ox 1.0.5 → 1.1.2

package/src/wasm/_test/Keystore.test.ts

@@ -0,0 +1,192 @@
+import { pbkdf2 as pbkdf2_noble } from '@noble/hashes/pbkdf2.js'
+import { sha256 } from '@noble/hashes/sha2.js'
+import { beforeAll, describe, expect, test } from 'vp/test'
+import * as Bytes from '../../core/Bytes.js'
+import * as Engine from '../../core/Engine.js'
+import * as Keystore from '../../core/Keystore.js'
+import * as WasmKeystore from '../Keystore.js'
+import * as hashes from '../internal/hashes.js'
+import { wasmBase64 } from '../internal/hashes.wasm.js'
+import * as internal from '../internal/instantiate.js'
+import * as pbkdf2 from '../internal/pbkdf2.js'
+
+let engine: WasmKeystore.engine.ReturnType
+
+beforeAll(async () => {
+  engine = await WasmKeystore.engine()
+})
+
+function input(size: number) {
+  return new Uint8Array(size).map((_, index) => (index * 37 + 11) & 0xff)
+}
+
+describe('engine', () => {
+  test('default', async () => {
+    expect(Object.keys(await WasmKeystore.engine())).toMatchInlineSnapshot(`
+      [
+        "pbkdf2Sha256",
+      ]
+    `)
+  })
+
+  test('behavior: shares the compiled hashes instance', async () => {
+    const [a, b] = await Promise.all([hashes.load(), hashes.load()])
+    expect(a).toBe(b)
+  })
+
+  test('behavior: hands every caller its own engine', async () => {
+    const [a, b] = await Promise.all([
+      WasmKeystore.engine(),
+      WasmKeystore.engine(),
+    ])
+    expect(a).not.toBe(b)
+
+    a.pbkdf2Sha256 = () => new Uint8Array([9])
+    const c = await WasmKeystore.engine()
+    expect(c.pbkdf2Sha256(input(8), input(16), { c: 2, dkLen: 33 })).toEqual(
+      b.pbkdf2Sha256(input(8), input(16), { c: 2, dkLen: 33 }),
+    )
+  })
+})
+
+const cases = [
+  { c: 1, dkLen: 1, password: 0, salt: 0 },
+  { c: 2, dkLen: 31, password: 1, salt: 51 },
+  { c: 3, dkLen: 32, password: 63, salt: 52 },
+  { c: 4, dkLen: 33, password: 64, salt: 55 },
+  { c: 7, dkLen: 64, password: 65, salt: 64 },
+  { c: 2, dkLen: 65, password: 129, salt: 137 },
+] as const
+
+describe('pbkdf2Sha256', () => {
+  test.each(cases)(
+    'matches the default for password=$password salt=$salt c=$c dkLen=$dkLen',
+    ({ c, dkLen, password: passwordLength, salt: saltLength }) => {
+      const password = input(passwordLength)
+      const salt = input(saltLength)
+      expect(engine.pbkdf2Sha256(password, salt, { c, dkLen })).toEqual(
+        pbkdf2_noble(sha256, password, salt, { c, dkLen }),
+      )
+    },
+  )
+
+  test('behavior: reads non-zero-offset views without mutating their backing buffers', () => {
+    const passwordBacking = new Uint8Array(80).fill(0xa5)
+    const saltBacking = new Uint8Array(90).fill(0x5a)
+    const password = passwordBacking.subarray(7, 72)
+    const salt = saltBacking.subarray(11, 63)
+    password.set(input(password.length))
+    salt.set(input(salt.length))
+    const passwordSnapshot = passwordBacking.slice()
+    const saltSnapshot = saltBacking.slice()
+
+    expect(engine.pbkdf2Sha256(password, salt, { c: 3, dkLen: 65 })).toEqual(
+      pbkdf2_noble(sha256, password, salt, { c: 3, dkLen: 65 }),
+    )
+    expect(passwordBacking).toEqual(passwordSnapshot)
+    expect(saltBacking).toEqual(saltSnapshot)
+  })
+
+  test('behavior: results are fresh and never alias WASM memory', () => {
+    const password = input(65)
+    const salt = input(52)
+    const first = engine.pbkdf2Sha256(password, salt, {
+      c: 2,
+      dkLen: 65,
+    })
+    const snapshot = first.slice()
+    const second = engine.pbkdf2Sha256(input(5), input(9), {
+      c: 3,
+      dkLen: 97,
+    })
+
+    expect(first).not.toBe(second)
+    expect(first).toEqual(snapshot)
+  })
+
+  test('behavior: clears passwords, salts, outputs, and scratch', async () => {
+    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const password = input(65)
+    const salt = input(52)
+    const stack = module.view().slice(0, module.heapBase)
+
+    expect(
+      pbkdf2.pbkdf2Sha256(module, password, salt, { c: 3, dkLen: 65 }),
+    ).toEqual(pbkdf2_noble(sha256, password, salt, { c: 3, dkLen: 65 }))
+    expect(module.view().slice(0, module.heapBase)).toEqual(stack)
+    expect(module.view().slice(module.heapBase)).toEqual(
+      new Uint8Array(module.view().length - module.heapBase),
+    )
+  })
+
+  test('behavior: clears the complete region after a late trap', async () => {
+    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const password = input(65)
+    const salt = input(52)
+    const exports: pbkdf2.Exports = {
+      pbkdf2_sha256(...parameters) {
+        module.exports.pbkdf2_sha256(...parameters)
+        throw new WebAssembly.RuntimeError('forced late trap')
+      },
+      zero: (ptr, length) => module.exports.zero(ptr, length),
+    }
+
+    expect(() =>
+      pbkdf2.pbkdf2Sha256({ ...module, exports }, password, salt, {
+        c: 3,
+        dkLen: 65,
+      }),
+    ).toThrow(WebAssembly.RuntimeError)
+    expect(module.view().slice(module.heapBase)).toEqual(
+      new Uint8Array(module.view().length - module.heapBase),
+    )
+  })
+
+  test('behavior: rejects a workspace that overflows wasm32 before growing memory', async () => {
+    const module = await internal.instantiate<hashes.Exports>(wasmBase64)
+    const memory = module.view().length
+
+    expect(() =>
+      pbkdf2.pbkdf2Sha256(module, new Uint8Array(), new Uint8Array(), {
+        c: 1,
+        dkLen: 0xffff_ffff,
+      }),
+    ).toThrow(internal.MemoryError)
+    expect(module.view()).toHaveLength(memory)
+  })
+
+  test.each([
+    { name: 'c', options: { c: 0, dkLen: 32 } },
+    { name: 'c', options: { c: 1.5, dkLen: 32 } },
+    { name: 'c', options: { c: 0x1_0000_0000, dkLen: 32 } },
+    { name: 'dkLen', options: { c: 1, dkLen: 0 } },
+    { name: 'dkLen', options: { c: 1, dkLen: 1.5 } },
+    { name: 'dkLen', options: { c: 1, dkLen: 0x1_0000_0000 } },
+  ])('behavior: rejects invalid $name before entering WASM', ({ options }) => {
+    expect(() => engine.pbkdf2Sha256(input(8), input(16), options)).toThrow()
+  })
+})
+
+describe('Engine.install', () => {
+  test('behavior: ox uses synchronous WASM PBKDF2 once installed', async () => {
+    await Engine.install({ Keystore: engine })
+    try {
+      const salt = input(32)
+      const [key] = Keystore.pbkdf2({
+        iterations: 1_000,
+        password: 'testpassword',
+        salt,
+      })
+      expect(key()).toBe(
+        Bytes.toHex(
+          pbkdf2_noble(sha256, Bytes.fromString('testpassword'), salt, {
+            c: 1_000,
+            dkLen: 32,
+          }),
+        ),
+      )
+    } finally {
+      Engine.reset()
+    }
+  })
+})

package/src/wasm/_test/Keystore.vectors.test.ts

@@ -0,0 +1,21 @@
+import { beforeAll, describe, expect, test } from 'vp/test'
+import * as vectors from '../../../test/vectors/pbkdf2/index.js'
+import * as WasmKeystore from '../Keystore.js'
+
+let engine: WasmKeystore.engine.ReturnType
+
+beforeAll(async () => {
+  engine = await WasmKeystore.engine()
+})
+
+describe('pbkdf2Sha256', () => {
+  test(`matches ${vectors.vectors.length} RFC 7914 vectors`, () => {
+    for (const { iterations, key, password, salt } of vectors.vectors)
+      expect(
+        engine.pbkdf2Sha256(password, salt, {
+          c: iterations,
+          dkLen: key.length,
+        }),
+      ).toEqual(key)
+  })
+})

package/src/wasm/_test/Mnemonic.test-d.ts

@@ -0,0 +1,17 @@
+import { expectTypeOf, test } from 'vp/test'
+import type * as Engine from '../../core/Engine.js'
+import * as core_Mnemonic from '../../core/Mnemonic.js'
+import * as Mnemonic from '../Mnemonic.js'
+
+type Slot = Awaited<ReturnType<typeof Mnemonic.engine>>
+
+test('return type exposes Mnemonic.toSeed', () => {
+  expectTypeOf<Slot['toSeed']>().toEqualTypeOf<
+    NonNullable<Engine.Mnemonic['toSeed']>
+  >()
+})
+
+test('the WASM namespace exposes the public Mnemonic API', () => {
+  expectTypeOf(Mnemonic.toSeed).toEqualTypeOf(core_Mnemonic.toSeed)
+  expectTypeOf<typeof Mnemonic>().not.toHaveProperty('create')
+})

package/src/wasm/_test/Mnemonic.test.ts

@@ -0,0 +1,110 @@
+import { mnemonicToSeedSync } from '@scure/bip39'
+import { describe, expect, test } from 'vp/test'
+import { vectors } from '../../../test/vectors/bip39/index.js'
+import * as Mnemonic from '../Mnemonic.js'
+import * as crypto25519 from '../internal/crypto25519.js'
+import { wasmBase64 } from '../internal/crypto25519.wasm.js'
+import * as internal from '../internal/instantiate.js'
+import * as mnemonic_internal from '../internal/mnemonic.js'
+
+describe('engine', () => {
+  test('vectors: matches the official English BIP-39 vector', async () => {
+    const { toSeed } = await Mnemonic.engine()
+
+    expect(
+      toHex(toSeed(vectors.english.mnemonic, vectors.english.passphrase)),
+    ).toBe(vectors.english.seed)
+  })
+
+  test('vectors: matches the official Japanese Unicode BIP-39 vector', async () => {
+    const { toSeed } = await Mnemonic.engine()
+
+    expect(
+      toHex(toSeed(vectors.japanese.mnemonic, vectors.japanese.passphrase)),
+    ).toBe(vectors.japanese.seed)
+  })
+
+  test('behavior: matches NFKD and every supported word count', async () => {
+    const { toSeed } = await Mnemonic.engine()
+
+    for (const count of [12, 15, 18, 21, 24]) {
+      const composed = Array.from({ length: count }, () => 'café').join(' ')
+      const decomposed = Array.from({ length: count }, () => 'cafe\u0301').join(
+        ' ',
+      )
+      expect(toSeed(composed, 'pássphrase')).toEqual(
+        toSeed(decomposed, 'pa\u0301ssphrase'),
+      )
+      expect(toSeed(composed, 'pássphrase')).toEqual(
+        mnemonicToSeedSync(composed, 'pássphrase'),
+      )
+    }
+  })
+
+  test('behavior: rejects the same malformed phrase shapes', async () => {
+    const { toSeed } = await Mnemonic.engine()
+
+    for (const count of [0, 1, 11, 13, 23, 25])
+      expect(() =>
+        toSeed(Array.from({ length: count }, () => 'word').join(' ')),
+      ).toThrowError('Invalid mnemonic')
+    expect(() => toSeed(1 as never)).toThrowError(
+      'invalid mnemonic type: number',
+    )
+  })
+
+  test('behavior: outputs remain owned and staging memory is cleared', async () => {
+    const { toSeed } = await Mnemonic.engine()
+    const seed = toSeed(vectors.english.mnemonic, vectors.japanese.passphrase)
+    const snapshot = seed.slice()
+    toSeed(Array.from({ length: 24 }, () => 'word').join(' '), 'other')
+    expect(seed).toEqual(snapshot)
+
+    const passwordSize = new TextEncoder().encode(
+      vectors.english.mnemonic.normalize('NFKD'),
+    ).length
+    const saltSize = new TextEncoder().encode(
+      `mnemonic${vectors.japanese.passphrase}`.normalize('NFKD'),
+    ).length
+    const module = await crypto25519.load()
+    expect(
+      module
+        .view()
+        .subarray(
+          module.heapBase,
+          module.heapBase + passwordSize + saltSize + 64,
+        )
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+
+  test('behavior: clears password, salt, and output after a late trap', async () => {
+    const module = await internal.instantiate<crypto25519.Exports>(wasmBase64)
+    const vector = vectors.japanese
+    const exports: crypto25519.Exports = {
+      ...module.exports,
+      mnemonic_to_seed(...parameters) {
+        module.exports.mnemonic_to_seed(...parameters)
+        throw new WebAssembly.RuntimeError('forced late trap')
+      },
+    }
+
+    expect(() =>
+      mnemonic_internal.toSeed(
+        { ...module, exports },
+        vector.mnemonic,
+        vector.passphrase,
+      ),
+    ).toThrow(WebAssembly.RuntimeError)
+    expect(
+      module
+        .view()
+        .subarray(module.heapBase)
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+})
+
+function toHex(value: Uint8Array): string {
+  return Buffer.from(value).toString('hex')
+}

package/src/wasm/_test/Runtime.test.ts

@@ -0,0 +1,21 @@
+import { readFileSync } from 'node:fs'
+import { expect, test } from 'vp/test'
+import { instantiate } from '../internal/instantiate.js'
+import { wasmBase64 } from './runtime.wasm.js'
+
+test('freestanding runtime preserves memmove and realloc semantics', async () => {
+  const module = await instantiate<{ run(): number }>(wasmBase64)
+  expect(module.exports.run()).toBe(0)
+})
+
+test('memmove compares flat-memory offsets rather than C object pointers', () => {
+  const source = readFileSync(
+    new URL('../../../wasm/src/ox_rt.c', import.meta.url),
+    'utf8',
+  )
+  const body = source.match(/void \*memmove\([\s\S]*?\n}\n\nvoid \*memset/)?.[0]
+
+  expect(body).toBeDefined()
+  expect(body).toContain('if ((size_t)d < (size_t)s)')
+  expect(body).not.toMatch(/if\s*\(\s*d\s*<\s*s\s*\)/)
+})

package/src/wasm/_test/X25519.test-d.ts

@@ -0,0 +1,21 @@
+import { expectTypeOf, test } from 'vp/test'
+import type * as Engine from '../../core/Engine.js'
+import * as core_X25519 from '../../core/X25519.js'
+import * as X25519 from '../X25519.js'
+
+type Slot = Awaited<ReturnType<typeof X25519.engine>>
+
+test('return type exposes only implemented X25519 primitives', () => {
+  expectTypeOf<Slot['getPublicKey']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdh['getPublicKey']>
+  >()
+  expectTypeOf<Slot['getSharedSecret']>().toEqualTypeOf<
+    NonNullable<Engine.Ecdh['getSharedSecret']>
+  >()
+  expectTypeOf<Slot>().not.toHaveProperty('randomSecretKey')
+})
+
+test('the WASM namespace exposes the public X25519 API', () => {
+  expectTypeOf(X25519.getPublicKey).toEqualTypeOf(core_X25519.getPublicKey)
+  expectTypeOf<typeof X25519>().not.toHaveProperty('create')
+})

package/src/wasm/_test/X25519.test.ts

@@ -0,0 +1,194 @@
+import * as fs from 'node:fs'
+import { x25519 } from '@noble/curves/ed25519.js'
+import { describe, expect, test } from 'vp/test'
+import * as X25519 from '../X25519.js'
+import * as crypto25519 from '../internal/crypto25519.js'
+import { wasmBase64 } from '../internal/crypto25519.wasm.js'
+import * as internal from '../internal/instantiate.js'
+import * as x25519_internal from '../internal/x25519.js'
+import { x25519LowOrder } from './fixtures.js'
+
+const alicePrivateKey = fromHex(
+  '77076d0a7318a57d3c16c17251b26645df4c2f87ebc0992ab177fba51db92c2a',
+)
+const bobPrivateKey = fromHex(
+  '5dab087e624a8a4b79e17f8b83800ee66f3bb1292618b6fd1c2f8b27ff88e0eb',
+)
+
+describe('engine', () => {
+  test('vectors: matches RFC 7748 key agreement', async () => {
+    const engine = await X25519.engine()
+    const alicePublicKey = engine.getPublicKey(alicePrivateKey)
+    const bobPublicKey = engine.getPublicKey(bobPrivateKey)
+
+    expect(toHex(alicePublicKey)).toMatchInlineSnapshot(
+      `"8520f0098930a754748b7ddcb43ef75a0dbf3a0d26381af4eba4a98eaa9b4e6a"`,
+    )
+    expect(toHex(bobPublicKey)).toMatchInlineSnapshot(
+      `"de9edb7d7b7dc1b4d35b61c2ece435373f8343c85b78674dadfc7e146f882b4f"`,
+    )
+    expect(
+      toHex(engine.getSharedSecret(alicePrivateKey, bobPublicKey)),
+    ).toMatchInlineSnapshot(
+      `"4a5d9d5ba4ce2de1728e3bf480350f25e07e21c947d19e3376f09b3c1e161742"`,
+    )
+  })
+
+  test('vectors: matches RFC 7748 arbitrary-point cases', async () => {
+    const engine = await X25519.engine()
+    const vectors = [
+      [
+        'a546e36bf0527c9d3b16154b82465edd62144c0ac1fc5a18506a2244ba449ac4',
+        'e6db6867583030db3594c1a424b15f7c726624ec26b3353b10a903a6d0ab1c4c',
+        'c3da55379de9c6908e94ea4df28d084f32eccf03491c71f754b4075577a28552',
+      ],
+      [
+        '4b66e9d4d1b4673c5ad22691957d6af5c11b6421e0ea01d42ca4169e7918ba0d',
+        'e5210f12786811d3f4b7959d0538ae2c31dbe7106fc03c3efc4cd549c715a493',
+        '95cbde9476e8907d7aade45cb4b873f88b595a68799fa152e6f8f7647aac7957',
+      ],
+    ] as const
+
+    for (const [privateKey, publicKey, expected] of vectors)
+      expect(
+        toHex(engine.getSharedSecret(fromHex(privateKey), fromHex(publicKey))),
+      ).toBe(expected)
+  })
+
+  test('vectors: matches RFC 7748 iterated cases', async () => {
+    const engine = await X25519.engine()
+    let privateKey = Uint8Array.of(9, ...new Uint8Array(31))
+    let publicKey = privateKey
+    const expected = new Map([
+      [1, '422c8e7a6227d7bca1350b3e2bb7279f7897b87bb6854b783c60e80311ae3079'],
+      [
+        1000,
+        '684cf59ba83309552800ef566f2f4d3c1c3887c49360e3875f2eb94d99532c51',
+      ],
+    ])
+
+    for (let iteration = 1; iteration <= 1000; iteration++) {
+      const previousPrivateKey = privateKey
+      privateKey = engine.getSharedSecret(privateKey, publicKey)
+      publicKey = previousPrivateKey
+      if (expected.has(iteration))
+        expect(toHex(privateKey), `iteration ${iteration}`).toBe(
+          expected.get(iteration),
+        )
+    }
+  })
+
+  test('behavior: accepts masked and noncanonical u-coordinates', async () => {
+    const engine = await X25519.engine()
+    const publicKey = x25519.getPublicKey(bobPrivateKey)
+    const masked = publicKey.slice()
+    masked[31]! |= 0x80
+    const noncanonicalBasePoint = fromHex(`f6${'ff'.repeat(30)}7f`)
+
+    expect(engine.getSharedSecret(alicePrivateKey, masked)).toEqual(
+      engine.getSharedSecret(alicePrivateKey, publicKey),
+    )
+    expect(
+      engine.getSharedSecret(alicePrivateKey, noncanonicalBasePoint),
+    ).toEqual(engine.getPublicKey(alicePrivateKey))
+  })
+
+  test('behavior: rejects low-order and malformed public keys', async () => {
+    const engine = await X25519.engine()
+
+    expect(x25519LowOrder).toEqual(
+      JSON.parse(
+        fs.readFileSync(
+          new URL(
+            '../../../test/vectors/x25519/low-order.json',
+            import.meta.url,
+          ),
+          'utf8',
+        ),
+      ),
+    )
+    expect(x25519LowOrder).toHaveLength(7)
+    for (const vector of x25519LowOrder) {
+      const publicKey = fromHex(vector.publicKey)
+      const highBitAlias = publicKey.slice()
+      highBitAlias[31]! |= 0x80
+      for (const value of [publicKey, highBitAlias])
+        expect(() =>
+          engine.getSharedSecret(alicePrivateKey, value),
+        ).toThrowError(`invalid private or public key received`)
+    }
+
+    for (const size of [0, 1, 31, 33, 64]) {
+      expect(() => engine.getPublicKey(new Uint8Array(size))).toThrowError(
+        `X25519 private key must be 32 bytes, got ${size}`,
+      )
+      expect(() =>
+        engine.getSharedSecret(alicePrivateKey, new Uint8Array(size)),
+      ).toThrowError(`X25519 public key must be 32 bytes, got ${size}`)
+    }
+  })
+
+  test('behavior: respects subviews, ownership, and cleanup', async () => {
+    const engine = await X25519.engine()
+    const privateKey = offsetView(alicePrivateKey)
+    const publicKey = offsetView(x25519.getPublicKey(bobPrivateKey))
+    const before = {
+      privateKey: privateKey.slice(),
+      publicKey: publicKey.slice(),
+    }
+    const sharedSecret = engine.getSharedSecret(privateKey, publicKey)
+    const snapshot = sharedSecret.slice()
+
+    engine.getPublicKey(new Uint8Array(32).fill(0xa5))
+    expect(sharedSecret).toEqual(snapshot)
+    expect({ privateKey, publicKey }).toEqual(before)
+
+    const module = await crypto25519.load()
+    expect(
+      module
+        .view()
+        .subarray(module.heapBase, module.heapBase + 96)
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+
+  test('behavior: clears both keys and the shared secret after a late trap', async () => {
+    const module = await internal.instantiate<crypto25519.Exports>(wasmBase64)
+    const publicKey = x25519.getPublicKey(bobPrivateKey)
+    const exports: crypto25519.Exports = {
+      ...module.exports,
+      x25519_get_shared_secret(...parameters) {
+        module.exports.x25519_get_shared_secret(...parameters)
+        throw new WebAssembly.RuntimeError('forced late trap')
+      },
+    }
+
+    expect(() =>
+      x25519_internal.getSharedSecret(
+        { ...module, exports },
+        alicePrivateKey,
+        publicKey,
+      ),
+    ).toThrow(WebAssembly.RuntimeError)
+    expect(
+      module
+        .view()
+        .subarray(module.heapBase, module.heapBase + 96)
+        .every((byte) => byte === 0),
+    ).toBe(true)
+  })
+})
+
+function fromHex(value: string): Uint8Array {
+  return Uint8Array.from(Buffer.from(value, 'hex'))
+}
+
+function offsetView(value: Uint8Array): Uint8Array {
+  const bytes = new Uint8Array(value.length + 4).fill(0xff)
+  bytes.set(value, 2)
+  return bytes.subarray(2, -2)
+}
+
+function toHex(value: Uint8Array): string {
+  return Buffer.from(value).toString('hex')
+}

package/src/wasm/_test/fixtures.ts

@@ -0,0 +1,4 @@
+import { lowOrder } from '../../../test/vectors/x25519/index.js'
+
+/** Complete libsodium X25519 low-order corpus. */
+export const x25519LowOrder = lowOrder

package/src/wasm/_test/runtime.wasm.ts

@@ -0,0 +1,11 @@
+// Generated by `pnpm wasm:build --target=runtime-test`. Do not edit.
+//
+// Compiled from wasm/test/ox_rt.c, wasm/src/ox_rt.c
+// with wasi-sdk 25.0 + binaryen 123.
+//
+// `pnpm wasm:check` rebuilds this file and fails if the bytes differ, so any
+// change to the C or to `wasm/targets.ts` must be followed by `pnpm wasm:build`.
+
+/** Base64-encoded WASM binary. */
+export const wasmBase64 =
+  'AGFzbQEAAAABFQRgAAF/YAF/AX9gAn9/AX9gAn9/AAMGBQABAgADBQQBAQICBggBfwFBkIgECwcjBAZtZW1vcnkCAANydW4AAAloZWFwX2Jhc2UAAwR6ZXJvAAQKghEFhQoBBX8jAEEQayIEJAAgBELAgomaxKiRo8cANwAIIAQgBCkACDcAAEEQIQICQCAELQAAQcAARw0AIAQtAAFBwQBHDQAgBC0AAkHCAEcNACAELQADQcMARw0AIAQtAARBxABHDQAgBC0ABUHFAEcNACAELQAGQcYARw0AIAQtAAdBxwBHDQBBAyECQRAQASEDQRAQASEAIANFDQAgAEUNACADQQE6AAAgAEGAAToAACADQQI6AAEgAEGBAToAASADQQM6AAIgAEGCAToAAkEEIQIgA0EEOgADIABBgwE6AAMgA0EFOgAEIABBhAE6AAQgA0EGOgAFIABBhQE6AAUgA0EHOgAGIABBhgE6AAYgA0EIOgAHIABBhwE6AAcgA0EJOgAIIABBiAE6AAggA0EKOgAJIABBiQE6AAkgA0ELOgAKIABBigE6AAogA0EMOgALIABBiwE6AAsgA0ENOgAMIABBjAE6AAwgA0EOOgANIABBjQE6AA0gA0EPOgAOIABBjgE6AA4gA0EQOgAPIABBjwE6AA8gA0EgEAIiAUUNACABIANGDQBBBSECIAEtAABBAUcNACAALQAAQYABRwRAQQYhAgwBCyABLQABQQJHDQAgAC0AAUGBAUcEQEEGIQIMAQsgAS0AAkEDRw0AIAAtAAJBggFHBEBBBiECDAELIAEtAANBBEcNACAALQADQYMBRwRAQQYhAgwBCyABLQAEQQVHDQBBBiECIAAtAARBhAFHDQAgAS0ABUEGRwRAQQUhAgwBCyAALQAFQYUBRw0AIAEtAAZBB0cEQEEFIQIMAQsgAC0ABkGGAUcNACABLQAHQQhHBEBBBSECDAELIAAtAAdBhwFHDQAgAS0ACEEJRwRAQQUhAgwBCyAALQAIQYgBRw0AIAEtAAlBCkcEQEEFIQIMAQsgAC0ACUGJAUcNACABLQAKQQtHBEBBBSECDAELIAAtAApBigFHDQAgAS0AC0EMRwRAQQUhAgwBCyAALQALQYsBRw0AIAEtAAxBDUcEQEEFIQIMAQsgAC0ADEGMAUcNACABLQANQQ5HBEBBBSECDAELIAAtAA1BjQFHDQAgAS0ADkEPRwRAQQUhAgwBCyAALQAOQY4BRw0AQQUhAiABLQAPQRBHDQBBBiECIAAtAA9BjwFHDQBBCCECQQgQASIARQRAQQchAgwBCyAAQvDjy5/Pvr37dzcAACAAQRgQAiAARw0AQQkhAiAALQAAQfABRw0AIAAtAAFB8QFHDQAgAC0AAkHyAUcNACAALQADQfMBRw0AIAAtAARB9AFHDQAgAC0ABUH1AUcNACAALQAGQfYBRw0AIAAtAAdB9wFHDQAgAEEEEAIgAEcEQEEKIQIMAQtBCyECIAAtAABB8AFHDQAgAC0AAUHxAUcNACAALQACQfIBRw0AIAAtAANB8wFHDQBBAEEIEAJFBEBBDCECDAELIAFBfxACBEBBDiECDAELQQ8hAiABLQAAQQFHDQAgAS0AAUECRw0AIAEtAAJBA0cNACABLQADQQRHDQAgAS0ABEEFRw0AIAEtAAVBBkcNACABLQAGQQdHDQAgAS0AB0EIRw0AIAEtAAhBCUcNACABLQAJQQpHDQAgAS0ACkELRw0AIAEtAAtBDEcNACABLQAMQQ1HDQAgAS0ADUEORw0AIAEtAA5BD0cNAEEPQQAgAS0AD0EQRxshAgsgBEEQaiQAIAILbQEEf0GACCgCACIBRQRAQYAIQZCIBDYCAEGQiAQhAQsCQCABQWxLDQAgAUETakFwcSIBIABBf3NLDQAgACABaiIDPwAiAkEQdEsgAkH//wNNcQ0AIAFBBGsgADYCAEGACCADNgIAIAEhBAsgBAvSBAEFfwJAIABFBEAgAUUNAUGACCgCACIARQRAQYAIQZCIBDYCAEGQiAQhAAsgAEFsSw0BIABBE2pBcHEiACABQX9zSw0BIAAgAWoiAz8AIgJBEHRLIAJB//8DTXENASAAQQRrIAE2AgBBgAggAzYCACAADwsgAUUEQEEADwsgAEEEayIEKAIAIgMgAU8EQCAEIAE2AgAgACADQX9zSwRAIAAPC0GACCgCACAAIANqRwRAIAAPC0GACCAAIAFqNgIAIAAPCwJAIAAgA0F/c00EQEGACCgCACICIAAgA2pHDQEgAUF/cyAASQ0CIAAgAWoiAz8AIgJBEHRLIAJB//8DTXENAiAEIAE2AgBBgAggAzYCACAADwtBgAgoAgAhAgsgAkUEQEGACEGQiAQ2AgBBkIgEIQILIAJBbEsEQEEADwsgAkETakFwcSICIAFBf3NLBEBBAA8LPwAiBkH//wNNIAEgAmoiBCAGQRB0S3ENACACQQRrIAE2AgBBgAggBDYCACACRQ0AIANFBEAgAg8LAkAgA0EHcSIFRQRAIAIhASADIQQMAQsgA0F4cSEEIAIhAQNAIAEgAC0AADoAACABQQFqIQEgAEEBaiEAIAVBAWsiBQ0ACwsgA0EISQRAIAIPCwNAIAEgAC0AADoAACABIAAtAAE6AAEgASAALQACOgACIAEgAC0AAzoAAyABIAAtAAQ6AAQgASAALQAFOgAFIAEgAC0ABjoABiABIAAtAAc6AAcgAUEIaiEBIABBCGohACACIQUgBEEIayIEDQALCyAFCyIBAX9BgAgoAgAiAEUEQEGACEGQiAQ2AgBBkIgEIQALIAALkwEBAn8CQCABRQ0AAkAgAUEHcSIDRQRAIAEhAgwBCyABQXhxIQIDQCAAQQA6AAAgAEEBaiEAIANBAWsiAw0ACwsgAUEISQ0AA0AgAEEAOgAAIABBADoAASAAQQA6AAIgAEEAOgADIABBADoABCAAQQA6AAUgAEEAOgAGIABBADoAByAAQQhqIQAgAkEIayICDQALCws='