsRDtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsWUFBWTtNQUNuQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksS0FBSyxRQUFRLEtBQUssQ0FBQyxFQUFFLE9BQU0sTUFBTyxPQUFPLFlBQVksS0FBSyxPQUFPLEdBQUc7QUFDdEUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxTQUFTO01BQ2hCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxLQUFLLFdBQVcsS0FBSyxRQUFRLFdBQVcsR0FBRztBQUM3QyxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFNBQVM7TUFDaEIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSx3QkFBd0IsaUJBQ2xDLE9BQU87RUFDTixTQUFTO0VBQ1QscUJBQXFCLGlCQUNsQixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsV0FBVyxpQkFBRSxNQUFNLG9CQUFvQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksdUJBQXVCO0NBQzVFLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxPQUFPLFlBQVc7QUFDOUIsUUFBTSxPQUFPLG9CQUFJLElBQUc7QUFDcEIsYUFBVyxDQUFDLE9BQU8sUUFBUSxLQUFLLE1BQU0sVUFBVSxRQUFPLEdBQUk7QUFDekQsUUFBSSxvQkFBb0IsUUFBUSxNQUFNLE1BQU0sU0FBUztBQUNuRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGFBQWEsS0FBSztRQUN6QixTQUFTO09BQ1Y7SUFDSDtBQUNBLFFBQUksS0FBSyxJQUFJLFNBQVMsY0FBYyxHQUFHO0FBQ3JDLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixNQUFNLENBQUMsYUFBYSxPQUFPLGdCQUFnQjtRQUMzQyxTQUFTO09BQ1Y7SUFDSDtBQUNBLFNBQUssSUFBSSxTQUFTLGNBQWM7QUFDaEMsVUFBTSxXQUNKLFNBQVMsZUFBZSxVQUNwQixTQUFTLHdCQUNULFNBQVM7QUFDZixVQUFNLFdBQ0osU0FBUyxlQUFlLFVBQ3BCLFNBQVMsT0FBTyxXQUNoQixTQUFTLE9BQU87QUFDdEIsUUFBSSxjQUFjLGFBQWEsT0FBTyxJQUFJLFdBQVcsSUFBSTtBQUN2RCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGFBQWEsT0FBTyxRQUFRO1FBQ25DLFNBQVM7T0FDVjtJQUNIO0VBQ0Y7QUFDRixDQUFDO0FBRUksSUFBTSwrQkFBK0IsaUJBQ3pDLE9BQU87RUFDTixRQUFRLGlCQUFFLFFBQVEsVUFBVTtFQUM1QixnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0VBQ2hDLGFBQWEsaUJBQUUsS0FBSyxDQUFDLGFBQWEsV0FBVyxDQUFDO0VBQzlDLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFFRixJQUFNLGtDQUFrQyxpQkFDNUMsT0FBTztFQUNOLFFBQVEsaUJBQUUsUUFBUSxVQUFVO0VBQzVCLGdCQUFnQixpQkFDYixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsaUJBQWlCLGlCQUFFLE1BQU0sQ0FBQyxxQkFBcUIsb0JBQW9CLENBQUM7RUFDcEUsU0FBUyx1QkFBdUIsU0FBUTtDQUN6QyxFQUNBLE9BQU07QUFFRixJQUFNLHlCQUF5QixpQkFDbkMsT0FBTztFQUNOLFNBQVM7RUFDVCxxQkFBcUI7RUFDckIscUJBQXFCLGlCQUNsQixPQUFNLEVBQ04sSUFBSSx5QkFBeUIsRUFDN0IsSUFBSSx5QkFBeUI7RUFDaEMsU0FBUyxpQkFDTixNQUNDLGlCQUFFLG1CQUFtQixVQUFVO0lBQzdCO0lBQ0E7R0FDRCxDQUFDLEVBRUgsSUFBSSxDQUFDLEVBQ0wsSUFBSSx1QkFBdUI7Q0FDL0IsRUFDQSxPQUFNO0FBTUYsSUFBTSw0Q0FDWCxzQkFBc0IsWUFBWSxDQUFDLE9BQU8sWUFBVztBQUNuRCxRQUFNLFlBQVksb0JBQUksSUFBRztBQUN6QixRQUFNLFVBQW9CLENBQUE7QUFDMUIsTUFBSTtBQUlKLGFBQVcsQ0FBQyxPQUFPLFFBQVEsS0FBSyxNQUFNLFVBQVUsUUFBTyxHQUFJO0FBQ3pELFFBQUksU0FBUyxlQUFlLFdBQVcsU0FBUyxlQUFlLFFBQVE7QUFDckUsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxhQUFhLE9BQU8sWUFBWTtRQUN2QyxTQUFTO09BQ1Y7QUFDRDtJQUNGO0FBQ0EsUUFDRSxTQUFTLDJCQUEyQixRQUNwQyxTQUFTLE9BQU8saUJBQWlCLFFBQ2pDO0FBQ0EsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxhQUFhLEtBQUs7UUFDekIsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLFVBQVUsSUFBSSxTQUFTLE9BQU8sRUFBRSxHQUFHO0FBQ3JDLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixNQUFNLENBQUMsYUFBYSxPQUFPLFVBQVUsSUFBSTtRQUN6QyxTQUFTO09BQ1Y7SUFDSDtBQUNBLGNBQVUsSUFBSSxTQUFTLE9BQU8sRUFBRTtBQUNoQyxRQUFJLFNBQVMsZUFBZSxTQUFTO0FBQ25DLFVBQUksa0JBQWtCLFFBQVc7QUFDL0IsZ0JBQVEsU0FBUztVQUNmLE1BQU07VUFDTixNQUFNLENBQUMsYUFBYSxLQUFLO1VBQ3pCLFNBQVM7U0FDVjtNQUNIO0FBQ0Esc0JBQWdCO0lBQ2xCLE9BQU87QUFDTCxjQUFRLEtBQUssU0FBUyxPQUFPLEVBQUU7SUFDakM7RUFDRjtBQUVBLE1BQUksa0JBQWtCLFFBQVc7QUFDL0IsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxXQUFXO01BQ2xCLFNBQVM7S0FDVjtBQUNEO0VBQ0Y7QUFDQSxNQUFJLE1BQU0sVUFBVSxHQUFHLEVBQUUsTUFBTSxlQUFlO0FBQzVDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVztNQUNsQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLGFBQVcsQ0FBQyxPQUFPLFFBQVEsS0FBSyxNQUFNLFVBQVUsUUFBTyxHQUFJO0FBQ3pELFFBQ0UsU0FBUyxlQUFlLFVBQ3hCLFNBQVMsT0FBTyxZQUFZLGNBQWMsT0FBTyxJQUNqRDtBQUNBLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixNQUFNLENBQUMsYUFBYSxPQUFPLFVBQVUsU0FBUztRQUM5QyxTQUFTO09BQ1Y7SUFDSDtFQUNGO0FBQ0EsUUFBTSxnQkFBZ0IsQ0FBQyxHQUFHLE9BQU8sRUFBRSxLQUFJO0FBQ3ZDLE1BQUksUUFBUSxLQUFLLENBQUMsUUFBUSxVQUFVLFdBQVcsY0FBYyxLQUFLLENBQUMsR0FBRztBQUNwRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFdBQVc7TUFDbEIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSwyQ0FBMkMsaUJBQ3JELE9BQU87RUFDTixnQkFBZ0IsaUJBQ2IsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0VBQ2hDLFFBQVE7Q0FDVCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLE1BQ0csT0FBTyxPQUFPLGVBQWUsV0FBVyxPQUFPLE9BQU8sZUFBZSxVQUN0RSxPQUFPLE9BQU8sY0FBYyxVQUM1QjtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsUUFBUTtNQUNmLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sNkNBQTZDLGlCQUN2RCxPQUFPO0VBQ04sU0FBUztFQUNULHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUkseUJBQXlCLEVBQzdCLElBQUkseUJBQXlCO0VBQ2hDLHFCQUFxQjtFQUNyQixTQUFTLGlCQUNOLE1BQU0sd0NBQXdDLEVBQzlDLElBQUksQ0FBQyxFQUNMLElBQUksOEJBQThCO0NBQ3RDLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxVQUFVLFlBQVc7QUFDakMsUUFBTSxVQUFvQixDQUFBO0FBQzFCLE1BQUksYUFBYTtBQUNqQixhQUFXLENBQUMsT0FBTyxNQUFNLEtBQUssU0FBUyxRQUFRLFFBQU8sR0FBSTtBQUN4RCxRQUFJLE9BQU8sT0FBTyxZQUFZLFNBQVMsU0FBUztBQUM5QyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLFdBQVcsT0FBTyxVQUFVLFNBQVM7UUFDNUMsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLFFBQVEsR0FBRztBQUNiLFlBQU0sV0FBVyxTQUFTLFFBQVEsUUFBUSxDQUFDO0FBQzNDLFVBQ0UsYUFBYSxVQUNiLE9BQU8sT0FBTyxtQkFBbUIsU0FBUyxPQUFPLGlCQUFpQixHQUNsRTtBQUNBLGdCQUFRLFNBQVM7VUFDZixNQUFNO1VBQ04sTUFBTSxDQUFDLFdBQVcsT0FBTyxVQUFVLGdCQUFnQjtVQUNuRCxTQUFTO1NBQ1Y7TUFDSDtJQUNGO0FBQ0EsUUFBSSxPQUFPLE9BQU8sZUFBZTtBQUFTLG9CQUFjO0FBQ3hELFFBQUksT0FBTyxPQUFPLGVBQWU7QUFBUSxjQUFRLEtBQUssT0FBTyxPQUFPLFFBQVE7RUFDOUU7QUFDQSxNQUFJLGVBQWUsS0FBSyxTQUFTLFFBQVEsR0FBRyxFQUFFLEdBQUcsT0FBTyxlQUFlLFNBQVM7QUFDOUUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxTQUFTO01BQ2hCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsUUFBTSxnQkFBZ0IsQ0FBQyxHQUFHLE9BQU8sRUFBRSxLQUFJO0FBQ3ZDLE1BQUksUUFBUSxLQUFLLENBQUMsUUFBUSxVQUFVLFdBQVcsY0FBYyxLQUFLLENBQUMsR0FBRztBQUNwRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFNBQVM7TUFDaEIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBNENILFNBQVMsMkJBQ1AsZ0JBQ0EsU0FDQSxVQUNBLGVBQ0EsU0FDQSxNQUFtQjtBQUVuQixNQUNFLG1CQUFtQixXQUNsQixlQUFlLElBQUksWUFBWSxXQUM5QixlQUFlLElBQUksYUFBYSxZQUNoQyxlQUFlLElBQUksa0JBQWtCLGdCQUN2QztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTjtNQUNBLFNBQVM7S0FDVjtFQUNIO0FBQ0Y7QUFJQSxTQUFTLHdCQUNQLFVBQ0EsTUFDQSxZQUNBLFNBQThCO0FBRTlCLFFBQU0sV0FBVyxLQUFLLENBQUM7QUFDdkIsTUFBSSxhQUFhLFVBQWEsS0FBSyxLQUFLLENBQUMsUUFBUSxJQUFJLFlBQVksU0FBUyxPQUFPLEdBQUc7QUFDbEYsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsUUFBUTtLQUNoQjtFQUNIO0FBQ0EsTUFBSSxlQUFlO0FBQU07QUFFekIsUUFBTSxXQUFXLEtBQUssR0FBRyxFQUFFO0FBQzNCLE1BQUksYUFBYSxRQUFXO0FBQzFCLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7QUFDRDtFQUNGO0FBRUEsTUFBSTtBQUNKLE1BQUk7QUFDRixvQkFBZ0Isd0JBQXdCLFVBQVU7RUFDcEQsUUFBUTtBQUNOLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7QUFDRDtFQUNGO0FBQ0EsTUFDRSxjQUFjLGFBQWEsWUFDM0IsY0FBYyxZQUFZLFNBQVMsV0FDbkMsY0FBYyxjQUFjLFNBQVMsYUFDckMsY0FBYyxPQUFPLFNBQVMsSUFDOUI7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxZQUFZO0tBQ3BCO0VBQ0g7QUFDRjtBQUVBLFNBQVMsb0NBQ1AsT0FDQSxRQUdBLGdCQUNBLFNBQ0EsTUFBbUI7QUFFbkIsUUFBTSxTQUFTLE1BQU07QUFDckIsUUFBTSxlQUFlLFFBQVEsU0FBUyxPQUFPLEtBQUssT0FBTztBQUN6RCxRQUFNLGNBQ0osUUFBUSxTQUNKLENBQUMsT0FBTyxxQkFBcUIsWUFBWSxPQUFPLGtCQUFrQixVQUFVLElBQzVFLENBQUMsT0FBTyxVQUFVO0FBQ3hCLE1BQ0UsT0FBTyxZQUFZLE9BQU8sT0FBTyxXQUNqQyxPQUFPLFlBQVksT0FBTyxPQUFPLFdBQ2pDLE9BQU8sV0FBVyxPQUFPLE9BQU8sVUFDaEMsaUJBQWlCLE9BQU8sT0FBTyxnQkFDL0IsT0FBTyxrQkFBa0IsT0FBTyxPQUFPLGlCQUN2QyxZQUFZLEtBQUssQ0FBQyxlQUFlLGVBQWUsT0FBTyxPQUFPLFVBQVUsS0FDeEUsbUJBQW1CLE9BQU8sZ0JBQzFCO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOO01BQ0EsU0FBUztLQUNWO0VBQ0g7QUFDRjtBQUVBLFNBQVMsa0JBQ1AsUUFBd0I7QUFFeEIsU0FBTyxXQUFXO0FBQ3BCO0FBRUEsU0FBUyxzQkFBc0IsUUFBd0I7QUFDckQsU0FDRSxDQUFDLGtCQUFrQixNQUFNLE1BQ3hCLEVBQUUsa0JBQWtCLFdBQVcsT0FBTyxpQkFBaUI7QUFFNUQ7QUFFQSxTQUFTLGtCQUFrQixRQUF3QjtBQUNqRCxTQUFPLGFBQWEsU0FBUyxPQUFPLFVBQVUsT0FBTztBQUN2RDtBQUVBLFNBQVMsYUFBYSxRQUF3QjtBQUM1QyxTQUFPLGtCQUFrQixNQUFNLElBQUksT0FBTyxXQUFXLE9BQU87QUFDOUQ7QUFFQSxTQUFTLHFCQUNQLFFBQXdCO0FBRXhCLE1BQUksa0JBQWtCLE1BQU07QUFBRyxXQUFPLE9BQU87QUFDN0MsTUFBSSxjQUFjO0FBQVEsV0FBTztBQUNqQyxNQUFJLFlBQVk7QUFBUSxXQUFPO0FBQy9CLE1BQUksYUFBYTtBQUFRLFdBQU87QUFDaEMsU0FBTztBQUNUO0FBRUEsU0FBUyxtQkFBbUIsUUFBd0I7QUFDbEQsTUFBSSxrQkFBa0IsTUFBTTtBQUFHLFdBQU8sT0FBTztBQUM3QyxTQUFPLGNBQWMsU0FBUyxPQUFPLFdBQVcsT0FBTztBQUN6RDtBQUVBLFNBQVMsb0JBQ1AsVUFBOEM7QUFFOUMsU0FBTyxTQUFTLGVBQWUsVUFBVSxTQUFTLE9BQU8sS0FBSyxTQUFTLE9BQU87QUFDaEY7OztBQ2wvQk8sSUFBTSw0QkFBNEIsaUJBQ3RDLE9BQU87RUFDTixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixRQUFRLGlCQUFFLEtBQUssQ0FBQyxVQUFVLFFBQVEsQ0FBQztFQUNuQyxRQUFRO0VBQ1IsVUFBVSxpQkFBRSxLQUFLLENBQUMsZ0JBQWdCLGNBQWMsZ0JBQWdCLFlBQVksQ0FBQztFQUM3RSxnQkFBZ0IsaUJBQUUsS0FBSyxDQUFDLFVBQVUsU0FBUyxDQUFDO0VBQzVDLFlBQVk7RUFDWixlQUFlO0VBQ2YsWUFBWTtDQUNiLEVBQ0EsT0FBTTtBQVNGLElBQU0sd0JBQXdCLGlCQUFFLEtBQUs7RUFDMUM7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBR00sSUFBTSx5QkFBeUIsaUJBQUUsS0FBSztFQUMzQztFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBR00sSUFBTSx3QkFBd0IsaUJBQUUsS0FBSztFQUMxQztFQUNBO0VBQ0E7RUFDQTtDQUNEO0FBRUQsSUFBTSx3QkFBd0IsRUFBRSxLQUFLLEdBQUcsS0FBSyxJQUFHO0FBQ2hELElBQU0sNkJBQTZCLEVBQUUsS0FBSyxHQUFHLEtBQUssSUFBRztBQVM5QyxJQUFNLDZCQUE2QixpQkFDdkMsT0FBTSxFQUNOLElBQUksc0JBQXNCLEdBQUcsRUFDN0IsSUFBSSxzQkFBc0IsR0FBRyxFQUM3QixNQUFNLG1DQUFtQztFQUN4QyxTQUFTO0NBQ1Y7QUFHSSxJQUFNLDBCQUEwQixpQkFDcEMsT0FBTSxFQUNOLElBQUksMkJBQTJCLEdBQUcsRUFDbEMsSUFBSSwyQkFBMkIsR0FBRyxFQUNsQyxNQUFNLG1DQUFtQztFQUN4QyxTQUFTO0NBQ1Y7QUFPSSxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFNBQVM7RUFDVCxZQUFZO0VBQ1osUUFBUTtFQUNSLFNBQVM7RUFDVCxZQUFZO0VBQ1osWUFBWSxpQkFBaUIsU0FBUTtFQUNyQyxPQUFPLHNCQUFzQixTQUFRO0VBQ3JDLFVBQVUsZUFBZSxTQUFRO0VBQ2pDLGdCQUFnQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxTQUFRO0NBQ3hELEVBQ0EsT0FBTTs7O0FDeEVGLElBQU0sNkJBQTZCO0FBQ25DLElBQU0sNkJBQTZCLEtBQUssT0FBTyxPQUFPO0FBRTdELElBQU0sNkJBQTZCLGdCQUNoQyxPQUFPLEVBQUUsRUFDVCxPQUFPLENBQUMsVUFBVSxPQUFPLEtBQUssT0FBTyxXQUFXLEVBQUUsZUFBZSxJQUFJO0VBQ3BFLE9BQU87Q0FDUjtBQUVJLElBQU0saUNBQ1gsMkJBQTJCLE1BQUs7QUFDM0IsSUFBTSxnQ0FDWCwyQkFBMkIsTUFBSztBQUVsQyxJQUFNLDZCQUE2QixpQkFDaEMsT0FBTztFQUNOLFdBQVcsaUJBQUUsUUFBUSx5QkFBeUI7RUFDOUMsTUFBTTtDQUNQLEVBQ0EsT0FBTTtBQUVGLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLFFBQVE7RUFDeEIsUUFBUSxpQkFBRSxRQUFRLHlCQUF5QjtFQUMzQyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixTQUFTO0VBQ1QsZUFBZTtFQUNmLFdBQVc7RUFDWCxnQkFBZ0I7Q0FDakIsRUFDQSxPQUFNO0FBRUYsSUFBTSw2QkFBNkIsaUJBQUUsbUJBQW1CLFFBQVE7RUFDckUsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxPQUFPLEdBQUcsUUFBUSxrQkFBaUIsQ0FBRSxFQUFFLE9BQU07RUFDeEUsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxPQUFPLEdBQUcsUUFBUSwyQkFBMEIsQ0FBRSxFQUFFLE9BQU07RUFDakYsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxNQUFNLEdBQUcsUUFBUSwwQkFBeUIsQ0FBRSxFQUFFLE9BQU07RUFDL0UsaUJBQ0csT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxZQUFZLEdBQUcsUUFBUSxnQ0FBK0IsQ0FBRSxFQUNqRixPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxtQkFBbUI7SUFDbkMsUUFBUTtHQUNULEVBQ0EsT0FBTTtFQUNULGlCQUNHLE9BQU87SUFDTixNQUFNLGlCQUFFLFFBQVEsa0JBQWtCO0lBQ2xDLFFBQVE7R0FDVCxFQUNBLE9BQU07RUFDVCxpQkFBRSxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLE9BQU8sR0FBRyxRQUFRLDJCQUEwQixDQUFFLEVBQUUsT0FBTTtFQUNqRixpQkFDRyxPQUFPLEVBQUUsTUFBTSxpQkFBRSxRQUFRLFNBQVMsR0FBRyxRQUFRLDZCQUE0QixDQUFFLEVBQzNFLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sTUFBTSxpQkFBRSxRQUFRLHVCQUF1QjtJQUN2QyxZQUFZLGlCQUFFLEtBQUssQ0FBQyxTQUFTLFFBQVEsWUFBWSxDQUFDO0lBQ2xELFFBQVEsaUJBQUUsTUFBTTtNQUNkO01BQ0E7TUFDQTtLQUNEO0dBQ0YsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixVQUFNLGFBQ0osWUFBWSxNQUFNLFNBQ2QsZUFDQSxhQUFhLE1BQU0sU0FDakIsU0FDQTtBQUNSLFFBQUksTUFBTSxlQUFlLFlBQVk7QUFDbkMsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxZQUFZO1FBQ25CLFNBQVM7T0FDVjtJQUNIO0FBQ0EsUUFBSSxNQUFNLE9BQU8saUJBQWlCLFFBQVc7QUFDM0MsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxVQUFVLGNBQWM7UUFDL0IsU0FBUztPQUNWO0lBQ0g7RUFDRixDQUFDO0VBQ0gsaUJBQUUsT0FBTyxFQUFFLE1BQU0saUJBQUUsUUFBUSxXQUFXLEdBQUcsUUFBUSxzQkFBcUIsQ0FBRSxFQUFFLE9BQU07Q0FDakY7QUFFTSxJQUFNLDhCQUE4QixpQkFDeEMsT0FBTztFQUNOLE1BQU0saUJBQUUsUUFBUSxRQUFRO0VBQ3hCLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLGFBQWEsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSxHQUFVO0VBQ3ZELGtCQUFrQjtFQUNsQixtQkFBbUI7Q0FDcEIsRUFDQSxPQUFNO0FBa0JULElBQU0sMEJBQTBCLGlCQUM3QixPQUFNLEVBQ04sSUFBRyxFQUNILFNBQVEsRUFDUixJQUFJLDBCQUEwQjtBQUNqQyxJQUFNLHVCQUF1QixpQkFDMUIsT0FBTSxFQUNOLElBQUcsRUFDSCxZQUFXLEVBQ1gsSUFBSSwwQkFBMEI7QUFFMUIsSUFBTSwyQkFBMkIsaUJBQ3JDLE9BQU87RUFDTixRQUFRO0VBQ1Isa0JBQWtCO0VBQ2xCLGFBQWE7RUFDYixrQkFBa0I7RUFDbEIsd0JBQXdCO0NBQ3pCLEVBQ0EsT0FBTTtBQUVULElBQU0sNEJBQTRCLGlCQUMvQixPQUFPO0VBQ04sSUFBSTtFQUNKLE1BQU0saUJBQUUsS0FBSyxDQUFDLGdCQUFnQixjQUFjLGNBQWMsQ0FBQztFQUMzRCxZQUFZO0NBQ2IsRUFDQSxPQUFNO0FBRVQsSUFBTSw4QkFBOEIsaUJBQ2pDLE9BQU87RUFDTixRQUFRLGlCQUFFLFFBQVEsQ0FBQztFQUNuQixRQUFRO0VBQ1IsT0FBTztFQUNQLGFBQWE7RUFDYixtQkFBbUI7RUFDbkIsa0JBQWtCO0VBQ2xCLHVCQUF1QixpQkFDcEIsT0FBTztJQUNOLFFBQVE7SUFDUixPQUFPO0lBQ1AsYUFBYTtHQUNkLEVBQ0EsT0FBTTtFQUNULFlBQVk7RUFDWixXQUFXO0VBQ1gsUUFBUTtDQUNULEVBQ0EsT0FBTTtBQUVGLElBQU0sMENBQTBDLGlCQUNwRCxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsT0FBTyxpQkFBRSxRQUFRLGtCQUFrQjtFQUNuQyxTQUFTO0VBQ1QsZUFBZTtFQUNmLGtCQUFrQjtFQUNsQixrQkFBa0I7RUFDbEIsd0JBQXdCO0VBQ3hCLGFBQWE7RUFDYixjQUFjO0VBQ2QsVUFBVTtDQUNYLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsUUFBTSxlQUFlLFFBQVEsU0FBUztBQUN0QyxRQUFNLG1CQUNKLGFBQWEsU0FBUyxhQUFhLFFBQVEsYUFBYTtBQUMxRCxRQUFNLGdCQUNKLFFBQVEsU0FBUyxTQUNqQixRQUFRLFNBQVMsU0FDakIsUUFBUSxTQUFTLFFBQ2pCLFFBQVEsU0FBUyxjQUNqQixRQUFRLFNBQVMsb0JBQ2pCLFFBQVEsU0FBUyxtQkFDakIsbUJBQ0EsUUFBUSxTQUFTLGFBQ2pCLFFBQVEsU0FBUyxZQUNqQixRQUFRLFNBQVM7QUFFbkIsTUFBSSxrQkFBa0IsUUFBUSxhQUFhO0FBQ3pDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsYUFBYTtNQUNwQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksUUFBUSxTQUFTLHNCQUFzQixRQUFRLFNBQVMsYUFBYTtBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFlBQVksbUJBQW1CO01BQ3RDLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxRQUFRLFNBQVMsbUJBQW1CLFFBQVEsU0FBUyxhQUFhO0FBQ3BFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsWUFBWSxrQkFBa0I7TUFDckMsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLFFBQVEsU0FBUyxhQUFhLGtCQUFrQjtBQUNsRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFlBQVksWUFBWTtNQUMvQixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFFSCxJQUFNLDhCQUE4QixpQkFBRSxPQUFPO0VBQzNDLGlCQUFpQixpQkFBRSxRQUFRLENBQUM7RUFDNUIsa0JBQWtCO0VBQ2xCLGNBQWMsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSwwQkFBMEI7RUFDeEUsZ0JBQWdCO0VBQ2hCLGFBQWEsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXLEVBQUcsSUFBSSwwQkFBMEI7RUFDMUUsZUFBZTtFQUNmLFdBQVc7RUFDWCxXQUFXO0NBQ1o7QUFFRCxJQUFNLDZCQUE2Qiw0QkFDaEMsT0FBTztFQUNOLE9BQU8saUJBQUUsUUFBUSxTQUFTO0VBQzFCLFNBQVMsY0FBYyxTQUFRO0NBQ2hDLEVBQ0EsT0FBTTtBQUVULElBQU0sNEJBQTRCLDRCQUMvQixPQUFPO0VBQ04sT0FBTyxpQkFBRSxRQUFRLFFBQVE7RUFDekIsU0FBUztFQUNULFNBQVM7RUFDVCxVQUFVO0NBQ1gsRUFDQSxPQUFNO0FBRVQsSUFBTSwrQkFBK0IsNEJBQ2xDLE9BQU87RUFDTixPQUFPLGlCQUFFLFFBQVEsV0FBVztFQUM1QixTQUFTO0VBQ1QsU0FBUztFQUNULFVBQVU7RUFDVixhQUFhO0NBQ2QsRUFDQSxPQUFNO0FBRVQsSUFBTSwrQkFBK0IsaUJBQ2xDLE9BQU87RUFDTixPQUFPLGlCQUFFLFFBQVEsV0FBVztFQUM1QixpQkFBaUIsaUJBQUUsUUFBUSxDQUFDO0VBQzVCLGtCQUFrQjtFQUNsQixTQUFTO0VBQ1QsYUFBYTtDQUNkLEVBQ0EsT0FBTTtBQUVULElBQU0sNkJBQTZCLGlCQUNoQyxPQUFPO0VBQ04sT0FBTyxpQkFBRSxRQUFRLFNBQVM7RUFDMUIsaUJBQWlCLGlCQUFFLFFBQVEsQ0FBQztFQUM1QixrQkFBa0I7RUFDbEIsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQUVGLElBQU0sNEJBQTRCLGlCQUN0QyxtQkFBbUIsU0FBUztFQUMzQjtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0QsRUFDQSxZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLE1BQUksaUJBQWlCLFVBQVUsT0FBTyxjQUFjLE9BQU8sY0FBYztBQUN2RSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLGFBQWE7TUFDcEIsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLG1CQUFtQixVQUFVLE9BQU8sZ0JBQWdCLE9BQU8sZ0JBQWdCO0FBQzdFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsZUFBZTtNQUN0QixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksbUJBQW1CLFFBQVE7QUFDN0IsVUFBTSxtQkFBbUIsT0FBTyxnQkFBZ0I7QUFDaEQsVUFBTSxpQkFBaUIsT0FBTyxjQUFjO0FBQzVDLFFBQUkscUJBQXFCLGdCQUFnQjtBQUN2QyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGVBQWU7UUFDdEIsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUNFLE9BQU8sVUFBVSxhQUNoQixPQUFPLFlBQVksV0FBZSxrQkFDbkM7QUFDQSxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLFNBQVM7UUFDaEIsU0FBUztPQUNWO0lBQ0g7RUFDRjtBQUNBLE1BQUksT0FBTyxVQUFVLGFBQWEsT0FBTyxVQUFVO0FBQVc7QUFFOUQsTUFBSSxPQUFPLHFCQUFxQixPQUFPLFFBQVEsa0JBQWtCO0FBQy9ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsa0JBQWtCO01BQ3pCLFNBQVM7S0FDVjtFQUNIO0FBQ0EsTUFBSSxPQUFPLFVBQVU7QUFBYTtBQUVsQyxNQUFJLE9BQU8sWUFBWSxPQUFPLFFBQVEsT0FBTyxTQUFTO0FBQ3BELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsU0FBUztNQUNoQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQ0UsT0FBTyxrQkFBa0IsT0FBTyxRQUFRLGVBQ3hDLE9BQU8sUUFBUSxjQUFjLE9BQU8sZ0JBQ3BDO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxlQUFlO01BQ3RCLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQzs7O0FDclhJLElBQU0saUJBQWlCLE9BQU8sT0FBTztFQUMxQyxJQUFJO0VBQ0oscUJBQXFCO0VBQ3JCLFlBQVk7RUFDWixzQkFBc0I7RUFDdEIsbUJBQW1CO0VBQ25CLHFCQUFxQjtFQUNyQixjQUFjO0VBQ2Qsc0JBQXNCO0VBQ3RCLGtCQUFrQjtFQUNsQiwwQkFBMEI7RUFDMUIsc0JBQXNCO0NBQ2Q7QUFJSCxJQUFNLGtCQUFrQjtFQUM3QjtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBOztBQUdLLElBQU0scUJBQXFCLGlCQUFFLEtBQUssZUFBZTtBQUl4RCxJQUFNLHVCQUErRCxPQUFPLE9BQU87RUFDakYsSUFBSSxlQUFlO0VBQ25CLHNCQUFzQixlQUFlO0VBQ3JDLGFBQWEsZUFBZTtFQUM1Qix1QkFBdUIsZUFBZTtFQUN0QyxvQkFBb0IsZUFBZTtFQUNuQyxzQkFBc0IsZUFBZTtFQUNyQyxlQUFlLGVBQWU7RUFDOUIsdUJBQXVCLGVBQWU7RUFDdEMsbUJBQW1CLGVBQWU7RUFDbEMsNEJBQTRCLGVBQWU7RUFDM0MsdUJBQXVCLGVBQWU7Q0FDdkM7QUFHSyxTQUFVLG9CQUFvQixNQUFrQjtBQUNwRCxTQUFPLHFCQUFxQixJQUFJO0FBQ2xDO0FBRU8sSUFBTSx5QkFBeUIsaUJBQ25DLE9BQU87RUFDTixPQUFPLGlCQUNKLE9BQU87SUFDTixNQUFNO0lBQ04sVUFBVSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksR0FBRztJQUN6QyxTQUFTLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLElBQUk7R0FDcEMsRUFDQSxPQUFNO0NBQ1YsRUFDQSxPQUFNOzs7QUNqREYsSUFBTSw0QkFBNEI7QUFDbEMsSUFBTSxpQ0FBaUM7QUFDdkMsSUFBTSxxQ0FBcUM7QUFDM0MsSUFBTSw4QkFBOEI7QUFDcEMsSUFBTSxzQkFBc0I7QUFFNUIsSUFBTSx5QkFBeUIsaUJBQ25DLE9BQU0sRUFDTixJQUFHLEVBQ0gsWUFBVyxFQUNYLElBQUksT0FBTyxnQkFBZ0IsRUFDM0IsTUFBSztBQUVSLElBQU0sK0JBQStCLGlCQUFFLE1BQU07RUFDM0M7RUFDQTtFQUNBO0NBQ0Q7QUFFTSxJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFlBQVk7RUFDWixZQUFZLGlCQUFFLEtBQUs7SUFDakI7SUFDQTtJQUNBO0dBQ0Q7RUFDRCxVQUFVO0VBQ1YsU0FBUyxpQkFBRSxLQUFLLENBQUMsV0FBVyxpQkFBaUIsWUFBWSxDQUFDO0VBQzFELGVBQWU7RUFDZixZQUFZO0VBQ1osVUFBVTtFQUNWLFNBQVMsY0FBYyxTQUFRO0VBQy9CLGdCQUFnQjtDQUNqQixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsZ0JBQWdCLFlBQVc7QUFDdkMsUUFBTSxrQkFDSCxlQUFlLGVBQWUsdUJBQzVCLGVBQWUsWUFBWSxhQUMxQixlQUFlLGFBQWEsZUFBZSxjQUMzQyxlQUFlLFlBQVksV0FDOUIsZUFBZSxlQUFlLDRCQUM1QixlQUFlLFlBQVksbUJBQzFCLENBQUMsZ0JBQWdCLFVBQVUsZUFBZSxRQUFRLEVBQUUsV0FDcEQsZUFBZSxZQUFZLFdBQzlCLGVBQWUsZUFBZSx5QkFDNUIsZUFBZSxZQUFZLGdCQUMxQixDQUFDLGNBQWMsVUFBVSxlQUFlLFFBQVEsRUFBRSxXQUNsRCxlQUFlLFlBQVksVUFDM0IsZUFBZSxhQUFhLGVBQWU7QUFFakQsTUFBSSxpQkFBaUI7QUFDbkIsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQ0U7S0FDSDtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sU0FBUztFQUNULFdBQVcsaUJBQUUsUUFBUSx5QkFBeUI7RUFDOUMsT0FBTztFQUNQLFlBQVk7RUFDWixtQkFBbUI7RUFDbkIsS0FBSztFQUNMLFlBQVk7Q0FDYixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsVUFBVSxZQUFXO0FBQ2pDLE1BQUksU0FBUyxNQUFNLFdBQVcsNEJBQTRCO0FBQ3hELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLE9BQU87S0FDZjtFQUNIO0FBQ0EsTUFBSSxTQUFTLGtCQUFrQixXQUFXLHlDQUF5QztBQUNqRixZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxtQkFBbUI7S0FDM0I7RUFDSDtBQUNBLE1BQUksU0FBUyxlQUFlLFNBQVMsSUFBSSxZQUFZO0FBQ25ELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFlBQVk7S0FDcEI7RUFDSDtBQUNGLENBQUM7QUFFSCxJQUFNLDZCQUE2QixpQkFDaEMsT0FBTztFQUNOLElBQUk7RUFDSixPQUFPLGlCQUFFLE9BQU0sRUFBRyxLQUFJLEVBQUcsSUFBSSxDQUFDLEVBQUUsSUFBSSxHQUFHO0VBQ3ZDLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFFRixJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLE9BQU8saUJBQUUsT0FBTSxFQUFHLEtBQUksRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQUc7RUFDdkMsUUFBUSxpQkFBRSxNQUFNLDBCQUEwQixFQUFFLElBQUksbUJBQW1CO0NBQ3BFLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsUUFBTSxXQUFXLG9CQUFJLElBQUc7QUFDeEIsYUFBVyxDQUFDLE9BQU8sS0FBSyxLQUFLLFFBQVEsT0FBTyxRQUFPLEdBQUk7QUFDckQsUUFBSSxTQUFTLElBQUksTUFBTSxFQUFFLEdBQUc7QUFDMUIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxVQUFVLE9BQU8sSUFBSTtRQUM1QixTQUFTO09BQ1Y7SUFDSDtBQUNBLGFBQVMsSUFBSSxNQUFNLEVBQUU7RUFDdkI7QUFDRixDQUFDO0FBRUgsSUFBTSxzQ0FBc0MsaUJBQ3pDLE9BQU87RUFDTixXQUFXLGlCQUFFLFFBQVEsYUFBYTtFQUNsQyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixNQUFNLGdCQUFnQixPQUFPLEVBQUU7RUFDL0IsU0FBUyxpQkFBRSxRQUFRLDhCQUE4QjtFQUNqRCxjQUFjLGlCQUFFLFFBQVEsRUFBRTtDQUMzQixFQUNBLE9BQU07QUFFVCxJQUFNLHNDQUFzQyxpQkFDekMsT0FBTztFQUNOLFdBQVcsaUJBQUUsUUFBUSxhQUFhO0VBQ2xDLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLE1BQU0sZ0JBQWdCLE9BQU8sRUFBRTtFQUMvQixTQUFTLGlCQUFFLFFBQVEsa0NBQWtDO0VBQ3JELGNBQWMsaUJBQUUsUUFBUSxFQUFFO0NBQzNCLEVBQ0EsT0FBTTtBQUVULElBQU0sNEJBQTRCLGlCQUFFLE9BQU87RUFDekMsYUFBYTtFQUNiLElBQUk7RUFDSixPQUFPLGlCQUFFLEtBQUssQ0FBQyxVQUFVLFNBQVMsQ0FBQztFQUNuQyxZQUFZO0VBQ1oscUJBQXFCO0VBQ3JCLFdBQVc7RUFDWCxXQUFXLGdCQUFnQixTQUFRO0NBQ3BDO0FBRU0sSUFBTSxnQ0FBZ0MsMEJBQzFDLE9BQU87RUFDTixNQUFNLGlCQUFFLFFBQVEsY0FBYztFQUM5QixPQUFPLGlCQUFFLFFBQVEsUUFBUTtFQUN6QixZQUFZO0NBQ2IsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE1BQU0sWUFBVztBQUM3QixNQUFJLEtBQUssY0FBYyxRQUFXO0FBQ2hDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVztNQUNsQixTQUNFO0tBQ0g7RUFDSDtBQUNBLGtDQUFnQyxNQUFNLE9BQU87QUFDL0MsQ0FBQztBQUVJLElBQU0sNkJBQTZCLDBCQUN2QyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLGNBQWM7RUFDOUIsWUFBWTtDQUNiLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxNQUFNLFlBQVc7QUFDN0IsTUFBSSxLQUFLLFVBQVUsYUFBYSxLQUFLLGNBQWMsUUFBVztBQUM1RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFdBQVc7TUFDbEIsU0FBUztLQUNWO0VBQ0g7QUFDQSxNQUFJLEtBQUssVUFBVSxZQUFZLEtBQUssY0FBYyxRQUFXO0FBQzNELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVztNQUNsQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLGtDQUFnQyxNQUFNLE9BQU87QUFDL0MsQ0FBQztBQUVJLElBQU0sa0NBQWtDLGlCQUM1QyxPQUFPO0VBQ04sUUFBUSxpQkFBRSxRQUFRLHlCQUF5QjtFQUMzQyxTQUFTLGlCQUFFLFFBQVEsa0NBQWtDO0VBQ3JELElBQUk7RUFDSixlQUFlO0VBQ2Ysc0JBQXNCO0VBQ3RCLG1CQUFtQjtFQUNuQixTQUFTO0VBQ1QsZUFBZSxpQkFBRSxNQUFNLDBCQUEwQixFQUFFLElBQUksMkJBQTJCO0VBQ2xGLFVBQVU7RUFDVixrQkFBa0I7RUFDbEIsdUJBQXVCO0VBQ3ZCLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFVBQVUsWUFBVztBQUNqQyxNQUFJLFNBQVMsUUFBUSxlQUFlLFNBQVMsbUJBQW1CO0FBQzlELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsV0FBVyxZQUFZO01BQzlCLFNBQ0U7S0FDSDtFQUNIO0FBQ0EsTUFBSSxTQUFTLFFBQVEsb0JBQW9CLElBQUksZUFBZSxTQUFTLElBQUk7QUFDdkUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxXQUFXLHVCQUF1QixPQUFPLFlBQVk7TUFDNUQsU0FBUztLQUNWO0VBQ0g7QUFFQSxRQUFNLGFBQWEsb0JBQUksSUFBWSxDQUFDLFNBQVMsUUFBUSxFQUFFLENBQUM7QUFDeEQsYUFBVyxDQUFDLE9BQU8sSUFBSSxLQUFLLFNBQVMsY0FBYyxRQUFPLEdBQUk7QUFDNUQsUUFBSSxXQUFXLElBQUksS0FBSyxFQUFFLEdBQUc7QUFDM0IsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyxJQUFJO1FBQ25DLFNBQVM7T0FDVjtJQUNIO0FBQ0EsZUFBVyxJQUFJLEtBQUssRUFBRTtBQUN0QixRQUFJLEtBQUssZUFBZSxTQUFTLG1CQUFtQjtBQUNsRCxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLGlCQUFpQixPQUFPLFlBQVk7UUFDM0MsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLEtBQUssb0JBQW9CLElBQUksZUFBZSxTQUFTLElBQUk7QUFDM0QsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxpQkFBaUIsT0FBTyx1QkFBdUIsT0FBTyxZQUFZO1FBQ3pFLFNBQVM7T0FDVjtJQUNIO0VBQ0Y7QUFFQSxRQUFNLFVBQVUsU0FBUztBQUN6QixNQUNFLFFBQVEsSUFBSSxlQUFlLFNBQVMsTUFDcEMsUUFBUSxJQUFJLGtCQUFrQixTQUFTLGlCQUN2QyxRQUFRLElBQUksZUFBZSxTQUFTLHFCQUNwQyxRQUFRLElBQUksYUFBYSxTQUFTLFlBQ2xDLFFBQVEsSUFBSSxtQkFBbUIsU0FBUyx1QkFDeEM7QUFDQSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLG9CQUFvQixLQUFLO01BQ2hDLFNBQVM7S0FDVjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sWUFBWTtFQUNaLElBQUk7RUFDSixlQUFlO0VBQ2Ysc0JBQXNCO0VBQ3RCLG1CQUFtQjtFQUNuQixrQkFBa0I7RUFDbEIsVUFBVTtFQUNWLGtCQUFrQjtFQUNsQixrQkFBa0I7RUFDbEIsdUJBQXVCO0VBQ3ZCLFdBQVc7RUFDWCxXQUFXO0NBQ1osRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixRQUFNLGNBQWMsTUFBTTtBQUMxQixNQUNFLFlBQVksSUFBSSxlQUFlLE1BQU0sY0FDckMsWUFBWSxJQUFJLFlBQVksTUFBTSxNQUNsQyxZQUFZLElBQUksa0JBQWtCLE1BQU0saUJBQ3hDLFlBQVksSUFBSSxlQUFlLE1BQU0scUJBQ3JDLFlBQVksSUFBSSxhQUFhLE1BQU0sa0JBQ25DO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxvQkFBb0IsS0FBSztNQUNoQyxTQUFTO0tBQ1Y7RUFDSDtBQUNBLFFBQU0sVUFBVSxNQUFNO0FBQ3RCLE1BQ0UsUUFBUSxJQUFJLFlBQVksTUFBTSxNQUM5QixDQUFDLGdDQUFnQyxRQUFRLEdBQUcsS0FDNUMsUUFBUSxJQUFJLGFBQWEsTUFBTSxNQUMvQixRQUFRLElBQUksa0JBQWtCLE1BQU0saUJBQ3BDLFFBQVEsSUFBSSxlQUFlLE1BQU0scUJBQ2pDLFFBQVEsSUFBSSxhQUFhLE1BQU0sWUFDL0IsUUFBUSxJQUFJLG1CQUFtQixNQUFNLHVCQUNyQztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsb0JBQW9CLEtBQUs7TUFDaEMsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUgsU0FBUyxnQ0FDUCxPQUF3RDtBQUV4RCxTQUNFLE1BQU0sZUFBZSx1QkFBdUIsTUFBTSxZQUFZO0FBRWxFO0FBRU8sSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixRQUFRLGlCQUFFLFFBQVEsOEJBQThCO0VBQ2hELFNBQVMsaUJBQUUsUUFBUSxrQ0FBa0M7RUFDckQsVUFBVTtFQUNWLFFBQVEsaUJBQUUsT0FBTyxlQUFlLDJCQUEyQjtDQUM1RCxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsV0FBVyxZQUFXO0FBQ2xDLFFBQU0sVUFBVSxPQUFPLFFBQVEsVUFBVSxNQUFNO0FBQy9DLE1BQUksUUFBUSxTQUFTLHFCQUFxQjtBQUN4QyxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLFFBQVE7TUFDZixTQUFTO0tBQ1Y7RUFDSDtBQUNBLGFBQVcsQ0FBQyxTQUFTLEtBQUssS0FBSyxTQUFTO0FBQ3RDLFFBQUksWUFBWSxNQUFNLElBQUk7QUFDeEIsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLE1BQU0sQ0FBQyxVQUFVLE9BQU87UUFDeEIsU0FBUztPQUNWO0lBQ0g7QUFDQSxRQUFJLE1BQU0sZUFBZSxVQUFVLFNBQVMsSUFBSTtBQUM5QyxjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sTUFBTSxDQUFDLFVBQVUsU0FBUyxZQUFZO1FBQ3RDLFNBQVM7T0FDVjtJQUNIO0VBQ0Y7QUFDRixDQUFDO0FBRUgsU0FBUyxnQ0FDUCxNQUtBLFNBQThCO0FBRTlCLFFBQU0sV0FBVyxLQUFLO0FBQ3RCLE1BQUksU0FBUyxJQUFJLGFBQWEsS0FBSyxJQUFJO0FBQ3JDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsdUJBQXVCLE9BQU8sVUFBVTtNQUMvQyxTQUFTO0tBQ1Y7RUFDSDtBQUNBLE1BQUksU0FBUyxlQUFlLEtBQUssWUFBWTtBQUMzQyxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLHVCQUF1QixZQUFZO01BQzFDLFNBQVM7S0FDVjtFQUNIO0FBQ0Y7OztBQ3JaTyxJQUFNLDJCQUEyQixpQkFDckMsV0FBVyxVQUFVLEVBQ3JCLE9BQU8sQ0FBQyxVQUFVLE1BQU0sZUFBZSxJQUFJO0VBQzFDLE9BQU87Q0FDUixFQUNBLE1BQUs7QUFFRCxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLFNBQVM7RUFDVCxVQUFVO0VBQ1YsV0FBVztDQUNaLEVBQ0EsT0FBTTtBQUdGLElBQU0sZ0NBQWdDLGlCQUMxQyxXQUFXLFVBQVUsRUFDckIsT0FBTyxDQUFDLFVBQVUsTUFBTSxlQUFlLElBQUk7RUFDMUMsT0FBTztDQUNSLEVBQ0EsTUFBSztBQUdELElBQU0saUNBQWlDLGlCQUMzQyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUztFQUNULFVBQVU7RUFDVixTQUFTLGlCQUFFLFFBQVEsYUFBYTtDQUNqQyxFQUNBLE9BQU07OztBQ3JCRixJQUFNLGlDQUFpQztBQUN2QyxJQUFNLHlCQUF5QjtBQUUvQixJQUFNLHNCQUFzQjtBQUM1QixJQUFNLG9CQUFvQjtBQUMxQixJQUFNLDJCQUEyQjtBQUNqQyxJQUFNLHVCQUF1QjtBQUM3QixJQUFNLDJCQUEyQjtBQUNqQyxJQUFNLDhCQUE4QjtBQUNwQyxJQUFNLHFCQUFxQjtBQUMzQixJQUFNLDRCQUE0QjtBQUNsQyxJQUFNLDBCQUEwQjtBQUNoQyxJQUFNLDJCQUEyQjtBQUNqQyxJQUFNLHlCQUF5QjtBQUMvQixJQUFNLHlCQUF5QixLQUFLLEtBQUssS0FBSyxLQUFLO0FBQ25ELElBQU0sZ0NBQWdDLE1BQU07QUFFbkQsSUFBTSxpQ0FBaUMsb0JBQUksSUFBSTtFQUM3QztFQUNBO0VBQ0E7Q0FDRDtBQUdNLElBQU0sNEJBQTRCLGlCQUN0QyxPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSw4QkFBOEIsRUFHbEMsT0FBTyxDQUFDLFVBQVUsQ0FBQyx5QkFBeUIsS0FBSyxLQUFLLEdBQUc7RUFDeEQsU0FBUztDQUNWLEVBQ0EsT0FBTyxDQUFDLFVBQVUsTUFBTSxLQUFJLE1BQU8sT0FBTztFQUN6QyxTQUFTO0NBQ1YsRUFDQSxPQUFPLENBQUMsVUFBVSxDQUFDLCtCQUErQixJQUFJLEtBQUssR0FBRztFQUM3RCxTQUFTO0NBQ1Y7QUFHSSxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksRUFBRSxFQUNOLE1BQU0saUNBQWlDLDBCQUEwQjtBQUU3RCxJQUFNLDJDQUNYO0FBR0ssSUFBTSxnQ0FBZ0MsaUJBQzFDLE9BQU0sRUFDTixNQUNDLElBQUksT0FBTyx3Q0FBd0MsR0FDbkQsbUNBQW1DO0FBUWhDLElBQU0sb0JBQW9CLGlCQUM5QixPQUFNLEVBQ04sSUFBSSxDQUFDLEVBQ0wsSUFBSSxHQUFHLEVBQ1AsTUFDQyxrQ0FDQSw2Q0FBNkM7QUFJMUMsSUFBTSxxQkFBcUIsaUJBQy9CLE9BQU0sRUFDTixJQUFJLENBQUMsRUFDTCxJQUFJLEVBQUUsRUFDTixNQUFNLG1DQUFtQyx1QkFBdUI7QUFFbkUsSUFBTSxnQkFBZ0IsSUFBSSxPQUFPLHdCQUF3QjtBQUdsRCxJQUFNLHlCQUF5QixpQkFDbkMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksR0FBRyxFQUNQLE1BQU0sZUFBZSw4QkFBOEI7QUFHL0MsSUFBTSx3QkFBd0IsaUJBQ2xDLE9BQU0sRUFDTixNQUFNLG1CQUFtQix3Q0FBd0M7QUFFN0QsSUFBTSwwQkFBMEI7QUFFdkMsSUFBTSxrQkFBa0IsSUFBSSxPQUFPLHVCQUF1QjtBQUduRCxJQUFNLGlCQUFpQixpQkFBRSxPQUFNLEVBQUcsTUFBTSxpQkFBaUIsa0JBQWtCO0FBTzVFLFNBQVUsa0JBQWtCLE9BQWE7QUFDN0MsTUFBSSxDQUFDLGdCQUFnQixLQUFLLEtBQUs7QUFBRyxXQUFPO0FBQ3pDLFFBQU0sUUFBUSxnQkFBZ0IsS0FBSyxLQUFLO0FBQ3hDLFFBQU0sYUFBYSxRQUFRLENBQUM7QUFDNUIsUUFBTSxPQUFPLFFBQVEsQ0FBQztBQUN0QixNQUFJLGVBQWUsVUFBYSxTQUFTO0FBQVcsV0FBTztBQUMzRCxRQUFNLFNBQVMsT0FBTyxVQUFVO0FBQ2hDLE1BQUksQ0FBQyxPQUFPLGNBQWMsTUFBTSxLQUFLLFVBQVU7QUFBRyxXQUFPO0FBQ3pELFFBQU0sYUFBYSxpQkFBaUIsSUFBSTtBQUN4QyxNQUFJLGVBQWU7QUFBVyxXQUFPO0FBQ3JDLFFBQU0sVUFBVSxTQUFTO0FBQ3pCLFNBQU8sV0FBVyx5QkFBeUIsVUFBVTtBQUN2RDtBQUVBLElBQU0sbUJBQXFELE9BQU8sT0FBTztFQUN2RSxHQUFHO0VBQ0gsR0FBRztFQUNILEdBQUc7RUFDSCxHQUFHO0NBQ0o7QUFNTSxJQUFNLGdDQUFnQyxpQkFBRSxNQUFNO0VBQ25ELGlCQUFFLFFBQU87RUFDVCxpQkFBRSxNQUFNLGtCQUFrQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksdUJBQXVCO0NBQy9EO0FBRU0sSUFBTSx3QkFBd0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEdBQVM7QUFHbkUsSUFBTSx5QkFBeUIsaUJBQ25DLE9BQU0sRUFDTixJQUFJLENBQUMsRUFDTCxJQUFJLElBQUssRUFHVCxPQUFPLENBQUMsVUFBVSxDQUFDLHlCQUF5QixLQUFLLEtBQUssR0FBRztFQUN4RCxTQUFTO0NBQ1Y7QUFPSSxJQUFNLHdCQUF3QixpQkFDbEMsT0FBTztFQUNOLFFBQVEsMEJBQTBCLFNBQVE7RUFDMUMsVUFBVSxpQkFBRSxNQUFNLGlCQUFpQixFQUFFLElBQUksQ0FBQyxFQUFFLElBQUksc0JBQXNCLEVBQUUsU0FBUTtFQUNoRixRQUFRLGlCQUFFLE9BQU8sbUJBQW1CLHFCQUFxQixFQUFFLFNBQVE7RUFDbkUsS0FBSyw4QkFBOEIsU0FBUTtFQUMzQyxRQUFRLGlCQUFFLFFBQU8sRUFBRyxTQUFRO0VBQzVCLEtBQUssZUFBZSxTQUFRO0VBQzVCLFNBQVMsc0JBQXNCLFNBQVE7RUFDdkMscUJBQXFCLDhCQUE4QixTQUFROztFQUUzRCxrQkFBa0IsdUJBQXVCLFNBQVE7RUFDakQsTUFBTSxpQkFBRSxRQUFPLEVBQUcsU0FBUTtDQUMzQixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsT0FBTyxZQUFXO0FBQzlCLFFBQU0sT0FBTyxNQUFNLFNBQVM7QUFDNUIsTUFBSSxDQUFDLE1BQU07QUFDVCxRQUFJLE1BQU0sV0FBVyxRQUFXO0FBQzlCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFFBQVE7T0FDaEI7SUFDSDtBQUNBLFFBQUksTUFBTSxhQUFhLFFBQVc7QUFDaEMsY0FBUSxTQUFTO1FBQ2YsTUFBTTtRQUNOLFNBQVM7UUFDVCxNQUFNLENBQUMsVUFBVTtPQUNsQjtJQUNIO0VBQ0YsT0FBTztBQUNMLGVBQVcsU0FBUztNQUNsQjtNQUNBO01BQ0E7TUFDQTtNQUNBO01BQ0E7T0FDVTtBQUNWLFVBQUksTUFBTSxLQUFLLE1BQU0sUUFBVztBQUM5QixnQkFBUSxTQUFTO1VBQ2YsTUFBTTtVQUNOLFNBQVM7VUFDVCxNQUFNLENBQUMsS0FBSztTQUNiO01BQ0g7SUFDRjtFQUNGO0FBQ0EsTUFBSSxNQUFNLFdBQVcsVUFBYSxNQUFNLGFBQWE7QUFBVztBQUNoRSxRQUFNLFdBQVcsSUFBSSxJQUFJLE1BQU0sUUFBUTtBQUN2QyxhQUFXLFVBQVUsT0FBTyxLQUFLLE1BQU0sTUFBTSxHQUFHO0FBQzlDLFFBQUksQ0FBQyxTQUFTLElBQUksTUFBTSxHQUFHO0FBQ3pCLGNBQVEsU0FBUztRQUNmLE1BQU07UUFDTixTQUFTO1FBQ1QsTUFBTSxDQUFDLFFBQVE7T0FDaEI7QUFDRDtJQUNGO0VBQ0Y7QUFDRixDQUFDO0FBU0csU0FBVSxnQ0FBZ0MsT0FBYztBQUM1RCxNQUFJLENBQUMsY0FBYyxLQUFLO0FBQUcsV0FBTztBQUNsQyxNQUFJLFVBQVU7QUFDZCxRQUFNLFNBQWtDLENBQUE7QUFDeEMsYUFBVyxDQUFDLEtBQUssVUFBVSxLQUFLLE9BQU8sUUFBUSxLQUFLLEdBQUc7QUFDckQsUUFBSSxRQUFRLHdCQUF3QjtBQUNsQyxhQUFPLHFCQUFxQixNQUFNO0FBQ2xDLGdCQUFVO0FBQ1Y7SUFDRjtBQUNBLFFBQUksUUFBUSxZQUFZO0FBQ3RCLGFBQU8sU0FBUyxNQUFNO0FBQ3RCLGdCQUFVO0FBQ1Y7SUFDRjtBQUNBLFdBQU8sR0FBRyxJQUFJO0VBQ2hCO0FBQ0EsU0FBTyxVQUFVLFNBQVM7QUFDNUI7QUFFQSxTQUFTLGNBQWMsT0FBYztBQUNuQyxTQUFPLE9BQU8sVUFBVSxZQUFZLFVBQVUsUUFBUSxDQUFDLE1BQU0sUUFBUSxLQUFLO0FBQzVFO0FBTU0sU0FBVSw4QkFBOEIsT0FBYztBQUMxRCxNQUFJLENBQUMsY0FBYyxLQUFLO0FBQUcsV0FBTztBQUNsQyxNQUFJLFdBQW9DO0FBQ3hDLE1BQUksVUFBVTtBQUVkLFFBQU0sV0FBVyxjQUFjLFNBQVMsVUFBVSxDQUFDO0FBQ25ELE1BQUksU0FBUyxTQUFTO0FBQ3BCLGVBQVcsRUFBRSxHQUFHLFVBQVUsVUFBVSxTQUFTLElBQUc7QUFDaEQsY0FBVTtFQUNaO0FBRUEsTUFBSSxjQUFjLFNBQVMsUUFBUSxDQUFDLEdBQUc7QUFDckMsVUFBTSxTQUFrQyxDQUFBO0FBQ3hDLFFBQUksZ0JBQWdCO0FBQ3BCLGVBQVcsQ0FBQyxTQUFTLEtBQUssS0FBSyxPQUFPLFFBQVEsU0FBUyxRQUFRLENBQUMsR0FBRztBQUNqRSxVQUFJLENBQUMsY0FBYyxLQUFLLEdBQUc7QUFDekIsZUFBTyxPQUFPLElBQUk7QUFDbEI7TUFDRjtBQUNBLFlBQU0sY0FBYyxjQUFjLE1BQU0sYUFBYSxDQUFDO0FBQ3RELFVBQUksWUFBWSxTQUFTO0FBQ3ZCLGVBQU8sT0FBTyxJQUFJLEVBQUUsR0FBRyxPQUFPLENBQUMsYUFBYSxHQUFHLFlBQVksSUFBRztBQUM5RCx3QkFBZ0I7QUFDaEI7TUFDRjtBQUNBLGFBQU8sT0FBTyxJQUFJO0lBQ3BCO0FBQ0EsUUFBSSxlQUFlO0FBQ2pCLGlCQUFXLEVBQUUsR0FBRyxVQUFVLE9BQU07QUFDaEMsZ0JBQVU7SUFDWjtFQUNGO0FBRUEsTUFBSSxjQUFjLFNBQVMsY0FBYyxDQUFDLEdBQUc7QUFDM0MsVUFBTSxlQUF3QyxDQUFBO0FBQzlDLFFBQUksc0JBQXNCO0FBQzFCLGVBQVcsQ0FBQyxlQUFlLFdBQVcsS0FBSyxPQUFPLFFBQ2hELFNBQVMsY0FBYyxDQUFDLEdBQ3ZCO0FBQ0QsVUFBSSxDQUFDLGNBQWMsV0FBVyxHQUFHO0FBQy9CLHFCQUFhLGFBQWEsSUFBSTtBQUM5QjtNQUNGO0FBQ0EsWUFBTUEsWUFBVyxjQUFjLFlBQVksVUFBVSxDQUFDO0FBQ3RELFVBQUlBLFVBQVMsU0FBUztBQUNwQixxQkFBYSxhQUFhLElBQUksRUFBRSxHQUFHLGFBQWEsQ0FBQyxVQUFVLEdBQUdBLFVBQVMsSUFBRztBQUMxRSw4QkFBc0I7QUFDdEI7TUFDRjtBQUNBLG1CQUFhLGFBQWEsSUFBSTtJQUNoQztBQUNBLFFBQUkscUJBQXFCO0FBQ3ZCLGlCQUFXLEVBQUUsR0FBRyxVQUFVLGFBQVk7QUFDdEMsZ0JBQVU7SUFDWjtFQUNGO0FBRUEsU0FBTyxVQUFVLFdBQVc7QUFDOUI7QUFFQSxTQUFTLGNBQ1AsVUFBaUI7QUFFakIsTUFBSSxDQUFDLGNBQWMsUUFBUTtBQUFHLFdBQU8sRUFBRSxTQUFTLE9BQU8sS0FBSyxTQUFRO0FBQ3BFLFFBQU0sT0FBZ0MsQ0FBQTtBQUN0QyxNQUFJLFVBQVU7QUFDZCxhQUFXLENBQUMsS0FBSyxLQUFLLEtBQUssT0FBTyxRQUFRLFFBQVEsR0FBRztBQUNuRCxVQUFNLGFBQWEsZ0NBQWdDLEtBQUs7QUFDeEQsUUFBSSxlQUFlO0FBQU8sZ0JBQVU7QUFDcEMsU0FBSyxHQUFHLElBQUk7RUFDZDtBQUNBLFNBQU8sVUFBVSxFQUFFLFNBQVMsTUFBTSxLQUFLLEtBQUksSUFBSyxFQUFFLFNBQVMsT0FBTyxLQUFLLFNBQVE7QUFDakY7QUFFTyxJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLFNBQVMsaUJBQ04sT0FBTywrQkFBK0IseUJBQXlCLEVBQy9ELFNBQVE7RUFDWCxVQUFVLGlCQUFFLE9BQU8sd0JBQXdCLHFCQUFxQixFQUFFLFNBQVE7Q0FDM0UsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLGFBQWEsWUFBVztBQUNwQyxPQUNHLFlBQVksWUFBWSxTQUNyQixJQUNBLE9BQU8sS0FBSyxZQUFZLE9BQU8sRUFBRSxVQUFVLDZCQUMvQztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFNBQVM7S0FDakI7RUFDSDtBQUNBLE9BQ0csWUFBWSxhQUFhLFNBQ3RCLElBQ0EsT0FBTyxLQUFLLFlBQVksUUFBUSxFQUFFLFVBQVUsMkJBQ2hEO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsVUFBVTtLQUNsQjtFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0scUJBQXFCLGlCQUMvQixPQUFPO0VBQ04sYUFBYSxpQkFBRSxPQUFPLHdCQUF3QixxQkFBcUI7Q0FDcEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLE9BQU8sWUFBVztBQUM5QixNQUFJLE9BQU8sS0FBSyxNQUFNLFdBQVcsRUFBRSxTQUFTLEdBQUc7QUFDN0MsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsYUFBYTtLQUNyQjtFQUNIO0FBQ0EsTUFBSSxPQUFPLEtBQUssTUFBTSxXQUFXLEVBQUUsU0FBUywyQkFBMkI7QUFDckUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsYUFBYTtLQUNyQjtFQUNIO0FBQ0YsQ0FBQztBQVFJLElBQU0sOEJBQThCLGlCQUN4QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUyxXQUFXLFNBQVE7RUFDNUIsY0FBYyxpQkFBRSxPQUFPLHVCQUF1Qix3QkFBd0IsRUFBRSxTQUFRO0VBQ2hGLFVBQVUsaUJBQUUsT0FBTyx3QkFBd0IscUJBQXFCLEVBQUUsU0FBUTtFQUMxRSxRQUFRLGlCQUFFLE9BQU8sd0JBQXdCLGtCQUFrQixFQUFFLFNBQVE7Q0FDdEUsRUFDQSxPQUFNLEVBQ04sWUFBWSxDQUFDLFVBQVUsWUFBVztBQUNqQyxPQUNHLFNBQVMsaUJBQWlCLFNBQ3ZCLElBQ0EsT0FBTyxLQUFLLFNBQVMsWUFBWSxFQUFFLFVBQVUsMEJBQ2pEO0FBQ0EsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsY0FBYztLQUN0QjtFQUNIO0FBQ0EsT0FDRyxTQUFTLFdBQVcsU0FBWSxJQUFJLE9BQU8sS0FBSyxTQUFTLE1BQU0sRUFBRSxVQUNsRSxvQkFDQTtBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFFBQVE7S0FDaEI7RUFDSDtBQUNBLFFBQU0sZUFDSCxTQUFTLGFBQWEsU0FBWSxJQUFJLE9BQU8sS0FBSyxTQUFTLFFBQVEsRUFBRSxVQUN0RSxPQUFPLE9BQU8sU0FBUyxnQkFBZ0IsQ0FBQSxDQUFFLEVBQUUsT0FDekMsQ0FBQyxPQUFPLGdCQUNOLFNBQ0MsWUFBWSxhQUFhLFNBQ3RCLElBQ0EsT0FBTyxLQUFLLFlBQVksUUFBUSxFQUFFLFNBQ3hDLENBQUM7QUFFTCxNQUFJLGNBQWMsc0JBQXNCO0FBQ3RDLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVU7S0FDbEI7RUFDSDtBQUNGLENBQUM7QUFNSSxJQUFNLG1CQUFtQixpQkFBRSxLQUFLLENBQUMsUUFBUSxPQUFPLENBQUM7QUFHakQsSUFBTSxvQkFBb0IsaUJBQzlCLE9BQU87RUFDTixTQUFTO0VBQ1QsUUFBUTtFQUNSLE9BQU87RUFDUCxVQUFVLGlCQUFFLE1BQU0saUJBQWlCLEVBQUUsSUFBSSxDQUFDLEVBQUUsSUFBSSxzQkFBc0I7RUFDdEUsUUFBUSxpQkFBRSxPQUFPLG1CQUFtQixxQkFBcUIsRUFBRSxTQUFRO0VBQ25FLEtBQUssOEJBQThCLFNBQVE7RUFDM0MsbUJBQW1CLHVCQUF1QixTQUFRO0VBQ2xELG9CQUFvQix1QkFBdUIsU0FBUTtFQUNuRCxXQUFXO0VBQ1gsV0FBVyxnQkFBZ0IsU0FBUTtFQUNuQyxTQUFTLHNCQUFzQixTQUFRO0VBQ3ZDLFdBQVcsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQ3ZDLFlBQVksZ0JBQWdCLFNBQVE7RUFDcEMsV0FBVyxnQkFBZ0IsU0FBUTtDQUNwQyxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsT0FBTyxZQUFXO0FBQzlCLE1BQUksTUFBTSxZQUFZLFVBQWEsTUFBTSxZQUFZLE1BQU0sU0FBUztBQUNsRSxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxXQUFXO0tBQ25CO0VBQ0g7QUFDQSxNQUFJLE1BQU0sY0FBYyxVQUFhLE1BQU0sYUFBYSxNQUFNLFdBQVc7QUFDdkUsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLFNBQVM7TUFDVCxNQUFNLENBQUMsV0FBVztLQUNuQjtFQUNIO0FBQ0EsTUFBSSxNQUFNLGNBQWMsVUFBYSxNQUFNLFlBQVksTUFBTSxXQUFXO0FBQ3RFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFdBQVc7S0FDbkI7RUFDSDtBQUNBLE1BQUksTUFBTSxXQUFXO0FBQVc7QUFDaEMsUUFBTSxXQUFXLElBQUksSUFBSSxNQUFNLFFBQVE7QUFDdkMsYUFBVyxVQUFVLE9BQU8sS0FBSyxNQUFNLE1BQU0sR0FBRztBQUM5QyxRQUFJLENBQUMsU0FBUyxJQUFJLE1BQU0sR0FBRztBQUN6QixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxRQUFRO09BQ2hCO0FBQ0Q7SUFDRjtFQUNGO0FBQ0YsQ0FBQztBQUtJLElBQU0sMkJBQTJCLGlCQUNyQyxPQUFPO0VBQ04sWUFBWTtFQUNaLFdBQVc7Q0FDWixFQUNBLE9BQU07QUFJRixJQUFNLHlCQUF5QixPQUFPLE9BQU87RUFDbEQ7RUFDQTtFQUNBO0NBQ1E7QUFFSCxJQUFNLDJCQUEyQixPQUFPLE9BQU87RUFDcEQ7Q0FDUTtBQUVILElBQU0sd0JBQXdCLE9BQU8sT0FBTztFQUNqRDtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtDQUNRO0FBRUgsSUFBTSw0QkFBNEIsaUJBQUUsS0FBSztFQUM5QyxHQUFHO0VBQ0gsR0FBRztFQUNILEdBQUc7Q0FDSjtBQUtNLElBQU0sOEJBQThCLGlCQUFFLG1CQUFtQixXQUFXO0VBQ3pFLGlCQUNHLE9BQU87SUFDTixTQUFTLGlCQUFFLFFBQVEsT0FBTztJQUMxQixRQUFRLGlCQUFFLEtBQUssc0JBQXNCO0lBQ3JDLFVBQVUsdUJBQXVCLFNBQVE7SUFDekMsU0FBUyx1QkFBdUIsU0FBUTtJQUN4QyxRQUFRLDBCQUEwQixTQUFRO0dBQzNDLEVBQ0EsT0FBTTtFQUNULGlCQUNHLE9BQU87SUFDTixTQUFTLGlCQUFFLFFBQVEsU0FBUztJQUM1QixRQUFRLGlCQUFFLEtBQUssd0JBQXdCO0lBQ3ZDLFVBQVUsdUJBQXVCLFNBQVE7SUFDekMsUUFBUSwwQkFBMEIsU0FBUTtHQUMzQyxFQUNBLE9BQU07RUFDVCxpQkFDRyxPQUFPO0lBQ04sU0FBUyxpQkFBRSxRQUFRLE1BQU07SUFDekIsUUFBUSxpQkFBRSxLQUFLLHFCQUFxQjtJQUNwQyxVQUFVLHVCQUF1QixTQUFRO0lBQ3pDLFNBQVMsdUJBQXVCLFNBQVE7SUFDeEMsUUFBUSwwQkFBMEIsU0FBUTtHQUMzQyxFQUNBLE9BQU07Q0FDVjtBQUlNLElBQU0sMEJBQTBCLGlCQUFFLEtBQUssQ0FBQyxRQUFRLE9BQU8sQ0FBQztBQUV4RCxJQUFNLDJCQUEyQixpQkFBRSxLQUFLO0VBQzdDO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFRCxJQUFNLDZCQUE2QixpQkFDaEMsT0FBTSxFQUNOLElBQUksQ0FBQyxFQUNMLElBQUksc0JBQXNCLEVBRzFCLE9BQU8sQ0FBQyxVQUFVLENBQUMseUJBQXlCLEtBQUssS0FBSyxHQUFHO0VBQ3hELFNBQVM7Q0FDVjtBQU1JLElBQU0sMEJBQTBCLGlCQUNwQyxPQUFPO0VBQ04sS0FBSyxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVE7RUFDOUIsWUFBWTtFQUNaLE9BQU87RUFDUCxRQUFRO0VBQ1IsVUFBVSx1QkFBdUIsU0FBUTtFQUN6QyxTQUFTLHVCQUF1QixTQUFRO0VBQ3hDLGVBQWUsdUJBQXVCLFNBQVE7RUFDOUMsUUFBUSwwQkFBMEIsU0FBUTtFQUMxQyxTQUFTLGtCQUFrQixTQUFRO0VBQ25DLGFBQWEsaUJBQ1YsTUFBTSwwQkFBMEIsRUFDaEMsSUFBSSx3QkFBd0IsRUFDNUIsU0FBUTtFQUNYLFVBQVUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxJQUFJLFdBQVcsRUFBRSxJQUFJLFVBQVUsRUFBRSxTQUFRO0VBQ3BFLFFBQVEsMEJBQTBCLFNBQVE7Q0FDM0MsRUFDQSxPQUFNO0FBTUYsSUFBTSwrQkFBK0IsaUJBQUUsS0FBSyxDQUFDLFlBQVksT0FBTyxDQUFDO0FBSWpFLElBQU0saUNBQWlDLGlCQUFFLFFBQzlDLCtCQUErQjtBQUkxQixJQUFNLHFDQUFxQyxpQkFDL0MsT0FBTztFQUNOLFFBQVE7RUFDUixXQUFXO0VBQ1gsU0FBUztFQUNULFVBQVUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0NBQ3ZDLEVBQ0EsT0FBTTtBQU9GLElBQU0sbUNBQW1DLGlCQUM3QyxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsVUFBVSxpQkFBRSxPQUFPLHdCQUF3Qix3QkFBd0I7RUFDbkUsUUFBUSxpQkFBRSxPQUFPLGVBQWUsaUJBQWlCO0VBQ2pELE9BQU8saUJBQUUsTUFBTSx1QkFBdUIsRUFBRSxJQUFJLHdCQUF3QjtDQUNyRSxFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsT0FBTyxZQUFXO0FBQzlCLE1BQUksT0FBTyxLQUFLLE1BQU0sUUFBUSxFQUFFLFNBQVMscUJBQXFCO0FBQzVELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFVBQVU7S0FDbEI7RUFDSDtBQUNBLE1BQUksT0FBTyxLQUFLLE1BQU0sTUFBTSxFQUFFLFNBQVMsbUJBQW1CO0FBQ3hELFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLFFBQVE7S0FDaEI7RUFDSDtBQUNGLENBQUM7QUFNSSxJQUFNLGlDQUFpQyxpQkFBRSxRQUFRLDRCQUE0QjtBQU83RSxJQUFNLG1DQUFtQyxpQkFDN0MsT0FBTztFQUNOLFFBQVE7RUFDUixTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixXQUFXO0VBQ1gsU0FBUztFQUNULFVBQVUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQ3RDLFdBQVc7RUFDWCxXQUFXO0VBQ1gsT0FBTyxnQkFBZ0IsT0FBTywwQkFBMEI7RUFDeEQsWUFBWTtFQUNaLG1CQUFtQixnQkFBZ0IsT0FBTyx1Q0FBdUM7Q0FDbEYsRUFDQSxPQUFNO0FBUVQsSUFBTSx1QkFDSjtBQUVLLElBQU0sMEJBQTBCO0FBQ2hDLElBQU0sdUJBQXVCO0FBQzdCLElBQU0seUJBQXlCLElBQUksT0FBTztBQUcxQyxJQUFNLDJCQUEyQixpQkFDckMsT0FBTztFQUNOLEdBQUcsaUJBQUUsUUFBUSxDQUFDO0VBQ2QsT0FBTyxpQkFBRSxPQUFNLEVBQUcsSUFBSSxFQUFFLEVBQUUsSUFBSSxHQUFHO0VBQ2pDLElBQUksaUJBQUUsUUFBUSxNQUFNO0VBQ3BCLFlBQVk7RUFDWixNQUFNLGlCQUNILE1BQU0saUJBQUUsT0FBTSxFQUFHLElBQUksQ0FBQyxFQUFFLElBQUksb0JBQW9CLENBQUMsRUFDakQsSUFBSSxDQUFDLEVBQ0wsSUFBSSx1QkFBdUI7Q0FDL0IsRUFDQSxPQUFNO0FBS0YsSUFBTSxpQ0FBaUMsaUJBQzNDLE9BQU87RUFDTixHQUFHLGlCQUFFLFFBQVEsQ0FBQztFQUNkLE9BQU8saUJBQUUsUUFBUSxVQUFVO0VBQzNCLFNBQVMsaUJBQUUsS0FBSyxDQUFDLFNBQVMsTUFBTSxDQUFDO0VBQ2pDLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFFRixJQUFNLCtCQUErQixpQkFDekMsT0FBTztFQUNOLEdBQUcsaUJBQUUsUUFBUSxDQUFDO0VBQ2QsT0FBTyxpQkFBRSxLQUFLLENBQUMsVUFBVSxRQUFRLENBQUM7RUFDbEMsTUFBTSxpQkFBRSxPQUFNLEVBQUcsTUFBTSxzQkFBc0IsOEJBQThCO0NBQzVFLEVBQ0EsT0FBTTtBQUVGLElBQU0sNkJBQTZCLGlCQUN2QyxPQUFPO0VBQ04sR0FBRyxpQkFBRSxRQUFRLENBQUM7RUFDZCxPQUFPLGlCQUFFLFFBQVEsTUFBTTtFQUN2QixVQUFVLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsSUFBSSxXQUFXLEVBQUUsSUFBSSxVQUFVLEVBQUUsU0FBUTtFQUNwRSxRQUFRLGlCQUFFLE9BQU0sRUFBRyxJQUFJLENBQUMsRUFBRSxJQUFJLEVBQUUsRUFBRSxTQUFRO0NBQzNDLEVBQ0EsT0FBTTtBQUVGLElBQU0sK0JBQStCLGlCQUFFLG1CQUFtQixTQUFTO0VBQ3hFO0VBQ0E7RUFDQTtDQUNEO0FBS00sSUFBTSwrQkFBK0IsaUJBQUUsbUJBQW1CLFNBQVM7RUFDeEUsaUJBQ0csT0FBTztJQUNOLEdBQUcsaUJBQUUsUUFBUSxDQUFDO0lBQ2QsT0FBTyxpQkFBRSxRQUFRLE9BQU87SUFDeEIsTUFBTSxpQkFBRSxPQUFNLEVBQUcsTUFBTSxvQkFBb0I7R0FDNUMsRUFDQSxPQUFNO0VBQ1QsaUJBQUUsT0FBTyxFQUFFLEdBQUcsaUJBQUUsUUFBUSxDQUFDLEdBQUcsT0FBTyxpQkFBRSxRQUFRLGFBQWEsRUFBQyxDQUFFLEVBQUUsT0FBTTtDQUN0RTs7O0FDdnhCTSxJQUFNLGlDQUFpQyxpQkFBRSxLQUFLO0VBQ25EO0VBQ0E7RUFDQTtFQUNBO0NBQ0Q7QUFFRCxJQUFNLDRCQUE0QixpQkFDL0IsT0FBTSxFQUNOLElBQUksRUFBRSxFQUNOLElBQUksR0FBRyxFQUNQLE1BQU0sZ0NBQWdDO0FBRWxDLElBQU0sNkNBQTZDLGlCQUN2RCxPQUFPO0VBQ04sU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsU0FBUztFQUNULGFBQWE7RUFDYixjQUFjO0VBQ2QsbUJBQW1CO0VBQ25CLGdCQUFnQjtFQUNoQixnQkFBZ0I7RUFDaEIsa0JBQWtCO0VBQ2xCLHVCQUF1QjtFQUN2QixrQkFBa0I7RUFDbEIsT0FBTztDQUNSLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxTQUFTLFlBQVc7QUFDaEMsTUFBSSxRQUFRLGlCQUFpQixRQUFRLG1CQUFtQjtBQUN0RCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sTUFBTSxDQUFDLG1CQUFtQjtNQUMxQixTQUFTO0tBQ1Y7RUFDSDtBQUNBLFFBQU0sU0FBUztJQUNiLFVBQVU7SUFDVixxQkFBcUI7SUFDckIsb0JBQW9CO0lBQ3BCLFdBQVc7SUFDWCxRQUFRLEtBQUs7QUFDZixNQUFJLFFBQVEsaUJBQWlCLFdBQVcsUUFBUSxnQkFBZ0I7QUFDOUQsWUFBUSxTQUFTO01BQ2YsTUFBTTtNQUNOLE1BQU0sQ0FBQyxnQkFBZ0I7TUFDdkIsU0FBUztLQUNWO0VBQ0g7QUFDRixDQUFDO0FBRUksSUFBTSxzQ0FBc0MsaUJBQ2hELE9BQU87RUFDTixTQUFTO0VBQ1QsbUJBQW1CO0NBQ3BCLEVBQ0EsT0FBTTtBQVlGLElBQU0sc0NBQXNDLGlCQUFFLEtBQUs7RUFDeEQ7RUFDQTtDQUNEO0FBRUQsSUFBTSxxQkFBcUIsY0FBYyxPQUN2QyxDQUFDLFNBQWtDLEtBQUssU0FBUyxnQkFDakQ7RUFDRSxPQUFPO0NBQ1I7QUFHSSxJQUFNLHlDQUF5QyxpQkFDbkQsT0FBTztFQUNOLFNBQVMsaUJBQUUsUUFBUSxDQUFDO0VBQ3BCLE1BQU0saUJBQUUsUUFBUSx1QkFBdUI7RUFDdkMsYUFBYTtFQUNiLFNBQVM7RUFDVCxVQUFVO0VBQ1YsT0FBTztFQUNQLFlBQVk7RUFDWixZQUFZO0VBQ1osaUJBQWlCO0VBQ2pCLGdCQUFnQjtFQUNoQixXQUFXO0VBQ1gsV0FBVztFQUNYLFlBQVk7Q0FDYixFQUNBLE9BQU0sRUFDTixZQUFZLENBQUMsUUFBUSxZQUFXO0FBQy9CLFFBQU0sMkJBQ0osT0FBTyxVQUFVLGNBQWMsT0FBTyxVQUFVLHNCQUM1QyxZQUNBO0FBQ04sTUFDRSxPQUFPLFdBQVcsVUFBVSxZQUM1QixPQUFPLGdCQUFnQixVQUFVLDRCQUNqQyxPQUFPLFdBQVcsT0FBTyxPQUFPLGdCQUFnQixNQUNoRCxPQUFPLFdBQVcsZUFBZSxPQUFPLGdCQUFnQixjQUN4RCxPQUFPLG1CQUFtQixPQUFPLFdBQVcsUUFBUSxrQkFDcEQsT0FBTyxXQUFXLFFBQVEsWUFBWSxPQUFPLFdBQzdDLE9BQU8sV0FBVyxRQUFRLGdCQUFnQixPQUFPLGVBQ2pELE9BQU8sV0FBVyxRQUFRLGlCQUFpQixPQUFPLFdBQVcsTUFDN0QsT0FBTyxXQUFXLFFBQVEsc0JBQXNCLE9BQU8sZ0JBQWdCLE1BQ3ZFLE9BQU8sV0FBVyxRQUFRLFVBQVUsT0FBTyxPQUMzQztBQUNBLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixNQUFNLENBQUMsWUFBWTtNQUNuQixTQUFTO0tBQ1Y7RUFDSDtBQUNGLENBQUM7QUFNSSxJQUFNLHFEQUFxRCxLQUFLOzs7QUM3SGhFLElBQU0seUJBQXlCO0FBQy9CLElBQU0seUJBQXlCO0FBTy9CLElBQU0sZ0NBQWdDO0FBQ3RDLElBQU0sMEJBQTBCO0FBQ2hDLElBQU0scUNBQXFDO0FBVzNDLElBQU0sNEJBQTRCLGlCQUFFLEtBQUs7O0VBRTlDOztFQUVBOztFQUVBOztFQUVBOztFQUVBOztFQUVBO0NBQ0Q7QUFXTSxJQUFNLDhCQUE4QixpQkFDeEMsT0FBTztFQUNOLHFCQUFxQixpQkFDbEIsT0FBTSxFQUNOLElBQUcsRUFDSCxJQUFJLHNCQUFzQixFQUMxQixJQUFJLHNCQUFzQjtFQUM3QixlQUFlLGlCQUNaLE9BQU0sRUFDTixJQUFHLEVBQ0gsSUFBSSxzQkFBc0IsRUFDMUIsSUFBSSxzQkFBc0I7RUFDN0IsMEJBQTBCLGlCQUN2QixPQUFNLEVBQ04sSUFBRyxFQUNILElBQUksc0JBQXNCLEVBQzFCLElBQUksc0JBQXNCO0NBQzlCLEVBQ0EsT0FBTSxFQUNOLFlBQVksQ0FBQyxRQUFRLFlBQVc7QUFDL0IsTUFBSSxPQUFPLGdCQUFnQixPQUFPLHFCQUFxQjtBQUNyRCxZQUFRLFNBQVM7TUFDZixNQUFNO01BQ04sU0FBUztNQUNULE1BQU0sQ0FBQyxlQUFlO0tBQ3ZCO0VBQ0g7QUFDQSxNQUFJLE9BQU8sMkJBQTJCLE9BQU8scUJBQXFCO0FBQ2hFLFlBQVEsU0FBUztNQUNmLE1BQU07TUFDTixTQUFTO01BQ1QsTUFBTSxDQUFDLDBCQUEwQjtLQUNsQztFQUNIO0FBQ0YsQ0FBQztBQUVJLElBQU0sa0NBQXlELE9BQU8sT0FBTztFQUNsRixxQkFBcUI7RUFDckIsZUFBZTtFQUNmLDBCQUEwQjtDQUMzQjs7O0FDL0VNLElBQU0saUNBQWlDO0FBQ3ZDLElBQU0sK0JBQStCLE1BQU0sT0FBTztBQUV6RCxJQUFNQyw4QkFBNkIsZ0JBQ2hDLE9BQU8sRUFBRSxFQUNULE9BQU8sQ0FBQyxVQUFVLE9BQU8sS0FBSyxPQUFPLFdBQVcsRUFBRSxlQUFlLElBQUk7RUFDcEUsT0FBTztDQUNSO0FBRUksSUFBTSx3QkFDWEEsNEJBQTJCLE1BQUs7QUFDM0IsSUFBTSxrQ0FDWEEsNEJBQTJCLE1BQUs7QUFZM0IsSUFBTSwyQkFBMkIsaUJBQ3JDLE9BQU87RUFDTixXQUFXLGlCQUFFLFFBQVEsOENBQThDO0VBQ25FLFlBQVk7RUFDWixlQUFlO0NBQ2hCLEVBQ0EsT0FBTTtBQUVGLElBQU0sZ0NBQWdDLGlCQUMxQyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLFFBQVE7RUFDeEIsUUFBUSxpQkFBRSxRQUFRLDJCQUEyQjtFQUM3QyxTQUFTLGlCQUFFLFFBQVEsQ0FBQztFQUNwQixTQUFTO0VBQ1QsZUFBZTtFQUNmLFdBQVc7RUFDWCxZQUFZO0NBQ2IsRUFDQSxPQUFNO0FBU0YsSUFBTSxrQ0FBa0MsaUJBQUUsS0FBSzs7RUFFcEQ7O0VBRUE7O0VBRUE7Q0FDRDtBQUVNLElBQU0sNEJBQTRCLGlCQUN0QyxPQUFPO0VBQ04sV0FBVztFQUNYLE9BQU8saUJBQUUsS0FBSyxDQUFDLFlBQVksTUFBTSxDQUFDO0VBQ2xDLFFBQVE7Q0FDVCxFQUNBLE9BQU07QUFPRixJQUFNLDZCQUE2QixpQkFDdkMsTUFBTSx5QkFBeUIsRUFDL0IsSUFBSSxHQUFLLEVBQ1QsWUFBWSxDQUFDLGNBQWMsWUFBVztBQUNyQyxRQUFNLE9BQU8sb0JBQUksSUFBRztBQUNwQixhQUFXLENBQUMsT0FBTyxRQUFRLEtBQUssYUFBYSxRQUFPLEdBQUk7QUFDdEQsVUFBTSxNQUFNLEdBQUcsU0FBUyxLQUFLLElBQUksU0FBUyxTQUFTO0FBQ25ELFFBQUksS0FBSyxJQUFJLEdBQUcsR0FBRztBQUNqQixjQUFRLFNBQVM7UUFDZixNQUFNO1FBQ04sU0FBUztRQUNULE1BQU0sQ0FBQyxPQUFPLFdBQVc7T0FDMUI7SUFDSDtBQUNBLFNBQUssSUFBSSxHQUFHO0VBQ2Q7QUFDRixDQUFDO0FBU0ksSUFBTSwrQkFBK0IsaUJBQUUsbUJBQW1CLFFBQVE7RUFDdkUsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxPQUFPO0lBQ3ZCLFNBQVM7SUFDVCxVQUFVO0dBQ1gsRUFDQSxPQUFNO0VBQ1QsaUJBQ0csT0FBTztJQUNOLE1BQU0saUJBQUUsUUFBUSxNQUFNO0lBQ3RCLFNBQVM7SUFDVCxRQUFRO0lBQ1IsVUFBVTtJQUNWLFVBQVU7R0FDWCxFQUNBLE9BQU07Q0FDVjtBQUVNLElBQU0sZ0NBQWdDLGlCQUMxQyxPQUFPO0VBQ04sTUFBTSxpQkFBRSxRQUFRLFFBQVE7RUFDeEIsU0FBUyxpQkFBRSxRQUFRLENBQUM7RUFDcEIsWUFBWSxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVcsRUFBRyxJQUFJLDhCQUE4QjtFQUM3RSxXQUFXLGlCQUFFLE9BQU0sRUFBRyxJQUFHLEVBQUcsWUFBVyxFQUFHLElBQUksOEJBQThCO0VBQzVFLGtCQUFrQkE7RUFDbEIsbUJBQW1CO0NBQ3BCLEVBQ0EsT0FBTTtBQUVGLElBQU0sdUJBQXVCLGlCQUNqQyxPQUFPO0VBQ04sY0FBYyxpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFNBQVEsRUFBRyxJQUFJLDRCQUE0QjtFQUMxRSxrQkFBa0IsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxTQUFRLEVBQUcsSUFBSSw4QkFBOEI7Q0FDakYsRUFDQSxPQUFNO0FBR0YsSUFBTSxrQ0FBa0MsaUJBQUUsS0FBSyxDQUFDLFFBQVEsUUFBUSxRQUFRLENBQUM7QUFFekUsSUFBTSw4QkFBOEIsaUJBQ3hDLE9BQU87RUFDTixTQUFTO0VBQ1QsV0FBVztFQUNYLGVBQWUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQzNDLGVBQWUsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQzNDLGNBQWMsaUJBQUUsT0FBTSxFQUFHLElBQUcsRUFBRyxZQUFXO0VBQzFDLGdCQUFnQixpQkFBRSxPQUFNLEVBQUcsSUFBRyxFQUFHLFlBQVc7Q0FDN0MsRUFDQSxPQUFNOyIsCiAgIm5hbWVzIjogWyJwb2xpY2llcyIsICJjYW5vbmljYWwzMkJ5dGVWYWx1ZVNjaGVtYSJdCn0K
|