@@ -141,20 +152,23 @@ export function MarketplaceSessionConnectDialog({
generatingLabel="Generating QR Code..."
clickToReloadLabel="Click to reload"
activeQrHasHoverEffect
+ showRingLogo={!requestsGrantBootstrap}
/>
{session.status === 'awaiting' && (
)}
{['creating', 'verifying', 'claiming'].includes(session.status) && (
{session.status === 'creating'
- ? 'Preparing secure approval…'
+ ? requestsGrantBootstrap
+ ? 'Confirming with your homeserver…'
+ : 'Preparing secure approval…'
: session.status === 'verifying'
? 'Verifying approval…'
: 'Connecting marketplace…'}
@@ -175,12 +189,16 @@ export function MarketplaceSessionConnectDialog({
)}
{session.isOpeningRing
- ? requestsGrantReconnect
- ? 'Opening signer...'
- : 'Opening Pubky Ring...'
- : requestsGrantReconnect
- ? 'Open in signer'
- : 'Open in Pubky Ring'}
+ ? requestsGrantBootstrap
+ ? 'Opening Bitkit...'
+ : requestsGrantReconnect
+ ? 'Opening signer...'
+ : 'Opening Pubky Ring...'
+ : requestsGrantBootstrap
+ ? 'Open in Bitkit'
+ : requestsGrantReconnect
+ ? 'Open in signer'
+ : 'Open in Pubky Ring'}
({
+ HomeserverService: { request: vi.fn(), delete: vi.fn() },
+}));
+
+vi.mock('@/libs/logger/logger', () => ({
+ Logger: { error: vi.fn(), warn: vi.fn(), info: vi.fn(), debug: vi.fn() },
+}));
+
+vi.mock('@/libs/utils/utils', async (importOriginal) => ({
+ ...(await importOriginal()),
+ sleep: vi.fn().mockResolvedValue(undefined),
+}));
+
+const PUBKY = 'y'.repeat(52);
+const CHALLENGE_ID = '018f4f36-7a61-7d4e-8f22-3e31ed45d2af';
+const STATE_ID = '11111111-1111-4111-8111-111111111111';
+const PROOF_URI = `pubky://${PUBKY}/pub/pubky.app/marketplace/v1/cli-grant-proofs/${CHALLENGE_ID}`;
+const PROOF_DOCUMENT = { aud: 'https://shop.example', challenge_id: CHALLENGE_ID, pubky: PUBKY };
+
+function challenge(overrides: Record = {}) {
+ return {
+ challenge_id: CHALLENGE_ID,
+ expires_at: new Date(Date.now() + 60_000).toISOString(),
+ nonce: 'n'.repeat(43),
+ proof_document: PROOF_DOCUMENT,
+ proof_uri: PROOF_URI,
+ result_cpk: 'c'.repeat(52),
+ result_delivery_id: 'd'.repeat(43),
+ ...overrides,
+ };
+}
+
+const verified = {
+ authorization_url: 'pubkyauth://signin_grant?caps=x',
+ expires_at: new Date(Date.now() + 120_000).toISOString(),
+ state_id: STATE_ID,
+ status: 'awaiting',
+};
+
+function jsonResponse(body: unknown, status = 200): Response {
+ return new Response(JSON.stringify(body), { status, headers: { 'content-type': 'application/json' } });
+}
+
+describe('marketplace purchase bootstrap client', () => {
+ const fetchMock = vi.fn();
+
+ beforeEach(() => {
+ vi.clearAllMocks();
+ vi.stubGlobal('fetch', fetchMock);
+ vi.mocked(HomeserverService.request).mockResolvedValue(undefined as never);
+ vi.mocked(HomeserverService.delete).mockResolvedValue(undefined);
+ });
+
+ afterEach(() => {
+ vi.unstubAllGlobals();
+ });
+
+ it('grant session writes proof document', async () => {
+ fetchMock.mockResolvedValueOnce(jsonResponse(challenge(), 201)).mockResolvedValueOnce(jsonResponse(verified));
+
+ const flow = await beginMarketplaceBootstrapFlow({ pubky: PUBKY });
+
+ expect(fetchMock.mock.calls[0][0]).toBe('/api/marketplace/bootstrap-challenges');
+ expect(JSON.parse(String(fetchMock.mock.calls[0][1]?.body))).toEqual({ pubky: PUBKY });
+ expect(HomeserverService.request).toHaveBeenCalledWith({
+ method: HttpMethod.PUT,
+ url: PROOF_URI,
+ bodyJson: PROOF_DOCUMENT,
+ });
+ expect(fetchMock.mock.calls[1][0]).toBe(`/api/marketplace/bootstrap-challenges/${CHALLENGE_ID}/verify`);
+ expect(JSON.parse(String(fetchMock.mock.calls[1][1]?.body))).toEqual({ nonce: 'n'.repeat(43) });
+ expect(flow.authorizationUrl).toBe(verified.authorization_url);
+ });
+
+ it('proof deleted after verify', async () => {
+ fetchMock.mockResolvedValueOnce(jsonResponse(challenge(), 201)).mockResolvedValueOnce(jsonResponse(verified));
+ await beginMarketplaceBootstrapFlow({ pubky: PUBKY });
+ expect(HomeserverService.delete).toHaveBeenCalledWith(PROOF_URI);
+
+ vi.mocked(HomeserverService.delete).mockClear();
+ fetchMock
+ .mockResolvedValueOnce(jsonResponse(challenge(), 201))
+ .mockResolvedValueOnce(jsonResponse({ error: 'homeserver_proof_invalid' }, 401));
+ await expect(beginMarketplaceBootstrapFlow({ pubky: PUBKY })).rejects.toThrow('homeserver_proof_invalid');
+ expect(HomeserverService.delete).toHaveBeenCalledWith(PROOF_URI);
+ });
+
+ it('proof for a pubky the session cannot write fails', async () => {
+ fetchMock.mockResolvedValueOnce(
+ jsonResponse(challenge({ proof_uri: `pubky://${'o'.repeat(52)}/pub/pubky.app/x` }), 201),
+ );
+
+ await expect(beginMarketplaceBootstrapFlow({ pubky: PUBKY })).rejects.toThrow('invalid_request');
+ expect(HomeserverService.request).not.toHaveBeenCalled();
+ });
+
+ it('maps a refused homeserver write to shop_session_expired and never verifies', async () => {
+ fetchMock.mockResolvedValueOnce(jsonResponse(challenge(), 201));
+ vi.mocked(HomeserverService.request).mockRejectedValue(
+ new AppError({
+ category: ErrorCategory.Auth,
+ code: AuthErrorCode.SESSION_EXPIRED,
+ message: 'Session expired',
+ service: ErrorService.Homeserver,
+ operation: 'request',
+ }),
+ );
+
+ await expect(beginMarketplaceBootstrapFlow({ pubky: PUBKY })).rejects.toThrow('shop_session_expired');
+ expect(fetchMock).toHaveBeenCalledTimes(1);
+ expect(HomeserverService.delete).toHaveBeenCalledWith(PROOF_URI);
+ });
+
+ it('keeps polling while another poll holds the claim, then returns the claimed session', async () => {
+ const claimed = {
+ capabilities: '/pub/pubky.app/marketplace-service/v1/:rw',
+ expires_at: new Date(Date.now() + 3_600_000).toISOString(),
+ pubky: PUBKY,
+ state_id: STATE_ID,
+ status: 'connected',
+ token: 'bearer',
+ };
+ fetchMock
+ .mockResolvedValueOnce(jsonResponse(challenge(), 201))
+ .mockResolvedValueOnce(jsonResponse(verified))
+ .mockResolvedValueOnce(jsonResponse({ state_id: STATE_ID, status: 'awaiting', expires_at: verified.expires_at }))
+ .mockResolvedValueOnce(jsonResponse({ error: 'claim_in_progress' }, 409))
+ .mockResolvedValueOnce(jsonResponse(claimed));
+
+ const flow = await beginMarketplaceBootstrapFlow({ pubky: PUBKY });
+ await expect(flow.awaitResult()).resolves.toMatchObject({ status: 'connected', pubky: PUBKY, token: 'bearer' });
+ expect(fetchMock.mock.calls.slice(2).map((call) => call[0])).toEqual([
+ `/api/marketplace/bootstrap-flows/${STATE_ID}/status`,
+ `/api/marketplace/bootstrap-flows/${STATE_ID}/status`,
+ `/api/marketplace/bootstrap-flows/${STATE_ID}/status`,
+ ]);
+ });
+
+ it('cancel posts to the bootstrap cancel route once', async () => {
+ fetchMock
+ .mockResolvedValueOnce(jsonResponse(challenge(), 201))
+ .mockResolvedValueOnce(jsonResponse(verified))
+ .mockResolvedValue(new Response(null, { status: 204 }));
+
+ const flow = await beginMarketplaceBootstrapFlow({ pubky: PUBKY });
+ await flow.cancel();
+ await flow.cancel();
+
+ const cancels = fetchMock.mock.calls.filter((call) => String(call[0]).endsWith('/cancel'));
+ expect(cancels.map((call) => call[0])).toEqual([`/api/marketplace/bootstrap-flows/${STATE_ID}/cancel`]);
+ });
+});
diff --git a/src/core/services/marketplace/marketplace-bootstrap-client.ts b/src/core/services/marketplace/marketplace-bootstrap-client.ts
new file mode 100644
index 000000000..79c846ae0
--- /dev/null
+++ b/src/core/services/marketplace/marketplace-bootstrap-client.ts
@@ -0,0 +1,125 @@
+import { z } from 'zod';
+import { isAppError } from '@/libs/error/error';
+import { ServerErrorCode } from '@/libs/error/error.codes';
+import { Err } from '@/libs/error/error.factories';
+import { ErrorCategory, ErrorService } from '@/libs/error/error.types';
+import { HttpMethod } from '@/libs/http/http.types';
+import { Logger } from '@/libs/logger/logger';
+import { getMarketplaceGrantPollMilliseconds } from '@/libs/runtime-config/runtime-config';
+import { sleep } from '@/libs/utils/utils';
+import { HomeserverService } from '@/services/homeserver/homeserver';
+import type { MarketplaceGrantFlow } from './marketplace-grant-client';
+
+/**
+ * Browser purchase bootstrap for a Bitkit (grant) sign-in. The grant session
+ * proves write access to its own homeserver with a single-use proof document,
+ * the Shop BFF runs the CLI verifier's checks and opens a marketplace
+ * `signin_grant`, and after the Bitkit approval the BFF claims the bearer.
+ */
+const challengeSchema = z.object({
+ challenge_id: z.uuid(),
+ expires_at: z.iso.datetime({ offset: true }),
+ nonce: z.string().min(1),
+ proof_document: z.record(z.string(), z.unknown()),
+ proof_uri: z.string().startsWith('pubky://'),
+ result_cpk: z.string(),
+ result_delivery_id: z.string(),
+});
+const verifySchema = z.object({
+ authorization_url: z.string().startsWith('pubkyauth://signin_grant'),
+ expires_at: z.iso.datetime({ offset: true }),
+ state_id: z.uuid(),
+ status: z.literal('awaiting'),
+});
+const pollSchema = z.object({
+ status: z.enum(['awaiting', 'verifying', 'connected', 'mismatch', 'expired', 'cancelled', 'failed']),
+ state_id: z.uuid().optional(),
+ token: z.string().optional(),
+ pubky: z.string().optional(),
+ capabilities: z.string().optional(),
+ expires_at: z.string().optional(),
+});
+
+function bootstrapFailure(code: string) {
+ return Err.server(ServerErrorCode.SERVICE_UNAVAILABLE, code, {
+ service: ErrorService.Marketplace,
+ operation: 'marketplaceBootstrap',
+ });
+}
+
+async function readJson(response: Response): Promise {
+ const body = (await response.json().catch(() => null)) as unknown;
+ if (!response.ok) {
+ const code =
+ typeof body === 'object' && body !== null && typeof (body as { error?: unknown }).error === 'string'
+ ? (body as { error: string }).error
+ : 'grant_unavailable';
+ throw bootstrapFailure(/^[a-z_]{1,64}$/.test(code) ? code : 'grant_unavailable');
+ }
+ return body;
+}
+
+async function post(path: string, body: unknown): Promise {
+ return await readJson(
+ await fetch(path, {
+ method: 'POST',
+ credentials: 'same-origin',
+ headers: { 'content-type': 'application/json' },
+ body: JSON.stringify(body),
+ }),
+ );
+}
+
+export async function beginMarketplaceBootstrapFlow({ pubky }: { pubky: string }): Promise {
+ const challenge = challengeSchema.parse(await post('/api/marketplace/bootstrap-challenges', { pubky }));
+ if (!challenge.proof_uri.startsWith(`pubky://${pubky}/`)) throw bootstrapFailure('invalid_request');
+
+ let verified: z.infer;
+ try {
+ try {
+ await HomeserverService.request({
+ method: HttpMethod.PUT,
+ url: challenge.proof_uri,
+ bodyJson: challenge.proof_document,
+ });
+ } catch (error) {
+ // The grant session could not write its own homeserver: it expired or was revoked.
+ if (isAppError(error) && error.category === ErrorCategory.Auth) throw bootstrapFailure('shop_session_expired');
+ throw error;
+ }
+ verified = verifySchema.parse(
+ await post(`/api/marketplace/bootstrap-challenges/${challenge.challenge_id}/verify`, { nonce: challenge.nonce }),
+ );
+ } finally {
+ // Single-use either way: the verify consumed the challenge or refused it.
+ await HomeserverService.delete(challenge.proof_uri).catch(() => {
+ Logger.warn('Could not delete the purchase bootstrap proof document');
+ });
+ }
+
+ let cancelled = false;
+ return {
+ authorizationUrl: verified.authorization_url,
+ awaitResult: async () => {
+ while (!cancelled && Date.now() < Date.parse(verified.expires_at)) {
+ let result: z.infer;
+ try {
+ result = pollSchema.parse(await post(`/api/marketplace/bootstrap-flows/${verified.state_id}/status`, {}));
+ } catch (error) {
+ // Another poll holds the claim lease; it finishes the approval.
+ if (!(error instanceof Error && error.message === 'claim_in_progress')) throw error;
+ await sleep(getMarketplaceGrantPollMilliseconds());
+ continue;
+ }
+ if (!['awaiting', 'verifying'].includes(result.status)) return result;
+ await sleep(getMarketplaceGrantPollMilliseconds());
+ }
+ throw bootstrapFailure(cancelled ? 'flow_cancelled' : 'flow_expired');
+ },
+ cancel: async () => {
+ if (cancelled) return;
+ cancelled = true;
+ await post(`/api/marketplace/bootstrap-flows/${verified.state_id}/cancel`, {}).catch(() => undefined);
+ },
+ };
+}
diff --git a/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.test.ts b/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.test.ts
index 0dd7ab680..5fca2c788 100644
--- a/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.test.ts
+++ b/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.test.ts
@@ -7,10 +7,12 @@ import { AppError } from '@/libs/error/error';
import { AuthErrorCode } from '@/libs/error/error.codes';
import { ErrorCategory, ErrorService } from '@/libs/error/error.types';
import { copyToClipboard } from '@/libs/utils/utils';
+import { beginMarketplaceBootstrapFlow } from '@/services/marketplace/marketplace-bootstrap-client';
import { beginMarketplaceGrantFlow } from '@/services/marketplace/marketplace-grant-client';
import { MarketplaceSessionService } from '@/services/marketplace/marketplace-session';
import { useAuthStore } from '@/stores/auth/auth.store';
import type { CommerceMarketplaceSession } from '@/stores/commerce/commerce.types';
+import { asOpaque } from '@/test-utils/type-assertions';
import { useMarketplaceSessionConnect } from './useMarketplaceSessionConnect';
vi.mock('@/libs/logger/logger', () => ({
@@ -36,6 +38,10 @@ vi.mock('@/services/marketplace/marketplace-grant-client', () => ({
beginMarketplaceGrantFlow: vi.fn(),
}));
+vi.mock('@/services/marketplace/marketplace-bootstrap-client', () => ({
+ beginMarketplaceBootstrapFlow: vi.fn(),
+}));
+
vi.mock('@/controllers/auth/auth', () => ({
AuthController: {
beginBridgedCommerceSessionFlow: vi.fn(),
@@ -554,4 +560,149 @@ describe('useMarketplaceSessionConnect grant reconnect', () => {
restore();
}
});
+
+ describe('Bitkit (grant) sign-in purchase bootstrap', () => {
+ const OTHER_PUBKY = 'o'.repeat(52);
+
+ function signInWithGrant(pubky = SESSION.pubky) {
+ useAuthStore.setState({
+ currentUserPubky: pubky,
+ session: asOpaque({ grant: {}, info: { publicKey: { z32: () => pubky } } }),
+ });
+ }
+
+ afterEach(() => {
+ useAuthStore.setState({ currentUserPubky: null, session: null });
+ });
+
+ it('grant session connect uses bootstrap', async () => {
+ const restore = await enableGrantFlow();
+ try {
+ signInWithGrant();
+ vi.spyOn(MarketplaceSessionService, 'getActiveSession').mockReturnValue(null);
+ const { grantFlow } = createDeferredGrantFlow('pubkyauth://signin_grant?caps=bootstrap');
+ vi.mocked(beginMarketplaceBootstrapFlow).mockResolvedValue(grantFlow);
+ const { result } = renderHook(() => useMarketplaceSessionConnect());
+
+ expect(result.current.requestsGrantBootstrap).toBe(true);
+ act(() => result.current.start());
+ await waitFor(() => expect(result.current.status).toBe('awaiting'));
+
+ expect(result.current.authorizationUrl).toBe('pubkyauth://signin_grant?caps=bootstrap');
+ expect(result.current.requestsGrantReconnect).toBe(false);
+ expect(beginMarketplaceGrantFlow).not.toHaveBeenCalled();
+ expect(CommerceController.beginMarketplaceSessionConnect).not.toHaveBeenCalled();
+ expect(AuthController.beginBridgedCommerceSessionFlow).not.toHaveBeenCalled();
+ } finally {
+ restore();
+ }
+ });
+
+ it('challenge pubky comes from live grant session', async () => {
+ const restore = await enableGrantFlow();
+ try {
+ signInWithGrant();
+ vi.spyOn(MarketplaceSessionService, 'getActiveSession').mockReturnValue(null);
+ const { grantFlow } = createDeferredGrantFlow('pubkyauth://signin_grant?caps=bootstrap');
+ vi.mocked(beginMarketplaceBootstrapFlow).mockResolvedValue(grantFlow);
+ const { result } = renderHook(() => useMarketplaceSessionConnect());
+
+ act(() => result.current.start());
+ await waitFor(() => expect(beginMarketplaceBootstrapFlow).toHaveBeenCalledTimes(1));
+ expect(beginMarketplaceBootstrapFlow).toHaveBeenCalledWith({ pubky: SESSION.pubky });
+ } finally {
+ restore();
+ }
+ });
+
+ it('a Ring (cookie) sign-in never runs the grant bootstrap', async () => {
+ const restore = await enableGrantFlow();
+ try {
+ useAuthStore.setState({
+ currentUserPubky: SESSION.pubky,
+ session: asOpaque({ info: { publicKey: { z32: () => SESSION.pubky } } }),
+ });
+ vi.spyOn(MarketplaceSessionService, 'getActiveSession').mockReturnValue(null);
+ const { flow } = createDeferredFlow('pubkyauth:///?caps=ring');
+ vi.mocked(CommerceController.beginMarketplaceSessionConnect).mockReturnValue(flow);
+ const { result } = renderHook(() => useMarketplaceSessionConnect());
+
+ expect(result.current.requestsGrantBootstrap).toBe(false);
+ act(() => result.current.start());
+
+ expect(beginMarketplaceBootstrapFlow).not.toHaveBeenCalled();
+ expect(CommerceController.beginMarketplaceSessionConnect).toHaveBeenCalledTimes(1);
+ } finally {
+ restore();
+ }
+ });
+
+ it('browser rejects bearer for another pubky', async () => {
+ const restore = await enableGrantFlow();
+ try {
+ signInWithGrant();
+ vi.spyOn(MarketplaceSessionService, 'getActiveSession').mockReturnValue(null);
+ const establish = vi.spyOn(MarketplaceSessionService, 'establishClaimedGrantSession');
+ const { grantFlow, resolveResult } = createDeferredGrantFlow('pubkyauth://signin_grant?caps=bootstrap');
+ vi.mocked(beginMarketplaceBootstrapFlow).mockResolvedValue(grantFlow);
+ const { result } = renderHook(() => useMarketplaceSessionConnect());
+
+ act(() => result.current.start());
+ await waitFor(() => expect(result.current.status).toBe('awaiting'));
+ resolveResult({
+ status: 'connected',
+ token: 'claimed-token',
+ pubky: OTHER_PUBKY,
+ capabilities: '/pub/pubky.app/marketplace-service/v1/:rw',
+ expires_at: SESSION.expiresAt,
+ });
+
+ await waitFor(() => expect(result.current.status).toBe('mismatch'));
+ expect(establish).not.toHaveBeenCalled();
+ expect(CommerceController.writeMarketplaceSessionStore).not.toHaveBeenCalled();
+ } finally {
+ restore();
+ }
+ });
+
+ it('an ended grant sign-in shows the bootstrap copy, not the AuthToken fallback', async () => {
+ const restore = await enableGrantFlow();
+ try {
+ signInWithGrant();
+ vi.spyOn(MarketplaceSessionService, 'getActiveSession').mockReturnValue(null);
+ vi.mocked(beginMarketplaceBootstrapFlow).mockRejectedValue(new Error('shop_session_expired'));
+ const { result } = renderHook(() => useMarketplaceSessionConnect());
+
+ act(() => result.current.start());
+ await waitFor(() => expect(result.current.status).toBe('error'));
+
+ expect(result.current.errorMessage).toBe('Your Shop session ended. Sign in again.');
+ expect(CommerceController.beginMarketplaceSessionConnect).not.toHaveBeenCalled();
+ } finally {
+ restore();
+ }
+ });
+
+ it('a failed Bitkit approval shows the approval_invalid copy', async () => {
+ const restore = await enableGrantFlow();
+ try {
+ signInWithGrant();
+ vi.spyOn(MarketplaceSessionService, 'getActiveSession').mockReturnValue(null);
+ const failed = {
+ authorizationUrl: 'pubkyauth://signin_grant?caps=bootstrap',
+ awaitResult: vi.fn().mockResolvedValue({ status: 'failed' }),
+ cancel: vi.fn().mockResolvedValue(undefined),
+ };
+ vi.mocked(beginMarketplaceBootstrapFlow).mockResolvedValue(failed);
+ const { result } = renderHook(() => useMarketplaceSessionConnect());
+
+ act(() => result.current.start());
+ await waitFor(() => expect(result.current.status).toBe('error'));
+
+ expect(result.current.errorMessage).toBe('That approval could not be verified. Approve again in Bitkit.');
+ } finally {
+ restore();
+ }
+ });
+ });
});
diff --git a/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.ts b/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.ts
index c426db200..6ad8aaf1f 100644
--- a/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.ts
+++ b/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.ts
@@ -6,6 +6,7 @@ import { AuthController } from '@/controllers/auth/auth';
import { CommerceController } from '@/controllers/commerce/commerce';
import {
MARKETPLACE_FAILURE_MESSAGES,
+ marketplaceBootstrapFailureMessage,
marketplaceErrorCode,
marketplaceFailureMessage,
} from '@/libs/commerce/failure-messages';
@@ -13,6 +14,7 @@ import { Logger } from '@/libs/logger/logger';
import { getMarketplaceGrantFlowEnabled } from '@/libs/runtime-config/runtime-config';
import { copyToClipboard } from '@/libs/utils/utils';
import { AUTH_FLOW_CANCELED_ERROR_NAME } from '@/services/homeserver/error.utils';
+import { beginMarketplaceBootstrapFlow } from '@/services/marketplace/marketplace-bootstrap-client';
import { beginMarketplaceGrantFlow, type MarketplaceGrantFlow } from '@/services/marketplace/marketplace-grant-client';
import { MarketplaceSessionService } from '@/services/marketplace/marketplace-session';
import { useAuthStore } from '@/stores/auth/auth.store';
@@ -37,6 +39,13 @@ type ActiveFlow =
* `start()` first detach the current flow, so a rejection arriving from a
* detached flow is dropped silently instead of being surfaced as a failure.
*/
+/** The signed-in pubky when the Shop session is grant-backed (Bitkit sign-in), else null. */
+function grantSignInPubky(): string | null {
+ const session = useAuthStore.getState().session;
+ if (!session || session.grant === undefined) return null;
+ return session.info.publicKey.z32();
+}
+
export function useMarketplaceSessionConnect(
options: UseMarketplaceSessionConnectOptions = {},
): UseMarketplaceSessionConnectReturn {
@@ -49,6 +58,10 @@ export function useMarketplaceSessionConnect(
const [requestsGrantReconnect, setRequestsGrantReconnect] = useState(
() => getMarketplaceGrantFlowEnabled() && Boolean(MarketplaceSessionService.getActiveSession()),
);
+ const [requestsGrantBootstrap, setRequestsGrantBootstrap] = useState(
+ () =>
+ getMarketplaceGrantFlowEnabled() && grantSignInPubky() !== null && !MarketplaceSessionService.getActiveSession(),
+ );
const activeFlowRef = useRef(null);
const activeGrantFlowRef = useRef(null);
const generationRef = useRef(0);
@@ -168,14 +181,14 @@ export function useMarketplaceSessionConnect(
});
};
- // Reconnect grant cannot mint a first session: BFF createFlow requires a
- // paired cookie. A seller with no marketplace bearer must bootstrap via
- // AuthToken instead of opening a grant that 401s locally as "expired".
- if (grantFlowEnabled && MarketplaceSessionService.getActiveSession()) {
- setRequestsGrantReconnect(true);
+ const runGrantFlow = (
+ begin: () => Promise,
+ failureMessage: (code: string) => string,
+ onSessionMissing?: () => void,
+ ) => {
setAuthorizationUrl('');
setStatus('creating');
- void beginMarketplaceGrantFlow()
+ void begin()
.then(async (grantFlow) => {
if (generationRef.current !== generation) {
await grantFlow.cancel();
@@ -196,6 +209,10 @@ export function useMarketplaceSessionConnect(
if (!expectedPubky) {
throw new Error('grant_invalid_response');
}
+ if (result.pubky !== expectedPubky) {
+ setStatus('mismatch');
+ return;
+ }
const session = MarketplaceSessionService.establishClaimedGrantSession(
{
token: result.token,
@@ -213,22 +230,48 @@ export function useMarketplaceSessionConnect(
if (result.status === 'mismatch') setStatus('mismatch');
else if (result.status === 'expired') setStatus('expired');
else if (result.status === 'cancelled') setStatus('cancelled');
- else setStatus('error');
+ else {
+ setErrorMessage(failureMessage('approval_invalid'));
+ setStatus('error');
+ }
})
.catch((error: unknown) => {
if (generationRef.current !== generation) return;
activeGrantFlowRef.current = null;
setAuthorizationUrl('');
const code = error instanceof Error ? error.message : '';
- if (code === 'shop_session_missing' || code === 'shop_session_expired') {
+ if ((code === 'shop_session_missing' || code === 'shop_session_expired') && onSessionMissing) {
Logger.warn('Marketplace grant reconnect needs a session; starting AuthToken connect', { code });
- startAuthTokenConnect();
+ onSessionMissing();
return;
}
Logger.error('Marketplace grant flow failed', { error });
- setErrorMessage(marketplaceFailureMessage(code, MARKETPLACE_FAILURE_MESSAGES.sessionStart));
+ setErrorMessage(failureMessage(code));
setStatus('error');
});
+ };
+
+ // A Bitkit (grant) sign-in carries no AuthToken to redeem: its purchase
+ // session comes from the browser bootstrap, a second Bitkit approval.
+ const bootstrapPubky = grantSignInPubky();
+ if (grantFlowEnabled && bootstrapPubky && !MarketplaceSessionService.getActiveSession()) {
+ setRequestsGrantReconnect(false);
+ setRequestsGrantBootstrap(true);
+ runGrantFlow(() => beginMarketplaceBootstrapFlow({ pubky: bootstrapPubky }), marketplaceBootstrapFailureMessage);
+ return;
+ }
+
+ // Reconnect grant cannot mint a first session: BFF createFlow requires a
+ // paired cookie. A seller with no marketplace bearer must bootstrap via
+ // AuthToken instead of opening a grant that 401s locally as "expired".
+ if (grantFlowEnabled && MarketplaceSessionService.getActiveSession()) {
+ setRequestsGrantBootstrap(false);
+ setRequestsGrantReconnect(true);
+ runGrantFlow(
+ beginMarketplaceGrantFlow,
+ (code) => marketplaceFailureMessage(code, MARKETPLACE_FAILURE_MESSAGES.sessionStart),
+ startAuthTokenConnect,
+ );
return;
}
@@ -280,6 +323,7 @@ export function useMarketplaceSessionConnect(
errorMessage,
requestsFullGrant,
requestsGrantReconnect,
+ requestsGrantBootstrap,
start,
cancel,
copyAuthUrl,
diff --git a/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.types.ts b/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.types.ts
index d853af72e..29641929d 100644
--- a/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.types.ts
+++ b/src/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect.types.ts
@@ -56,6 +56,12 @@ export interface UseMarketplaceSessionConnectReturn {
* must render this instead of re-reading the grant flag.
*/
requestsGrantReconnect: boolean;
+ /**
+ * True while `start()` is running (or about to run) the browser bootstrap:
+ * a Bitkit (grant) sign-in with no marketplace bearer yet. Its approval is a
+ * Bitkit grant, so the dialog shows Bitkit copy, never the Ring prompt.
+ */
+ requestsGrantBootstrap: boolean;
/** Begins a fresh flow, cancelling any in-flight one. */
start: () => void;
/** Cancels the in-flight flow (frees it) and returns to `idle`. */
diff --git a/src/libs/commerce/failure-messages.test.ts b/src/libs/commerce/failure-messages.test.ts
index 321d8efe2..a4e48e40d 100644
--- a/src/libs/commerce/failure-messages.test.ts
+++ b/src/libs/commerce/failure-messages.test.ts
@@ -5,6 +5,7 @@ import { ClientErrorCode, ServerErrorCode, ValidationErrorCode } from '@/libs/er
import { ErrorCategory, ErrorService } from '@/libs/error/error.types';
import {
MARKETPLACE_FAILURE_MESSAGES,
+ marketplaceBootstrapFailureMessage,
marketplaceCheckoutRefusalMessage,
marketplaceDropRefusalMessage,
marketplaceFailureMessage,
@@ -288,3 +289,41 @@ describe('marketplaceOfferFailureMessage', () => {
);
});
});
+
+describe('Bitkit purchase bootstrap reason codes', () => {
+ it.each([
+ ['origin_denied', 'This request did not come from the Shop. Reload and try again.'],
+ ['invalid_request', 'Something went wrong. Try again.'],
+ ['grant_unavailable', 'Bitkit approvals are unavailable right now. Try again later.'],
+ ['retry_later', 'Too many attempts. Wait a minute and try again.'],
+ ['challenge_not_found', 'This approval expired. Start again.'],
+ ['challenge_consumed', 'This approval was already used. Start again.'],
+ ['homeserver_proof_invalid', 'Your homeserver could not confirm this sign-in. Start again.'],
+ ['flow_expired', 'This approval expired. Start again.'],
+ ['flow_cancelled', 'Approval cancelled.'],
+ ['result_denied', 'This approval could not be completed. Start again.'],
+ [
+ 'identity_mismatch',
+ "This approval came from a different account. Approve with the account you're signed in with.",
+ ],
+ ['fresh_approval_required', 'Approve again in Bitkit.'],
+ ['flow_binding_missing', 'This approval belongs to another tab. Start again here.'],
+ ['flow_binding_denied', 'This approval belongs to another tab. Start again here.'],
+ ['flow_not_found', 'This approval expired. Start again.'],
+ ['claim_in_progress', 'Finishing your approval…'],
+ ['shop_session_expired', 'Your Shop session ended. Sign in again.'],
+ ['approval_invalid', 'That approval could not be verified. Approve again in Bitkit.'],
+ ])('bootstrap reason code %s maps to copy', (code, copy) => {
+ expect(marketplaceBootstrapFailureMessage(code)).toBe(copy);
+ });
+
+ it('keeps the reconnect copy for shop_session_expired outside the bootstrap', () => {
+ expect(marketplaceFailureMessage('shop_session_expired', MARKETPLACE_FAILURE_MESSAGES.sessionStart)).toBe(
+ MARKETPLACE_FAILURE_MESSAGES.sessionCookieExpired,
+ );
+ });
+
+ it('an unknown bootstrap code falls back to static copy, never the code', () => {
+ expect(marketplaceBootstrapFailureMessage('something_new')).toBe(MARKETPLACE_FAILURE_MESSAGES.sessionStart);
+ });
+});
diff --git a/src/libs/commerce/failure-messages.ts b/src/libs/commerce/failure-messages.ts
index 39107c6c6..d284d8d14 100644
--- a/src/libs/commerce/failure-messages.ts
+++ b/src/libs/commerce/failure-messages.ts
@@ -108,6 +108,42 @@ const CHECKOUT_REFUSAL_MESSAGES: ReadonlyMap = new Map([
],
]);
+/**
+ * Copy for the Bitkit purchase bootstrap. `shop_session_expired` here means
+ * the grant sign-in itself ended (its homeserver write was refused), not a
+ * marketplace cookie, so it must not use the reconnect copy.
+ */
+const BOOTSTRAP_APPROVAL_EXPIRED = 'This approval expired. Start again.';
+const BOOTSTRAP_OTHER_TAB = 'This approval belongs to another tab. Start again here.';
+
+export const MARKETPLACE_BOOTSTRAP_CODE_MESSAGES: ReadonlyMap = new Map([
+ ['origin_denied', 'This request did not come from the Shop. Reload and try again.'],
+ ['invalid_request', 'Something went wrong. Try again.'],
+ ['grant_unavailable', 'Bitkit approvals are unavailable right now. Try again later.'],
+ ['retry_later', 'Too many attempts. Wait a minute and try again.'],
+ ['challenge_not_found', BOOTSTRAP_APPROVAL_EXPIRED],
+ ['challenge_consumed', 'This approval was already used. Start again.'],
+ ['homeserver_proof_invalid', 'Your homeserver could not confirm this sign-in. Start again.'],
+ ['flow_expired', BOOTSTRAP_APPROVAL_EXPIRED],
+ ['flow_cancelled', 'Approval cancelled.'],
+ ['result_denied', 'This approval could not be completed. Start again.'],
+ ['identity_mismatch', "This approval came from a different account. Approve with the account you're signed in with."],
+ ['fresh_approval_required', 'Approve again in Bitkit.'],
+ ['flow_binding_missing', BOOTSTRAP_OTHER_TAB],
+ ['flow_binding_denied', BOOTSTRAP_OTHER_TAB],
+ ['flow_not_found', BOOTSTRAP_APPROVAL_EXPIRED],
+ ['claim_in_progress', 'Finishing your approval…'],
+ ['shop_session_expired', 'Your Shop session ended. Sign in again.'],
+ ['approval_invalid', 'That approval could not be verified. Approve again in Bitkit.'],
+]);
+
+export function marketplaceBootstrapFailureMessage(code: MarketplaceFailureCode): string {
+ return (
+ (code && MARKETPLACE_BOOTSTRAP_CODE_MESSAGES.get(code)) ||
+ marketplaceFailureMessage(code, MARKETPLACE_FAILURE_MESSAGES.sessionStart)
+ );
+}
+
export function marketplaceCheckoutRefusalMessage(code: MarketplaceFailureCode, message: unknown): string | null {
if (typeof code !== 'string' || typeof message !== 'string') return null;
return CHECKOUT_REFUSAL_MESSAGES.get(`${code}:${message}`) ?? null;
diff --git a/src/server/marketplace-grant/browser-bff.test.ts b/src/server/marketplace-grant/browser-bff.test.ts
new file mode 100644
index 000000000..fca26a3ab
--- /dev/null
+++ b/src/server/marketplace-grant/browser-bff.test.ts
@@ -0,0 +1,779 @@
+/** @vitest-environment node */
+import { randomUUID } from 'node:crypto';
+import { readdirSync } from 'node:fs';
+import path from 'node:path';
+import { hkdf } from '@noble/hashes/hkdf.js';
+import { sha256 } from '@noble/hashes/sha2.js';
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest';
+import { BffError } from './bff';
+import { type CliGrantConfig, resetMarketplaceGrantConfigForTests } from './config';
+import {
+ BrowserContextRefused,
+ browserSeedKeyForTests,
+ deriveBrowserBootstrap,
+ encodeBase64Url,
+ hashBoundCookie,
+ hashCliDeliveryId,
+ hashCliToken,
+ makeBoundCookie,
+ openBrowserFlowContext,
+ sealBrowserFlowContext,
+ sealCliFlowContext,
+ sha256Bytes,
+} from './crypto';
+
+const insertCliChallenge = vi.fn();
+const consumeCliRateLimit = vi.fn();
+const getCliChallenge = vi.fn();
+const consumeChallengeAndInsertCliFlow = vi.fn();
+const bindCliFlow = vi.fn();
+const terminalizeCliFlow = vi.fn();
+const getCliFlow = vi.fn();
+const acquireCliClaim = vi.fn();
+const completeCliClaim = vi.fn();
+const abandonCliClaim = vi.fn();
+const renewCliClaim = vi.fn();
+const assertCliGrantSchema = vi.fn();
+const fetchHomeserverProofDocument = vi.fn();
+const createBootstrapFlow = vi.fn();
+const getGrantStatus = vi.fn();
+const claimGrantResult = vi.fn();
+const ticketGrantResult = vi.fn();
+const cancelGrant = vi.fn();
+
+vi.mock('./db', async (importOriginal) => {
+ const actual = await importOriginal();
+ return {
+ ...actual,
+ assertCliGrantSchema: (...args: unknown[]) => assertCliGrantSchema(...args),
+ insertCliChallenge: (...args: unknown[]) => insertCliChallenge(...args),
+ consumeCliRateLimit: (...args: unknown[]) => consumeCliRateLimit(...args),
+ getCliChallenge: (...args: unknown[]) => getCliChallenge(...args),
+ consumeChallengeAndInsertCliFlow: (...args: unknown[]) => consumeChallengeAndInsertCliFlow(...args),
+ bindCliFlow: (...args: unknown[]) => bindCliFlow(...args),
+ terminalizeCliFlow: (...args: unknown[]) => terminalizeCliFlow(...args),
+ getCliFlow: (...args: unknown[]) => getCliFlow(...args),
+ acquireCliClaim: (...args: unknown[]) => acquireCliClaim(...args),
+ completeCliClaim: (...args: unknown[]) => completeCliClaim(...args),
+ abandonCliClaim: (...args: unknown[]) => abandonCliClaim(...args),
+ renewCliClaim: (...args: unknown[]) => renewCliClaim(...args),
+ };
+});
+
+vi.mock('./homeserver-proof', async (importOriginal) => {
+ const actual = await importOriginal();
+ return {
+ ...actual,
+ fetchHomeserverProofDocument: (...args: unknown[]) => fetchHomeserverProofDocument(...args),
+ };
+});
+
+vi.mock('./service', async (importOriginal) => {
+ const actual = await importOriginal();
+ return {
+ ...actual,
+ createBootstrapFlow: (...args: unknown[]) => createBootstrapFlow(...args),
+ getGrantStatus: (...args: unknown[]) => getGrantStatus(...args),
+ claimGrantResult: (...args: unknown[]) => claimGrantResult(...args),
+ ticketGrantResult: (...args: unknown[]) => ticketGrantResult(...args),
+ cancelGrant: (...args: unknown[]) => cancelGrant(...args),
+ };
+});
+
+const ENV = { ...process.env };
+const ORIGIN = 'https://shop.example';
+const pubky = 'yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyy';
+const otherPubky = 'o1gg8yc7mj4ksrzr6ms3s5rs8h7bo8y7ohcq7j88wbkm7ns7tuxo';
+const challengeId = '018f4f36-7a61-7d4e-8f22-3e31ed45d2af';
+const STATE_KEY_1 = Buffer.alloc(32, 3).toString('base64');
+const STATE_KEY_2 = Buffer.alloc(32, 5).toString('base64');
+const STATE_KEY_3 = Buffer.alloc(32, 7).toString('base64');
+const ASSERTION_SEED_HEX = '11'.repeat(32);
+const REQUEST_SEED_HEX = '22'.repeat(32);
+
+function grantEnv(overrides: Record = {}): void {
+ process.env = {
+ ...ENV,
+ SHOP_BFF_GRANT_FLOW_ENABLED: 'true',
+ SHOP_ALLOWED_ORIGINS: `["${ORIGIN}"]`,
+ SHOP_PUBLIC_ORIGIN: ORIGIN,
+ MARKETPLACE_SERVICE_URL: 'https://service.example',
+ SHOP_BFF_GRANT_STATE_DATABASE_URL: 'postgres://example',
+ CRON_SECRET: 'c'.repeat(32),
+ SHOP_GRANT_ASSERTION_ISSUER: ORIGIN,
+ SHOP_GRANT_ASSERTION_KEY_ID: 'shop-bff-test-0001',
+ SHOP_GRANT_ASSERTION_KEY_EPOCH: '1',
+ SHOP_GRANT_ASSERTION_SIGNING_KEY: ASSERTION_SEED_HEX,
+ MARKETPLACE_SERVICE_REQUEST_KEY_ID: 'shop-bff-request-test-0001',
+ MARKETPLACE_SERVICE_REQUEST_KEY_EPOCH: '1',
+ MARKETPLACE_SERVICE_REQUEST_SIGNING_KEY: REQUEST_SEED_HEX,
+ SHOP_BFF_GRANT_STATE_ENCRYPTION_KEY_B64: STATE_KEY_1,
+ SHOP_BFF_GRANT_STATE_KEY_EPOCH: '1',
+ };
+ delete process.env.VERCEL;
+ delete process.env.SHOP_BFF_CLI_GRANT_ENABLED;
+ for (const [key, value] of Object.entries(overrides)) {
+ if (value === undefined) delete process.env[key];
+ else process.env[key] = value;
+ }
+ resetMarketplaceGrantConfigForTests();
+}
+
+function rotateTo(epoch: number, key: string, previous?: { epoch: number; key: string }): void {
+ process.env.SHOP_BFF_GRANT_STATE_ENCRYPTION_KEY_B64 = key;
+ process.env.SHOP_BFF_GRANT_STATE_KEY_EPOCH = String(epoch);
+ if (previous) {
+ process.env.SHOP_BFF_GRANT_STATE_PREVIOUS_ENCRYPTION_KEY_B64 = previous.key;
+ process.env.SHOP_BFF_GRANT_STATE_PREVIOUS_KEY_EPOCH = String(previous.epoch);
+ } else {
+ delete process.env.SHOP_BFF_GRANT_STATE_PREVIOUS_ENCRYPTION_KEY_B64;
+ delete process.env.SHOP_BFF_GRANT_STATE_PREVIOUS_KEY_EPOCH;
+ }
+ resetMarketplaceGrantConfigForTests();
+}
+
+async function browserConfig(): Promise {
+ const { getBrowserBootstrapConfig } = await import('./config');
+ const config = getBrowserBootstrapConfig();
+ if (!config) throw new Error('browser bootstrap config missing');
+ return config;
+}
+
+function jsonRequest(url: string, body: unknown, headers: Record = {}): Request {
+ return new Request(url, {
+ method: 'POST',
+ headers: { 'content-type': 'application/json', origin: ORIGIN, ...headers },
+ body: JSON.stringify(body),
+ });
+}
+
+const challengeRequest = (body: unknown = { pubky }, headers: Record = {}) =>
+ jsonRequest(`${ORIGIN}/api/marketplace/bootstrap-challenges`, body, headers);
+const verifyRequest = (nonce: string) =>
+ jsonRequest(`${ORIGIN}/api/marketplace/bootstrap-challenges/${challengeId}/verify`, { nonce });
+const flowRequest = (stateId: string, headers: Record = {}) =>
+ jsonRequest(`${ORIGIN}/api/marketplace/bootstrap-flows/${stateId}/status`, {}, headers);
+
+type StoredChallenge = {
+ challenge_id: string;
+ pubky: string;
+ result_cpk: string;
+ result_delivery_id_hash: Uint8Array;
+ nonce_hash: Uint8Array;
+ consumed_at: Date | null;
+ created_at: Date;
+ expires_at: Date;
+};
+
+/** Mirrors `insertCliChallenge` into `getCliChallenge`, the way the table would. */
+function storeInsertedChallenges(): Map {
+ const rows = new Map();
+ insertCliChallenge.mockImplementation(async (_config: unknown, row: Record) => {
+ const createdAt = new Date(Math.floor(Date.now() / 1000) * 1000);
+ rows.set(String(row.challengeId), {
+ challenge_id: String(row.challengeId),
+ pubky: String(row.pubky),
+ result_cpk: String(row.resultCpk),
+ result_delivery_id_hash: row.resultDeliveryIdHash as Uint8Array,
+ nonce_hash: row.nonceHash as Uint8Array,
+ consumed_at: null,
+ created_at: createdAt,
+ expires_at: row.expiresAt as Date,
+ });
+ });
+ getCliChallenge.mockImplementation(async (_config: unknown, id: string) => rows.get(id) ?? null);
+ return rows;
+}
+
+/** A challenge row as the browser route stores it for `challengeId`. */
+function browserChallengeRow(config: CliGrantConfig, epoch = config.stateKeyEpoch, nonce = new Uint8Array(32).fill(9)) {
+ const derived = deriveBrowserBootstrap(config, epoch, challengeId);
+ const createdAt = new Date(Math.floor(Date.now() / 1000) * 1000);
+ return {
+ derived,
+ nonce,
+ row: {
+ challenge_id: challengeId,
+ pubky,
+ result_cpk: derived.resultCpk,
+ result_delivery_id_hash: hashCliDeliveryId(config, epoch, challengeId, derived.resultDeliveryId),
+ nonce_hash: sha256Bytes(nonce),
+ consumed_at: null,
+ created_at: createdAt,
+ expires_at: new Date(createdAt.getTime() + 60_000),
+ } satisfies StoredChallenge,
+ };
+}
+
+function browserFlowRow(
+ config: CliGrantConfig,
+ opts: { tokenHash?: Uint8Array; contextSealed?: Uint8Array; status?: string; epoch?: number } = {},
+) {
+ const stateId = randomUUID();
+ const bound = makeBoundCookie(stateId);
+ const epoch = opts.epoch ?? config.stateKeyEpoch;
+ const derived = deriveBrowserBootstrap(config, epoch, challengeId);
+ const row = {
+ state_id: stateId,
+ challenge_id: challengeId,
+ flow_id: randomUUID(),
+ pubky,
+ result_cpk: derived.resultCpk,
+ token_hash: opts.tokenHash ?? hashBoundCookie(config, epoch, 'flow', stateId, bound.secret),
+ context_sealed:
+ opts.contextSealed ??
+ sealBrowserFlowContext(config, stateId, pubky, {
+ kind: 'browser',
+ resultDeliveryId: encodeBase64Url(derived.resultDeliveryId),
+ resultPopSeed: encodeBase64Url(derived.resultPopSeed),
+ version: 2,
+ }),
+ result_token_sealed: null,
+ key_epoch: epoch,
+ status: opts.status ?? 'awaiting',
+ lease_owner: null,
+ lease_until: null,
+ version: '1',
+ created_at: new Date(),
+ expires_at: new Date(Date.now() + 60_000),
+ terminal_at: null,
+ };
+ return { bound, derived, row, stateId };
+}
+
+function completeServiceFlow(flowId: string) {
+ getGrantStatus.mockResolvedValue({
+ expires_at: new Date(Date.now() + 60_000).toISOString(),
+ flow_id: flowId,
+ status: 'complete',
+ terminal_code: null,
+ });
+}
+
+const claimedSession = (claimedPubky = pubky) => ({
+ capabilities: '/pub/pubky.app/marketplace-service/v1/:rw',
+ expires_at: new Date(Date.now() + 3_600_000).toISOString(),
+ pubky: claimedPubky,
+ token: 'marketplace-bearer',
+});
+
+function secretForms(bytes: Uint8Array): string[] {
+ const buffer = Buffer.from(bytes);
+ return [buffer.toString('hex'), buffer.toString('base64'), buffer.toString('base64url')];
+}
+
+describe('browser purchase bootstrap BFF', () => {
+ beforeEach(() => {
+ vi.resetAllMocks();
+ consumeCliRateLimit.mockResolvedValue(true);
+ assertCliGrantSchema.mockResolvedValue(undefined);
+ insertCliChallenge.mockResolvedValue(undefined);
+ bindCliFlow.mockResolvedValue(true);
+ consumeChallengeAndInsertCliFlow.mockResolvedValue(undefined);
+ completeCliClaim.mockResolvedValue(true);
+ renewCliClaim.mockResolvedValue(true);
+ abandonCliClaim.mockResolvedValue(undefined);
+ terminalizeCliFlow.mockResolvedValue(undefined);
+ createBootstrapFlow.mockResolvedValue({
+ authorization_url: 'pubkyauth://signin_grant?caps=x',
+ expires_at: new Date(Date.now() + 120_000).toISOString(),
+ flow_id: randomUUID(),
+ status: 'awaiting',
+ });
+ grantEnv();
+ });
+
+ afterEach(() => {
+ process.env = { ...ENV };
+ resetMarketplaceGrantConfigForTests();
+ vi.restoreAllMocks();
+ });
+
+ // A1
+ it('browser challenge stores derived result_cpk and delivery hash', async () => {
+ const rows = storeInsertedChallenges();
+ const { createBrowserChallenge } = await import('./browser-bff');
+ const config = await browserConfig();
+
+ const created = await createBrowserChallenge(challengeRequest());
+ const derived = deriveBrowserBootstrap(config, 1, created.challenge_id);
+ const stored = rows.get(created.challenge_id)!;
+
+ expect(stored.result_cpk).toBe(derived.resultCpk);
+ expect(Buffer.from(stored.result_delivery_id_hash)).toEqual(
+ Buffer.from(hashCliDeliveryId(config, 1, created.challenge_id, derived.resultDeliveryId)),
+ );
+ expect(created.result_cpk).toBe(derived.resultCpk);
+ expect(created.result_delivery_id).toBe(encodeBase64Url(derived.resultDeliveryId));
+ expect(created.proof_uri).toBe(
+ `pubky://${pubky}/pub/pubky.app/marketplace/v1/cli-grant-proofs/${created.challenge_id}`,
+ );
+ expect(created.proof_document).toMatchObject({
+ aud: ORIGIN,
+ challenge_id: created.challenge_id,
+ pubky,
+ result_cpk: derived.resultCpk,
+ result_delivery_id: created.result_delivery_id,
+ });
+ });
+
+ // A2
+ it('result seed never leaves bff', async () => {
+ const rows = storeInsertedChallenges();
+ const logged: unknown[] = [];
+ for (const method of ['log', 'info', 'warn', 'error', 'debug'] as const) {
+ vi.spyOn(console, method).mockImplementation((...args: unknown[]) => {
+ logged.push(args);
+ });
+ }
+ const { createBrowserChallenge, verifyBrowserChallenge, pollBrowserFlow } = await import('./browser-bff');
+ const { grantError } = await import('./http');
+ const config = await browserConfig();
+
+ const created = await createBrowserChallenge(challengeRequest());
+ expect(Object.keys(created).sort()).toEqual([
+ 'challenge_id',
+ 'expires_at',
+ 'nonce',
+ 'proof_document',
+ 'proof_uri',
+ 'result_cpk',
+ 'result_delivery_id',
+ ]);
+ const seed = deriveBrowserBootstrap(config, 1, created.challenge_id).resultPopSeed;
+ fetchHomeserverProofDocument.mockResolvedValue(created.proof_document);
+ const verifyUrl = `${ORIGIN}/api/marketplace/bootstrap-challenges/${created.challenge_id}/verify`;
+ const verified = await verifyBrowserChallenge(
+ jsonRequest(verifyUrl, { nonce: created.nonce }),
+ created.challenge_id,
+ );
+ expect(Object.keys(verified.response).sort()).toEqual(['authorization_url', 'expires_at', 'state_id', 'status']);
+
+ const flowInsert = consumeChallengeAndInsertCliFlow.mock.calls[0][2] as Record;
+ const stateId = String(flowInsert.stateId);
+ const flow = {
+ state_id: stateId,
+ challenge_id: created.challenge_id,
+ flow_id: randomUUID(),
+ pubky,
+ result_cpk: created.result_cpk,
+ token_hash: flowInsert.tokenHash,
+ context_sealed: flowInsert.contextSealed,
+ result_token_sealed: null,
+ key_epoch: 1,
+ status: 'awaiting',
+ lease_owner: null,
+ lease_until: null,
+ version: '1',
+ created_at: new Date(),
+ expires_at: new Date(Date.now() + 60_000),
+ terminal_at: null,
+ };
+ getCliFlow.mockResolvedValue(flow);
+ acquireCliClaim.mockResolvedValue(flow);
+ completeServiceFlow(flow.flow_id);
+ claimGrantResult.mockResolvedValue(claimedSession());
+ const polled = await pollBrowserFlow(flowRequest(stateId), verified.cookie, stateId);
+ expect(polled.status).toBe('connected');
+ expect(Buffer.from(claimGrantResult.mock.calls[0][3] as Uint8Array)).toEqual(Buffer.from(seed));
+
+ // A refusal body goes through the same logger path.
+ const refusal = grantError(new BffError(409, 'fresh_approval_required'));
+ const refusalBody = await refusal.json();
+
+ const outbound = JSON.stringify({
+ created,
+ proofDocument: created.proof_document,
+ verified,
+ polled,
+ refusalBody,
+ logged,
+ serviceBootstrapArgs: createBootstrapFlow.mock.calls,
+ });
+ for (const form of secretForms(seed)) expect(outbound).not.toContain(form);
+ expect(rows.size).toBe(1);
+ });
+
+ // A3
+ it('verify refuses a challenge after a state key rotation', async () => {
+ storeInsertedChallenges();
+ const { createBrowserChallenge, verifyBrowserChallenge } = await import('./browser-bff');
+ const created = await createBrowserChallenge(challengeRequest());
+
+ rotateTo(2, STATE_KEY_2, { epoch: 1, key: STATE_KEY_1 });
+ const verifyUrl = `${ORIGIN}/api/marketplace/bootstrap-challenges/${created.challenge_id}/verify`;
+ await expect(
+ verifyBrowserChallenge(jsonRequest(verifyUrl, { nonce: created.nonce }), created.challenge_id),
+ ).rejects.toEqual(new BffError(409, 'fresh_approval_required'));
+ expect(fetchHomeserverProofDocument).not.toHaveBeenCalled();
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ expect(createBootstrapFlow).not.toHaveBeenCalled();
+ });
+
+ // A4
+ it('claim opens a context sealed under the previous epoch', async () => {
+ const epoch1 = await browserConfig();
+ const { bound, derived, row, stateId } = browserFlowRow(epoch1);
+ rotateTo(2, STATE_KEY_2, { epoch: 1, key: STATE_KEY_1 });
+ getCliFlow.mockResolvedValue(row);
+ acquireCliClaim.mockResolvedValue(row);
+ completeServiceFlow(row.flow_id);
+ claimGrantResult.mockResolvedValue(claimedSession());
+ const { pollBrowserFlow } = await import('./browser-bff');
+
+ await expect(pollBrowserFlow(flowRequest(stateId), bound.value, stateId)).resolves.toMatchObject({
+ status: 'connected',
+ pubky,
+ });
+ expect(claimGrantResult).toHaveBeenCalledWith(
+ expect.anything(),
+ row.flow_id,
+ encodeBase64Url(derived.resultDeliveryId),
+ derived.resultPopSeed,
+ expect.any(Function),
+ );
+ });
+
+ it('claim fails closed when the sealing epoch is gone', async () => {
+ const epoch1 = await browserConfig();
+ const { bound, row, stateId } = browserFlowRow(epoch1);
+ rotateTo(3, STATE_KEY_3, { epoch: 2, key: STATE_KEY_2 });
+ getCliFlow.mockResolvedValue(row);
+ acquireCliClaim.mockResolvedValue(row);
+ completeServiceFlow(row.flow_id);
+ const { pollBrowserFlow } = await import('./browser-bff');
+
+ await expect(pollBrowserFlow(flowRequest(stateId), bound.value, stateId)).rejects.toEqual(
+ new BffError(422, 'fresh_approval_required'),
+ );
+ expect(claimGrantResult).not.toHaveBeenCalled();
+ const current = await browserConfig();
+ expect(() => openBrowserFlowContext(current, stateId, pubky, 1, row.context_sealed)).toThrow(
+ new BrowserContextRefused('epoch_unavailable'),
+ );
+ });
+
+ // A5
+ it('browser seed key differs from every existing BFF key for the same epoch', async () => {
+ const config = await browserConfig();
+ const root = Uint8Array.from(Buffer.from(STATE_KEY_1, 'base64'));
+ const utf8 = new TextEncoder();
+ const epochBytes = Uint8Array.of(0, 1);
+ const info = (label: string) => Uint8Array.from([...utf8.encode(label), ...epochBytes]);
+ const stateSalt = utf8.encode('marketplace/shop-bff-state/hkdf-salt/v1');
+ const existing = {
+ sessionCookie: hkdf(sha256, root, stateSalt, info('marketplace/shop-bff-state/session-cookie-key/v1'), 32),
+ flowCookie: hkdf(sha256, root, stateSalt, info('marketplace/shop-bff-state/flow-cookie-key/v1'), 32),
+ seal: hkdf(sha256, root, stateSalt, info('marketplace/shop-bff-state/seal-key/v1'), 32),
+ cliToken: hkdf(
+ sha256,
+ root,
+ utf8.encode('shop-bff/cli-flow-token/hkdf-salt/v1'),
+ info('shop-bff/cli-flow-token/token-key/v1'),
+ 32,
+ ),
+ cliDelivery: hkdf(
+ sha256,
+ root,
+ utf8.encode('shop-bff/cli-challenge/hkdf-salt/v1'),
+ info('shop-bff/cli-challenge/delivery-key/v1'),
+ 32,
+ ),
+ };
+ const hex = (bytes: Uint8Array) => Buffer.from(bytes).toString('hex');
+ const seedKey = hex(browserSeedKeyForTests(config, 1));
+ for (const key of Object.values(existing)) expect(hex(key)).not.toBe(seedKey);
+
+ const derived = deriveBrowserBootstrap(config, 1, challengeId);
+ const raw = [hex(root), ASSERTION_SEED_HEX, REQUEST_SEED_HEX, ...Object.values(existing).map(hex)];
+ for (const output of [hex(derived.resultPopSeed), hex(derived.resultDeliveryId)]) {
+ expect(raw).not.toContain(output);
+ }
+ expect(hex(derived.resultPopSeed)).not.toBe(hex(derived.resultDeliveryId));
+ expect(deriveBrowserBootstrap(config, 1, randomUUID()).resultCpk).not.toBe(derived.resultCpk);
+
+ // Known-answer vector, computed with an independent HKDF/HMAC implementation
+ // for state key 0x03×32, epoch 1 and the fixed challenge id.
+ expect(seedKey).toBe('a72aa8ce19621199841f1658d6cff9c5eb4645845143c9bffb745793f6003817');
+ expect(hex(derived.resultPopSeed)).toBe('837f6142178ab22ae96c2bf7e30a9d124e9eeab49f2d94df0994dbfe35be1c4c');
+ expect(hex(derived.resultDeliveryId)).toBe('9f0f3139a127cc702c3275a7a644892eac828b9cf4aa112e0cf5fbf2dace6e71');
+ });
+
+ // A6
+ it('cli routes refuse a browser bootstrap flow', async () => {
+ grantEnv({ SHOP_BFF_CLI_GRANT_ENABLED: 'true' });
+ const config = await browserConfig();
+ const { bound, row, stateId } = browserFlowRow(config);
+ getCliFlow.mockResolvedValue(row);
+ const { cliFlowStatus } = await import('./cli-bff');
+
+ await expect(
+ cliFlowStatus(flowRequest(stateId, { authorization: `PubkyShopCli ${bound.value}` }), stateId),
+ ).rejects.toEqual(new BffError(401, 'cli_token_denied'));
+ expect(getGrantStatus).not.toHaveBeenCalled();
+ expect(ticketGrantResult).not.toHaveBeenCalled();
+ });
+
+ it('browser routes refuse a cli flow', async () => {
+ grantEnv({ SHOP_BFF_CLI_GRANT_ENABLED: 'true' });
+ const config = await browserConfig();
+ const stateId = randomUUID();
+ const bound = makeBoundCookie(stateId);
+ const { row } = browserFlowRow(config, { tokenHash: hashCliToken(config, 1, bound.secret) });
+ getCliFlow.mockResolvedValue({ ...row, state_id: stateId });
+ const { pollBrowserFlow } = await import('./browser-bff');
+
+ await expect(pollBrowserFlow(flowRequest(stateId), bound.value, stateId)).rejects.toEqual(
+ new BffError(403, 'flow_binding_denied'),
+ );
+ expect(getGrantStatus).not.toHaveBeenCalled();
+ expect(claimGrantResult).not.toHaveBeenCalled();
+ });
+
+ it('cli verify refuses a browser bootstrap challenge before consume', async () => {
+ grantEnv({ SHOP_BFF_CLI_GRANT_ENABLED: 'true' });
+ const config = await browserConfig();
+ const { nonce, row } = browserChallengeRow(config);
+ getCliChallenge.mockResolvedValue(row);
+ const { verifyCliChallenge } = await import('./cli-bff');
+
+ await expect(
+ verifyCliChallenge(
+ jsonRequest(`${ORIGIN}/api/cli/grant-challenges/${challengeId}/verify`, { nonce: encodeBase64Url(nonce) }),
+ challengeId,
+ ),
+ ).rejects.toEqual(new BffError(404, 'challenge_not_found'));
+ expect(fetchHomeserverProofDocument).not.toHaveBeenCalled();
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ });
+
+ it('browser verify refuses a cli challenge before consume', async () => {
+ const config = await browserConfig();
+ const nonce = new Uint8Array(32).fill(9);
+ const cliDeliveryId = new Uint8Array(32).fill(4);
+ getCliChallenge.mockResolvedValue({
+ challenge_id: challengeId,
+ pubky,
+ result_cpk: pubky,
+ result_delivery_id_hash: hashCliDeliveryId(config, 1, challengeId, cliDeliveryId),
+ nonce_hash: sha256Bytes(nonce),
+ consumed_at: null,
+ created_at: new Date(),
+ expires_at: new Date(Date.now() + 60_000),
+ });
+ const { verifyBrowserChallenge } = await import('./browser-bff');
+
+ await expect(verifyBrowserChallenge(verifyRequest(encodeBase64Url(nonce)), challengeId)).rejects.toEqual(
+ new BffError(409, 'fresh_approval_required'),
+ );
+ expect(fetchHomeserverProofDocument).not.toHaveBeenCalled();
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ });
+
+ // A7
+ it('browser claim refuses a cli context', async () => {
+ const config = await browserConfig();
+ const stateId = randomUUID();
+ const bound = makeBoundCookie(stateId);
+ const cliContext = sealCliFlowContext(config, stateId, pubky, {
+ resultDeliveryId: encodeBase64Url(new Uint8Array(32).fill(4)),
+ version: 1,
+ });
+ const { row } = browserFlowRow(config, {
+ tokenHash: hashBoundCookie(config, 1, 'flow', stateId, bound.secret),
+ contextSealed: cliContext,
+ });
+ const flow = { ...row, state_id: stateId };
+ getCliFlow.mockResolvedValue(flow);
+ acquireCliClaim.mockResolvedValue(flow);
+ completeServiceFlow(flow.flow_id);
+ const { pollBrowserFlow } = await import('./browser-bff');
+
+ await expect(pollBrowserFlow(flowRequest(stateId), bound.value, stateId)).rejects.toEqual(
+ new BffError(403, 'result_denied'),
+ );
+ expect(claimGrantResult).not.toHaveBeenCalled();
+ expect(abandonCliClaim).toHaveBeenCalledWith(expect.anything(), stateId, expect.any(String));
+ });
+
+ // A8
+ it('browser bootstrap does not need the cli flag', async () => {
+ storeInsertedChallenges();
+ const { getCliGrantConfig } = await import('./config');
+ const { createBrowserChallenge } = await import('./browser-bff');
+
+ expect(process.env.SHOP_BFF_CLI_GRANT_ENABLED).toBeUndefined();
+ expect(getCliGrantConfig()).toBeNull();
+ await expect(createBrowserChallenge(challengeRequest())).resolves.toMatchObject({ proof_uri: expect.any(String) });
+ });
+
+ it.each([
+ ['the grant flag is off', { SHOP_BFF_GRANT_FLOW_ENABLED: 'false' }],
+ ['the state key is missing', { SHOP_BFF_GRANT_STATE_ENCRYPTION_KEY_B64: undefined }],
+ ['the database url is missing', { SHOP_BFF_GRANT_STATE_DATABASE_URL: undefined }],
+ ])('browser bootstrap 404s without grant config (%s)', async (_label, overrides) => {
+ grantEnv(overrides);
+ const { createBrowserChallenge, verifyBrowserChallenge, pollBrowserFlow } = await import('./browser-bff');
+ const unavailable = new BffError(404, 'grant_unavailable');
+ const stateId = randomUUID();
+
+ await expect(createBrowserChallenge(challengeRequest())).rejects.toEqual(unavailable);
+ await expect(verifyBrowserChallenge(verifyRequest('x'), challengeId)).rejects.toEqual(unavailable);
+ await expect(pollBrowserFlow(flowRequest(stateId), undefined, stateId)).rejects.toEqual(unavailable);
+ expect(insertCliChallenge).not.toHaveBeenCalled();
+ });
+
+ // R3.1
+ it('bootstrap routes reject cross-origin', async () => {
+ const { createBrowserChallenge, verifyBrowserChallenge } = await import('./browser-bff');
+ const denied = new BffError(403, 'origin_denied');
+
+ await expect(
+ createBrowserChallenge(challengeRequest({ pubky }, { origin: 'https://evil.example' })),
+ ).rejects.toEqual(denied);
+ await expect(
+ verifyBrowserChallenge(
+ jsonRequest(
+ `${ORIGIN}/api/marketplace/bootstrap-challenges/${challengeId}/verify`,
+ { nonce: 'x' },
+ {
+ origin: 'https://evil.example',
+ },
+ ),
+ challengeId,
+ ),
+ ).rejects.toEqual(denied);
+ expect(insertCliChallenge).not.toHaveBeenCalled();
+ expect(getCliChallenge).not.toHaveBeenCalled();
+ });
+
+ // R3.5
+ it('replayed challenge is consumed', async () => {
+ const config = await browserConfig();
+ const { nonce, row } = browserChallengeRow(config);
+ getCliChallenge.mockResolvedValue({ ...row, consumed_at: new Date() });
+ const { verifyBrowserChallenge } = await import('./browser-bff');
+
+ await expect(verifyBrowserChallenge(verifyRequest(encodeBase64Url(nonce)), challengeId)).rejects.toEqual(
+ new BffError(409, 'challenge_consumed'),
+ );
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ });
+
+ it('expired challenge rejected', async () => {
+ const config = await browserConfig();
+ const { nonce, row } = browserChallengeRow(config);
+ getCliChallenge.mockResolvedValue({ ...row, expires_at: new Date(Date.now() - 1_000) });
+ const { verifyBrowserChallenge } = await import('./browser-bff');
+
+ await expect(verifyBrowserChallenge(verifyRequest(encodeBase64Url(nonce)), challengeId)).rejects.toEqual(
+ new BffError(401, 'homeserver_proof_invalid'),
+ );
+ expect(fetchHomeserverProofDocument).not.toHaveBeenCalled();
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ });
+
+ it('missing nonce rejected', async () => {
+ const config = await browserConfig();
+ const { row } = browserChallengeRow(config);
+ getCliChallenge.mockResolvedValue(row);
+ const { verifyBrowserChallenge } = await import('./browser-bff');
+
+ await expect(verifyBrowserChallenge(jsonRequest(`${ORIGIN}/verify`, {}), challengeId)).rejects.toEqual(
+ new BffError(400, 'invalid_request'),
+ );
+ await expect(
+ verifyBrowserChallenge(verifyRequest(encodeBase64Url(new Uint8Array(32).fill(1))), challengeId),
+ ).rejects.toEqual(new BffError(401, 'homeserver_proof_invalid'));
+ expect(fetchHomeserverProofDocument).not.toHaveBeenCalled();
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ });
+
+ it('proof from another pubky rejected', async () => {
+ storeInsertedChallenges();
+ const { createBrowserChallenge, verifyBrowserChallenge } = await import('./browser-bff');
+ const created = await createBrowserChallenge(challengeRequest());
+ fetchHomeserverProofDocument.mockResolvedValue({ ...created.proof_document, pubky: otherPubky });
+ const verifyUrl = `${ORIGIN}/api/marketplace/bootstrap-challenges/${created.challenge_id}/verify`;
+
+ await expect(
+ verifyBrowserChallenge(jsonRequest(verifyUrl, { nonce: created.nonce }), created.challenge_id),
+ ).rejects.toEqual(new BffError(401, 'homeserver_proof_invalid'));
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ expect(createBootstrapFlow).not.toHaveBeenCalled();
+ });
+
+ it('foreign homeserver proof rejected', async () => {
+ storeInsertedChallenges();
+ const { HomeserverFetchDenied } = await import('./ssrf');
+ const { createBrowserChallenge, verifyBrowserChallenge } = await import('./browser-bff');
+ const created = await createBrowserChallenge(challengeRequest());
+ fetchHomeserverProofDocument.mockRejectedValue(new HomeserverFetchDenied());
+ const verifyUrl = `${ORIGIN}/api/marketplace/bootstrap-challenges/${created.challenge_id}/verify`;
+
+ await expect(
+ verifyBrowserChallenge(jsonRequest(verifyUrl, { nonce: created.nonce }), created.challenge_id),
+ ).rejects.toEqual(new BffError(401, 'homeserver_proof_invalid'));
+ expect(consumeChallengeAndInsertCliFlow).not.toHaveBeenCalled();
+ });
+
+ it('verify binds the flow to the bootstrap cookie with a version 2 browser context', async () => {
+ storeInsertedChallenges();
+ const { createBrowserChallenge, verifyBrowserChallenge } = await import('./browser-bff');
+ const config = await browserConfig();
+ const created = await createBrowserChallenge(challengeRequest());
+ fetchHomeserverProofDocument.mockResolvedValue(created.proof_document);
+ const verifyUrl = `${ORIGIN}/api/marketplace/bootstrap-challenges/${created.challenge_id}/verify`;
+
+ const verified = await verifyBrowserChallenge(
+ jsonRequest(verifyUrl, { nonce: created.nonce }),
+ created.challenge_id,
+ );
+ const insert = consumeChallengeAndInsertCliFlow.mock.calls[0][2] as {
+ stateId: string;
+ tokenHash: Uint8Array;
+ contextSealed: Uint8Array;
+ keyEpoch: number;
+ };
+ const [, secret] = verified.cookie.split('.');
+ expect(verified.response.state_id).toBe(insert.stateId);
+ expect(Buffer.from(insert.tokenHash)).toEqual(
+ Buffer.from(hashBoundCookie(config, 1, 'flow', insert.stateId, Buffer.from(secret, 'base64url'))),
+ );
+ const context = openBrowserFlowContext(config, insert.stateId, pubky, insert.keyEpoch, insert.contextSealed);
+ expect(context).toMatchObject({ kind: 'browser', version: 2 });
+ expect(createBootstrapFlow).toHaveBeenCalledWith(
+ expect.anything(),
+ created.result_delivery_id,
+ created.result_cpk,
+ pubky,
+ );
+ expect(bindCliFlow).toHaveBeenCalledOnce();
+ expect(verified).not.toHaveProperty('cli_token');
+ });
+
+ // R3.7
+ it('claim pubky mismatch rejected', async () => {
+ const config = await browserConfig();
+ const { bound, row, stateId } = browserFlowRow(config);
+ getCliFlow.mockResolvedValue(row);
+ acquireCliClaim.mockResolvedValue(row);
+ completeServiceFlow(row.flow_id);
+ claimGrantResult.mockResolvedValue(claimedSession(otherPubky));
+ const { pollBrowserFlow } = await import('./browser-bff');
+
+ await expect(pollBrowserFlow(flowRequest(stateId), bound.value, stateId)).rejects.toEqual(
+ new BffError(409, 'identity_mismatch'),
+ );
+ expect(terminalizeCliFlow).toHaveBeenCalledWith(expect.anything(), stateId, 'mismatch');
+ expect(completeCliClaim).not.toHaveBeenCalled();
+ });
+
+ // A9
+ it('no migration added by the browser bootstrap', () => {
+ const migrations = readdirSync(path.resolve(process.cwd(), 'db/bff'))
+ .filter((name) => name.endsWith('.sql'))
+ .sort();
+ expect(migrations).toEqual(['0001_shop_grant_bff.sql', '0002_shop_grant_bff_cli.sql']);
+ });
+});
diff --git a/src/server/marketplace-grant/browser-bff.ts b/src/server/marketplace-grant/browser-bff.ts
new file mode 100644
index 000000000..9251043e0
--- /dev/null
+++ b/src/server/marketplace-grant/browser-bff.ts
@@ -0,0 +1,398 @@
+import { randomBytes, randomUUID } from 'node:crypto';
+import { z } from 'zod';
+import { assertSameOrigin, BffError, FLOW_COOKIE, parseStrictJson } from './bff';
+import { canonicalZ32, clientIp, hashesEqual, requireUuid } from './cli-bff';
+import type { CliGrantConfig } from './config';
+import { getBrowserBootstrapConfig } from './config';
+import {
+ BrowserContextRefused,
+ cookieMatches,
+ decodeBase64Url32,
+ deriveBrowserBootstrap,
+ encodeBase64Url,
+ hashBoundCookie,
+ hashCliDeliveryId,
+ makeBoundCookie,
+ openBrowserFlowContext,
+ parseBoundCookie,
+ sealBrowserFlowContext,
+ sha256Bytes,
+} from './crypto';
+import {
+ abandonCliClaim,
+ acquireCliClaim,
+ assertCliGrantSchema,
+ bindCliFlow,
+ CliChallengeConsumeConflict,
+ type CliFlowRow,
+ completeCliClaim,
+ consumeChallengeAndInsertCliFlow,
+ consumeCliRateLimit,
+ getCliChallenge,
+ getCliFlow,
+ insertCliChallenge,
+ renewCliClaim,
+ terminalizeCliFlow,
+} from './db';
+import {
+ assertProofMatches,
+ type ExpectedProof,
+ expectedProofDocument,
+ fetchHomeserverProofDocument,
+ parseProofDocument,
+ proofUri,
+} from './homeserver-proof';
+import { cancelGrant, claimGrantResult, createBootstrapFlow, getGrantStatus } from './service';
+
+/**
+ * Browser purchase bootstrap for a Bitkit (grant) sign-in: the CLI verifier's
+ * checks, run by the BFF for a same-origin browser. The result PoP seed is
+ * derived from the state key and the challenge id (never stored on the
+ * challenge row, never sent to the browser); the flow is bound to the
+ * reconnect flow's `__Host-shop-marketplace-grant` cookie, not a CLI token.
+ */
+export const BOOTSTRAP_FLOW_COOKIE = FLOW_COOKIE;
+
+const challengeBody = z.object({ pubky: z.string() }).strict();
+const verifyBody = z.object({ nonce: z.string() }).strict();
+const emptyBody = z.object({}).strict();
+const VERIFY_PER_CHALLENGE_PER_MINUTE = 5;
+
+export function requiredBrowserConfig(): CliGrantConfig {
+ let config: CliGrantConfig | null;
+ try {
+ config = getBrowserBootstrapConfig();
+ } catch {
+ // A missing or invalid state key, database URL or verifier parameter.
+ config = null;
+ }
+ if (!config) throw new BffError(404, 'grant_unavailable');
+ return config;
+}
+
+async function rateLimit(config: CliGrantConfig, key: string, limit: number): Promise {
+ if (!(await consumeCliRateLimit(config, key, limit))) {
+ throw new BffError(429, 'retry_later', 60);
+ }
+}
+
+function proofInvalid(): never {
+ throw new BffError(401, 'homeserver_proof_invalid');
+}
+
+export type BrowserChallengeResponse = {
+ challenge_id: string;
+ expires_at: string;
+ nonce: string;
+ proof_document: ExpectedProof;
+ proof_uri: string;
+ result_cpk: string;
+ result_delivery_id: string;
+};
+
+export async function createBrowserChallenge(request: Request): Promise {
+ const config = requiredBrowserConfig();
+ assertSameOrigin(request, config);
+ await assertCliGrantSchema(config);
+ const input = await parseStrictJson(request, challengeBody);
+ const pubky = canonicalZ32(input.pubky);
+ await rateLimit(
+ config,
+ `browser_challenge_ip:${clientIp(request, config.trustedProxyCount)}`,
+ config.createPerIpPerMinute,
+ );
+ await rateLimit(config, `browser_challenge_pubky:${pubky}`, config.createPerPubkyPerMinute);
+
+ const challengeId = randomUUID();
+ const derived = deriveBrowserBootstrap(config, config.stateKeyEpoch, challengeId);
+ const nonce = Uint8Array.from(randomBytes(32));
+ const expiresAt = new Date(Date.now() + config.challengeTtlSeconds * 1000);
+ const resultDeliveryId = encodeBase64Url(derived.resultDeliveryId);
+ await insertCliChallenge(config, {
+ challengeId,
+ pubky,
+ resultCpk: derived.resultCpk,
+ resultDeliveryIdHash: hashCliDeliveryId(config, config.stateKeyEpoch, challengeId, derived.resultDeliveryId),
+ nonceHash: sha256Bytes(nonce),
+ expiresAt,
+ });
+ // The proof body the grant session writes: only public, verifier-bound fields.
+ // Its window comes from the stored row (database clock), which verify checks.
+ const stored = await getCliChallenge(config, challengeId);
+ if (!stored) throw new BffError(503, 'grant_unavailable');
+ const iat = Math.ceil(stored.created_at.getTime() / 1000);
+ const exp = Math.floor(stored.expires_at.getTime() / 1000);
+ if (!(exp > iat)) throw new BffError(503, 'grant_unavailable');
+ return {
+ challenge_id: challengeId,
+ expires_at: stored.expires_at.toISOString(),
+ nonce: encodeBase64Url(nonce),
+ proof_document: expectedProofDocument({
+ aud: config.publicOrigin,
+ challengeId,
+ exp,
+ iat,
+ nonce,
+ pubky,
+ resultCpk: derived.resultCpk,
+ resultDeliveryId,
+ }),
+ proof_uri: proofUri(pubky, challengeId),
+ result_cpk: derived.resultCpk,
+ result_delivery_id: resultDeliveryId,
+ };
+}
+
+export async function verifyBrowserChallenge(
+ request: Request,
+ challengeIdParam: string,
+): Promise<{
+ cookie: string;
+ maxAge: number;
+ response: { authorization_url: string; expires_at: string; state_id: string; status: 'awaiting' };
+}> {
+ const config = requiredBrowserConfig();
+ assertSameOrigin(request, config);
+ await assertCliGrantSchema(config);
+ const challengeId = requireUuid(challengeIdParam);
+ const input = await parseStrictJson(request, verifyBody);
+ let nonce: Uint8Array;
+ try {
+ nonce = decodeBase64Url32(input.nonce);
+ } catch {
+ throw new BffError(400, 'invalid_request');
+ }
+ await rateLimit(
+ config,
+ `browser_verify_ip:${clientIp(request, config.trustedProxyCount)}`,
+ config.verifyPerIpPerMinute,
+ );
+ await rateLimit(config, `browser_verify_challenge:${challengeId}`, VERIFY_PER_CHALLENGE_PER_MINUTE);
+
+ const challenge = await getCliChallenge(config, challengeId);
+ if (!challenge) throw new BffError(404, 'challenge_not_found');
+ if (challenge.consumed_at) throw new BffError(409, 'challenge_consumed');
+
+ // Re-derive under the current epoch only. A rotation inside the challenge
+ // window (or a CLI row, whose key the CLI chose) no longer matches: refuse
+ // before consume, so no flow is created.
+ const derived = deriveBrowserBootstrap(config, config.stateKeyEpoch, challengeId);
+ if (
+ derived.resultCpk !== challenge.result_cpk ||
+ !hashesEqual(
+ hashCliDeliveryId(config, config.stateKeyEpoch, challengeId, derived.resultDeliveryId),
+ challenge.result_delivery_id_hash,
+ )
+ ) {
+ throw new BffError(409, 'fresh_approval_required');
+ }
+ if (challenge.expires_at.getTime() <= Date.now()) proofInvalid();
+ if (!hashesEqual(sha256Bytes(nonce), challenge.nonce_hash)) proofInvalid();
+
+ const resultDeliveryId = encodeBase64Url(derived.resultDeliveryId);
+ try {
+ const parsed = await fetchHomeserverProofDocument(config, challenge.pubky, challengeId);
+ const document = parseProofDocument(parsed);
+ const createdSeconds = Math.floor(challenge.created_at.getTime() / 1000);
+ const expiresSeconds = Math.floor(challenge.expires_at.getTime() / 1000);
+ if (document.iat < createdSeconds) proofInvalid();
+ if (document.exp > expiresSeconds) proofInvalid();
+ if (!(document.exp > document.iat && document.exp - document.iat <= config.challengeTtlSeconds)) {
+ proofInvalid();
+ }
+ if (document.result_delivery_id !== resultDeliveryId) proofInvalid();
+ assertProofMatches(
+ parsed,
+ expectedProofDocument({
+ aud: config.publicOrigin,
+ challengeId,
+ exp: document.exp,
+ iat: document.iat,
+ nonce,
+ pubky: challenge.pubky,
+ resultCpk: challenge.result_cpk,
+ resultDeliveryId,
+ }),
+ );
+ } catch (error) {
+ if (error instanceof BffError) throw error;
+ proofInvalid();
+ }
+
+ const stateId = randomUUID();
+ const bound = makeBoundCookie(stateId);
+ const tokenHash = hashBoundCookie(config, config.stateKeyEpoch, 'flow', stateId, bound.secret);
+ const contextSealed = sealBrowserFlowContext(config, stateId, challenge.pubky, {
+ kind: 'browser',
+ resultDeliveryId,
+ resultPopSeed: encodeBase64Url(derived.resultPopSeed),
+ version: 2,
+ });
+ const localExpiry = new Date(Date.now() + config.stateTtlSeconds * 1000);
+ try {
+ await consumeChallengeAndInsertCliFlow(config, challengeId, {
+ stateId,
+ pubky: challenge.pubky,
+ resultCpk: challenge.result_cpk,
+ tokenHash,
+ contextSealed,
+ keyEpoch: config.stateKeyEpoch,
+ expiresAt: localExpiry,
+ });
+ } catch (error) {
+ if (error instanceof CliChallengeConsumeConflict) {
+ throw new BffError(
+ error.reason === 'consumed' ? 409 : 401,
+ error.reason === 'consumed' ? 'challenge_consumed' : 'homeserver_proof_invalid',
+ );
+ }
+ throw error;
+ }
+
+ try {
+ const created = await createBootstrapFlow(config, resultDeliveryId, challenge.result_cpk, challenge.pubky);
+ const serviceExpiry = new Date(created.expires_at);
+ if (!(await bindCliFlow(config, stateId, created.flow_id, serviceExpiry))) {
+ await terminalizeCliFlow(config, stateId, 'abandoned');
+ throw new BffError(503, 'grant_unavailable');
+ }
+ return {
+ cookie: bound.value,
+ maxAge: Math.max(1, Math.floor((Math.min(localExpiry.getTime(), serviceExpiry.getTime()) - Date.now()) / 1000)),
+ response: {
+ authorization_url: created.authorization_url,
+ expires_at: created.expires_at,
+ state_id: stateId,
+ status: 'awaiting',
+ },
+ };
+ } catch (error) {
+ await terminalizeCliFlow(config, stateId, 'abandoned');
+ throw error;
+ }
+}
+
+async function authenticatedBrowserFlow(
+ request: Request,
+ flowCookie: string | undefined,
+ stateIdParam: string,
+): Promise<{ config: CliGrantConfig; flow: CliFlowRow }> {
+ const config = requiredBrowserConfig();
+ assertSameOrigin(request, config);
+ await assertCliGrantSchema(config);
+ const stateId = requireUuid(stateIdParam);
+ const parsed = parseBoundCookie(flowCookie);
+ if (!parsed || parsed.id !== stateId) throw new BffError(401, 'flow_binding_missing');
+ const flow = await getCliFlow(config, stateId);
+ if (!flow) throw new BffError(404, 'flow_not_found');
+ let expectedHash: Uint8Array;
+ try {
+ expectedHash = hashBoundCookie(config, flow.key_epoch, 'flow', stateId, parsed.secret);
+ } catch {
+ throw new BffError(422, 'fresh_approval_required');
+ }
+ if (!cookieMatches(flow.token_hash, expectedHash)) throw new BffError(403, 'flow_binding_denied');
+ return { config, flow };
+}
+
+function openContext(config: CliGrantConfig, flow: CliFlowRow) {
+ if (!flow.context_sealed) throw new BffError(403, 'result_denied');
+ try {
+ return openBrowserFlowContext(config, flow.state_id, flow.pubky, flow.key_epoch, flow.context_sealed);
+ } catch (error) {
+ if (error instanceof BrowserContextRefused && error.reason === 'epoch_unavailable') {
+ throw new BffError(422, 'fresh_approval_required');
+ }
+ throw new BffError(403, 'result_denied');
+ }
+}
+
+export type BrowserFlowPoll =
+ | { expires_at: string; state_id: string; status: 'awaiting' | 'verifying' }
+ | { state_id: string; status: 'mismatch' | 'expired' | 'cancelled' | 'failed' }
+ | { capabilities: string; expires_at: string; pubky: string; state_id: string; status: 'connected'; token: string };
+
+export async function pollBrowserFlow(
+ request: Request,
+ flowCookie: string | undefined,
+ stateIdParam: string,
+): Promise {
+ const { config, flow } = await authenticatedBrowserFlow(request, flowCookie, stateIdParam);
+ await parseStrictJson(request, emptyBody);
+ await rateLimit(config, `browser_status_flow:${flow.state_id}`, config.statusPerTokenPerMinute);
+ if (flow.expires_at.getTime() <= Date.now() && (flow.status === 'creating' || flow.status === 'awaiting')) {
+ await terminalizeCliFlow(config, flow.state_id, 'expired');
+ throw new BffError(410, 'flow_expired');
+ }
+ if (flow.status === 'expired') throw new BffError(410, 'flow_expired');
+ if (flow.status === 'cancelled') throw new BffError(410, 'flow_cancelled');
+ if (flow.status === 'mismatch') return { state_id: flow.state_id, status: 'mismatch' };
+ if (flow.status === 'claiming') throw new BffError(409, 'claim_in_progress');
+ if (flow.status !== 'awaiting' || !flow.flow_id) {
+ throw new BffError(422, 'fresh_approval_required');
+ }
+
+ const status = await getGrantStatus(config, flow.flow_id);
+ if (status.status === 'awaiting' || status.status === 'verifying') {
+ return { expires_at: status.expires_at, state_id: flow.state_id, status: status.status };
+ }
+ if (status.status !== 'complete') {
+ const localStatus = status.status === 'invalid' ? 'failed' : status.status;
+ await terminalizeCliFlow(config, flow.state_id, localStatus);
+ return {
+ state_id: flow.state_id,
+ status:
+ localStatus === 'mismatch' || localStatus === 'expired' || localStatus === 'cancelled' ? localStatus : 'failed',
+ };
+ }
+
+ const owner = randomUUID();
+ const claimedFlow = await acquireCliClaim(config, flow.state_id, owner);
+ if (!claimedFlow?.context_sealed || !claimedFlow.flow_id) {
+ if (claimedFlow) await abandonCliClaim(config, flow.state_id, owner);
+ throw new BffError(409, 'claim_in_progress');
+ }
+ try {
+ const context = openContext(config, claimedFlow);
+ const claimed = await claimGrantResult(
+ config,
+ claimedFlow.flow_id,
+ context.resultDeliveryId,
+ decodeBase64Url32(context.resultPopSeed),
+ async () => {
+ if (!(await renewCliClaim(config, flow.state_id, owner))) {
+ throw new BffError(422, 'fresh_approval_required');
+ }
+ },
+ );
+ if (claimed.pubky !== claimedFlow.pubky) {
+ await terminalizeCliFlow(config, flow.state_id, 'mismatch');
+ throw new BffError(409, 'identity_mismatch');
+ }
+ if (!(await completeCliClaim(config, flow.state_id, owner))) {
+ throw new BffError(422, 'fresh_approval_required');
+ }
+ return { ...claimed, state_id: flow.state_id, status: 'connected' };
+ } catch (error) {
+ if (!(error instanceof BffError && error.code === 'identity_mismatch')) {
+ await abandonCliClaim(config, flow.state_id, owner);
+ }
+ if (error instanceof BffError) throw error;
+ throw new BffError(422, 'fresh_approval_required');
+ }
+}
+
+export async function cancelBrowserFlow(
+ request: Request,
+ flowCookie: string | undefined,
+ stateIdParam: string,
+): Promise {
+ const { config, flow } = await authenticatedBrowserFlow(request, flowCookie, stateIdParam);
+ await parseStrictJson(request, emptyBody);
+ if (flow.status !== 'awaiting' && flow.status !== 'creating') throw new BffError(403, 'result_denied');
+ if (flow.flow_id && flow.context_sealed) {
+ const context = openContext(config, flow);
+ await cancelGrant(config, flow.flow_id, context.resultDeliveryId);
+ }
+ await terminalizeCliFlow(config, flow.state_id, 'cancelled');
+}
diff --git a/src/server/marketplace-grant/cli-bff.ts b/src/server/marketplace-grant/cli-bff.ts
index 609811f0f..3c5a807d0 100644
--- a/src/server/marketplace-grant/cli-bff.ts
+++ b/src/server/marketplace-grant/cli-bff.ts
@@ -7,6 +7,7 @@ import { getCliGrantConfig } from './config';
import {
cookieMatches,
decodeBase64Url32,
+ deriveBrowserBootstrap,
encodeBase64Url,
hashCliDeliveryId,
hashCliToken,
@@ -82,7 +83,7 @@ const proofBody = z
})
.strict();
-function canonicalZ32(value: string): string {
+export function canonicalZ32(value: string): string {
if (!Z32.test(value)) throw new BffError(400, 'invalid_request');
let key: PublicKey;
try {
@@ -94,7 +95,7 @@ function canonicalZ32(value: string): string {
return value;
}
-function requireUuid(value: string): string {
+export function requireUuid(value: string): string {
if (!UUID.test(value)) throw new BffError(400, 'invalid_request');
return value;
}
@@ -122,7 +123,7 @@ function xffHopBehindTrustedProxies(forwarded: string | null, trustedProxyCount:
return hops[index] ?? '';
}
-function clientIp(request: Request, trustedProxyCount: number): string {
+export function clientIp(request: Request, trustedProxyCount: number): string {
if (process.env.VERCEL === '1') {
return firstHop(request.headers.get('x-vercel-forwarded-for')) || platformRequestIp(request) || '0.0.0.0';
}
@@ -133,7 +134,7 @@ function tokenBucketKey(prefix: string, digest: Uint8Array): string {
return `${prefix}:${Buffer.from(digest).toString('hex')}`;
}
-function hashesEqual(actual: Uint8Array, expected: Uint8Array): boolean {
+export function hashesEqual(actual: Uint8Array, expected: Uint8Array): boolean {
return actual.length === expected.length && timingSafeEqual(actual, expected);
}
@@ -149,6 +150,12 @@ async function rateLimit(config: CliGrantConfig, key: string, limit: number): Pr
}
}
+export function isBrowserBootstrapRow(config: CliGrantConfig, challengeId: string, resultCpk: string): boolean {
+ const epochs = [config.stateKeyEpoch];
+ if (config.previousStateKey && config.previousStateKeyEpoch !== undefined) epochs.push(config.previousStateKeyEpoch);
+ return epochs.some((epoch) => deriveBrowserBootstrap(config, epoch, challengeId).resultCpk === resultCpk);
+}
+
function proofInvalid(): never {
throw new BffError(401, 'homeserver_proof_invalid');
}
@@ -221,6 +228,11 @@ export async function verifyCliChallenge(
const challenge = await getCliChallenge(config, challengeId);
if (!challenge) throw new BffError(404, 'challenge_not_found');
if (challenge.consumed_at) throw new BffError(409, 'challenge_consumed');
+ // A browser bootstrap row carries a server-derived result key; the CLI
+ // route must not consume it (the CLI context it would write holds no seed).
+ if (isBrowserBootstrapRow(config, challengeId, challenge.result_cpk)) {
+ throw new BffError(404, 'challenge_not_found');
+ }
if (challenge.expires_at.getTime() <= Date.now()) proofInvalid();
if (!hashesEqual(sha256Bytes(nonce), challenge.nonce_hash)) proofInvalid();
diff --git a/src/server/marketplace-grant/config.ts b/src/server/marketplace-grant/config.ts
index cb76c5a66..78db1791d 100644
--- a/src/server/marketplace-grant/config.ts
+++ b/src/server/marketplace-grant/config.ts
@@ -88,6 +88,20 @@ export type CliGrantConfig = MarketplaceGrantConfig & z.infer {
+ return cliExtrasSchema.parse({
+ challengeTtlSeconds: process.env.SHOP_BFF_CLI_GRANT_CHALLENGE_TTL_SECONDS,
+ createPerIpPerMinute: process.env.SHOP_BFF_CLI_GRANT_CREATE_PER_IP_PER_MINUTE,
+ createPerPubkyPerMinute: process.env.SHOP_BFF_CLI_GRANT_CREATE_PER_PUBKY_PER_MINUTE,
+ verifyPerIpPerMinute: process.env.SHOP_BFF_CLI_GRANT_VERIFY_PER_IP_PER_MINUTE,
+ statusPerTokenPerMinute: process.env.SHOP_BFF_CLI_GRANT_STATUS_PER_TOKEN_PER_MINUTE,
+ resultPerTokenPerMinute: process.env.SHOP_BFF_CLI_GRANT_RESULT_PER_TOKEN_PER_MINUTE,
+ homeserverFetchTimeoutMs: process.env.SHOP_BFF_CLI_HOMESERVER_FETCH_TIMEOUT_MILLISECONDS,
+ trustedProxyCount: process.env.SHOP_BFF_CLI_TRUSTED_PROXY_COUNT,
+ });
+}
export function marketplaceGrantEnabled(): boolean {
return process.env.SHOP_BFF_GRANT_FLOW_ENABLED === 'true';
@@ -139,23 +153,23 @@ export function getCliGrantConfig(): CliGrantConfig | null {
cachedCli = null;
return null;
}
- cachedCli = {
- ...base,
- ...cliExtrasSchema.parse({
- challengeTtlSeconds: process.env.SHOP_BFF_CLI_GRANT_CHALLENGE_TTL_SECONDS,
- createPerIpPerMinute: process.env.SHOP_BFF_CLI_GRANT_CREATE_PER_IP_PER_MINUTE,
- createPerPubkyPerMinute: process.env.SHOP_BFF_CLI_GRANT_CREATE_PER_PUBKY_PER_MINUTE,
- verifyPerIpPerMinute: process.env.SHOP_BFF_CLI_GRANT_VERIFY_PER_IP_PER_MINUTE,
- statusPerTokenPerMinute: process.env.SHOP_BFF_CLI_GRANT_STATUS_PER_TOKEN_PER_MINUTE,
- resultPerTokenPerMinute: process.env.SHOP_BFF_CLI_GRANT_RESULT_PER_TOKEN_PER_MINUTE,
- homeserverFetchTimeoutMs: process.env.SHOP_BFF_CLI_HOMESERVER_FETCH_TIMEOUT_MILLISECONDS,
- trustedProxyCount: process.env.SHOP_BFF_CLI_TRUSTED_PROXY_COUNT,
- }),
- };
+ cachedCli = { ...base, ...cliExtrasFromEnv() };
return cachedCli;
}
+/**
+ * Browser purchase bootstrap (Bitkit sign-in): the CLI verifier's parameters,
+ * gated only by `SHOP_BFF_GRANT_FLOW_ENABLED`, never by the CLI flag.
+ */
+export function getBrowserBootstrapConfig(): CliGrantConfig | null {
+ if (cachedBrowser !== undefined) return cachedBrowser;
+ const base = getMarketplaceGrantConfig();
+ cachedBrowser = base ? { ...base, ...cliExtrasFromEnv() } : null;
+ return cachedBrowser;
+}
+
export function resetMarketplaceGrantConfigForTests(): void {
cached = undefined;
cachedCli = undefined;
+ cachedBrowser = undefined;
}
diff --git a/src/server/marketplace-grant/crypto.ts b/src/server/marketplace-grant/crypto.ts
index 423e3385b..36e3d9053 100644
--- a/src/server/marketplace-grant/crypto.ts
+++ b/src/server/marketplace-grant/crypto.ts
@@ -327,6 +327,58 @@ export type CliStateContext = {
version: 1;
};
+const BROWSER_BOOTSTRAP_SALT = utf8.encode('shop-bff/browser-bootstrap/hkdf-salt/v1');
+
+function browserSeedKey(config: MarketplaceGrantConfig, epoch: number): Uint8Array {
+ return hkdf(
+ sha256,
+ rootForEpoch(config, epoch),
+ BROWSER_BOOTSTRAP_SALT,
+ concat(utf8.encode('shop-bff/browser-bootstrap/seed-key/v1'), u16(epoch)),
+ 32,
+ );
+}
+
+export type BrowserBootstrapSecrets = {
+ resultPopSeed: Uint8Array;
+ resultCpk: string;
+ resultDeliveryId: Uint8Array;
+};
+
+/**
+ * The browser bootstrap's result PoP seed and delivery id are a pure function
+ * of the state key epoch and the challenge id, so verify can recompute them
+ * without storing a secret on the challenge row. Anyone holding the epoch's
+ * state key can recompute them; a public challenge id alone cannot.
+ */
+export function deriveBrowserBootstrap(
+ config: MarketplaceGrantConfig,
+ epoch: number,
+ challengeId: string,
+): BrowserBootstrapSecrets {
+ const key = browserSeedKey(config, epoch);
+ const id = uuidBytes(challengeId);
+ const resultPopSeed = hmac(sha256, key, concat(utf8.encode('shop-bff/browser-bootstrap/result-pop-seed/v1'), id));
+ const resultDeliveryId = hmac(
+ sha256,
+ key,
+ concat(utf8.encode('shop-bff/browser-bootstrap/result-delivery-id/v1'), id),
+ );
+ return { resultPopSeed, resultCpk: resultPublicKey(resultPopSeed), resultDeliveryId };
+}
+
+/** Test-only: the raw browser bootstrap key, for the key-separation vector. */
+export function browserSeedKeyForTests(config: MarketplaceGrantConfig, epoch: number): Uint8Array {
+ return browserSeedKey(config, epoch);
+}
+
+export type BrowserStateContext = {
+ kind: 'browser';
+ resultDeliveryId: string;
+ resultPopSeed: string;
+ version: 2;
+};
+
function cliFlowAad(stateId: string, pubky: string, epoch: number): Uint8Array {
const pubkyBytes = utf8.encode(pubky);
return concat(
@@ -356,6 +408,64 @@ export function sealCliFlowContext(
);
}
+export function sealBrowserFlowContext(
+ config: MarketplaceGrantConfig,
+ stateId: string,
+ pubky: string,
+ context: BrowserStateContext,
+): Uint8Array {
+ return seal(
+ config,
+ config.stateKeyEpoch,
+ utf8.encode(canonicalJson(context)),
+ cliFlowAad(stateId, pubky, config.stateKeyEpoch),
+ );
+}
+
+export class BrowserContextRefused extends Error {
+ constructor(readonly reason: 'epoch_unavailable' | 'not_browser') {
+ super(reason);
+ }
+}
+
+/**
+ * Opens a browser bootstrap context. An epoch whose key is gone is
+ * `epoch_unavailable` (fresh approval); anything that is not a canonical
+ * `{version: 2, kind: 'browser'}` envelope, including a CLI context, is
+ * `not_browser` (result denied).
+ */
+export function openBrowserFlowContext(
+ config: MarketplaceGrantConfig,
+ stateId: string,
+ pubky: string,
+ epoch: number,
+ sealed: Uint8Array,
+): BrowserStateContext {
+ try {
+ rootForEpoch(config, epoch);
+ } catch {
+ throw new BrowserContextRefused('epoch_unavailable');
+ }
+ let parsed: BrowserStateContext;
+ let text: string;
+ try {
+ text = new TextDecoder().decode(open(config, epoch, sealed, cliFlowAad(stateId, pubky, epoch)));
+ parsed = JSON.parse(text) as BrowserStateContext;
+ } catch {
+ throw new BrowserContextRefused('not_browser');
+ }
+ if (
+ parsed.version !== 2 ||
+ parsed.kind !== 'browser' ||
+ canonicalJson(parsed) !== text ||
+ decodeBase64Url32(parsed.resultDeliveryId).length !== 32 ||
+ decodeBase64Url32(parsed.resultPopSeed).length !== 32
+ ) {
+ throw new BrowserContextRefused('not_browser');
+ }
+ return parsed;
+}
+
export function openCliFlowContext(
config: MarketplaceGrantConfig,
stateId: string,
diff --git a/src/test/vrt/marketplace/MarketplaceSessionConnect.vrt.test.tsx b/src/test/vrt/marketplace/MarketplaceSessionConnect.vrt.test.tsx
index 019e5d9eb..bd893cebd 100644
--- a/src/test/vrt/marketplace/MarketplaceSessionConnect.vrt.test.tsx
+++ b/src/test/vrt/marketplace/MarketplaceSessionConnect.vrt.test.tsx
@@ -34,8 +34,12 @@ const view = vi.hoisted(() => ({
errorMessage: null as string | null,
isOpeningRing: false,
grantEnabled: false,
+ bootstrap: false,
}));
+const VRT_BOOTSTRAP_URL =
+ 'pubkyauth://signin_grant?caps=%2Fpub%2Fpubky.app%2Fmarketplace-service%2Fv1%2F%3Arw&relay=https%3A%2F%2Fvrt.invalid%2Finbox&secret=vrt-fixed-secret&cid=vrt.invalid&cpk=vrt-fixed-cpk';
+
vi.mock('next/navigation', () => ({
useRouter: () => ({ push: vi.fn() }),
usePathname: () => '/marketplace/orders',
@@ -59,7 +63,8 @@ vi.mock('@/hooks/useMarketplaceSessionConnect/useMarketplaceSessionConnect', ()
// Bridged / narrow-grant arrival: the full-grant copy (mirrors the
// CommerceController.hasFullHomeserverGrant mock above).
requestsFullGrant: true,
- requestsGrantReconnect: view.grantEnabled,
+ requestsGrantReconnect: view.grantEnabled && !view.bootstrap,
+ requestsGrantBootstrap: view.bootstrap,
start: vi.fn(),
cancel: vi.fn(),
copyAuthUrl: vi.fn(async () => {}),
@@ -91,6 +96,22 @@ describe('Marketplace session connect — visual regression', () => {
view.errorMessage = null;
view.isOpeningRing = false;
view.grantEnabled = false;
+ view.bootstrap = false;
+ });
+
+ it('renders the Bitkit purchase bootstrap approval at desktop viewport', async () => {
+ view.grantEnabled = true;
+ view.bootstrap = true;
+ view.authorizationUrl = VRT_BOOTSTRAP_URL;
+
+ const screen = await renderForVRT(
+
+ ,
+ { viewport: VRT_VIEWPORT_DESKTOP },
+ );
+ await openDialog(screen.getByRole('button', { name: 'Approve purchases' }));
+ await expect(screen.getByTestId(VRT_ROOT_TESTID)).toMatchScreenshot('session-connect-bitkit-bootstrap-desktop');
});
it('renders the awaiting-approval QR state at desktop viewport', async () => {
From 3ceca5cd6653a9e3d665c6d1871266ed0aff5e8d Mon Sep 17 00:00:00 2001
From: Bitcoin Error Log <18273620+BitcoinErrorLog@users.noreply.github.com>
Date: Wed, 23 Sep 2026 18:21:38 +0100
Subject: [PATCH 2/4] feat(marketplace): Bitkit copy on the purchase card, Lock
Server step for both signers
The session-required card names Bitkit for a Bitkit sign-in that can run
the purchase bootstrap. The Lock Server step and its dialog now say to
approve or scan with Pubky Ring or Bitkit, since the Lock Server offers a
Bitkit QR too. The bootstrap client refuses (and cancels) a marketplace
QR that asks Bitkit for anything beyond the marketplace-service
capability.
---
.../MarketplaceGetPaidSettings.tsx | 6 +--
.../MarketplaceSessionRequiredCard.test.tsx | 48 +++++++++++++++++++
.../MarketplaceSessionRequiredCard.tsx | 14 ++++--
.../marketplace-bootstrap-client.test.ts | 25 +++++++++-
.../marketplace-bootstrap-client.ts | 16 ++++++-
5 files changed, 99 insertions(+), 10 deletions(-)
create mode 100644 src/components/organisms/Marketplace/MarketplaceSessionRequiredCard.test.tsx
diff --git a/src/components/organisms/Marketplace/MarketplaceGetPaidSettings.tsx b/src/components/organisms/Marketplace/MarketplaceGetPaidSettings.tsx
index aec072edd..99ee7eec6 100644
--- a/src/components/organisms/Marketplace/MarketplaceGetPaidSettings.tsx
+++ b/src/components/organisms/Marketplace/MarketplaceGetPaidSettings.tsx
@@ -350,8 +350,8 @@ export function MarketplaceGetPaidSettings({ locksConnect, onSaved }: Marketplac
Step 1 Connect your Lock Server
- Approve the connection in Pubky Ring. The Lock Server can then lock your content for buyers — it never
- sees your identity secret.
+ Approve the connection in Pubky Ring or Bitkit. The Lock Server can then lock your content for buyers — it
+ never sees your identity secret.
{step1Connected && (
@@ -482,7 +482,7 @@ export function MarketplaceGetPaidSettings({ locksConnect, onSaved }: Marketplac
Connect Lock Server
- Scan the code with Pubky Ring. The Lock Server can then lock your content for buyers — it never sees your
+ Scan with Pubky Ring or Bitkit. The Lock Server can then lock your content for buyers — it never sees your
identity secret.
{connectUrl && (
diff --git a/src/components/organisms/Marketplace/MarketplaceSessionRequiredCard.test.tsx b/src/components/organisms/Marketplace/MarketplaceSessionRequiredCard.test.tsx
new file mode 100644
index 000000000..eb6d18864
--- /dev/null
+++ b/src/components/organisms/Marketplace/MarketplaceSessionRequiredCard.test.tsx
@@ -0,0 +1,48 @@
+import { render, screen } from '@testing-library/react';
+import { beforeEach, describe, expect, it, vi } from 'vitest';
+import { MarketplaceSessionRequiredCard } from './MarketplaceSessionRequiredCard';
+
+const view = vi.hoisted(() => ({ isGrantSession: false, grantEnabled: false }));
+
+vi.mock('@/hooks/useIsGrantSession/useIsGrantSession', () => ({
+ useIsGrantSession: () => view.isGrantSession,
+}));
+
+vi.mock('@/libs/runtime-config/runtime-config', async (importOriginal) => ({
+ ...(await importOriginal()),
+ getMarketplaceGrantFlowEnabled: () => view.grantEnabled,
+}));
+
+vi.mock('./MarketplaceSessionConnectDialog', () => ({
+ MarketplaceSessionConnectDialog: ({ triggerLabel }: { triggerLabel: string }) => {triggerLabel} ,
+}));
+
+describe('MarketplaceSessionRequiredCard', () => {
+ beforeEach(() => {
+ view.isGrantSession = false;
+ view.grantEnabled = false;
+ });
+
+ it('names Pubky Ring for a Ring sign-in', () => {
+ render( }) {
+ const signer = useIsGrantSession() && getMarketplaceGrantFlowEnabled() ? 'Bitkit' : 'Pubky Ring';
return (
- Approve purchases in Pubky Ring
+ Approve purchases in {signer}
One approval lets you buy, bid, and make offers on this marketplace. Nothing is charged until you pay.
-
);
}
diff --git a/src/core/services/marketplace/marketplace-bootstrap-client.test.ts b/src/core/services/marketplace/marketplace-bootstrap-client.test.ts
index 277a89a21..1f0b20250 100644
--- a/src/core/services/marketplace/marketplace-bootstrap-client.test.ts
+++ b/src/core/services/marketplace/marketplace-bootstrap-client.test.ts
@@ -38,8 +38,11 @@ function challenge(overrides: Record
= {}) {
};
}
+const BOOTSTRAP_URL =
+ 'pubkyauth://signin_grant?caps=%2Fpub%2Fpubky.app%2Fmarketplace-service%2Fv1%2F%3Arw&relay=https%3A%2F%2Frelay.example%2Finbox&secret=s&cid=shop.example&cpk=k';
+
const verified = {
- authorization_url: 'pubkyauth://signin_grant?caps=x',
+ authorization_url: BOOTSTRAP_URL,
expires_at: new Date(Date.now() + 120_000).toISOString(),
state_id: STATE_ID,
status: 'awaiting',
@@ -144,6 +147,26 @@ describe('marketplace purchase bootstrap client', () => {
]);
});
+ it('refuses and cancels a bootstrap QR that asks Bitkit for more than purchases', async () => {
+ fetchMock
+ .mockResolvedValueOnce(jsonResponse(challenge(), 201))
+ .mockResolvedValueOnce(
+ jsonResponse({
+ ...verified,
+ authorization_url: BOOTSTRAP_URL.replace(
+ 'caps=%2Fpub%2Fpubky.app%2Fmarketplace-service%2Fv1%2F%3Arw',
+ 'caps=%2Fpub%2Fpubky.app%2F%3Arw',
+ ),
+ }),
+ )
+ .mockResolvedValue(new Response(null, { status: 204 }));
+
+ await expect(beginMarketplaceBootstrapFlow({ pubky: PUBKY })).rejects.toThrow('result_denied');
+ expect(fetchMock.mock.calls.map((call) => call[0])).toContain(
+ `/api/marketplace/bootstrap-flows/${STATE_ID}/cancel`,
+ );
+ });
+
it('cancel posts to the bootstrap cancel route once', async () => {
fetchMock
.mockResolvedValueOnce(jsonResponse(challenge(), 201))
diff --git a/src/core/services/marketplace/marketplace-bootstrap-client.ts b/src/core/services/marketplace/marketplace-bootstrap-client.ts
index 79c846ae0..ecf21aeab 100644
--- a/src/core/services/marketplace/marketplace-bootstrap-client.ts
+++ b/src/core/services/marketplace/marketplace-bootstrap-client.ts
@@ -40,6 +40,9 @@ const pollSchema = z.object({
expires_at: z.string().optional(),
});
+/** The only capability the marketplace bootstrap grant may ask Bitkit for. */
+export const MARKETPLACE_BOOTSTRAP_CAPABILITIES = '/pub/pubky.app/marketplace-service/v1/:rw';
+
function bootstrapFailure(code: string) {
return Err.server(ServerErrorCode.SERVICE_UNAVAILABLE, code, {
service: ErrorService.Marketplace,
@@ -97,6 +100,17 @@ export async function beginMarketplaceBootstrapFlow({ pubky }: { pubky: string }
});
}
+ const cancelFlow = async () => {
+ await post(`/api/marketplace/bootstrap-flows/${verified.state_id}/cancel`, {}).catch(() => undefined);
+ };
+ // Never show Bitkit a QR that asks for more than purchases.
+ if (
+ new URL(verified.authorization_url).searchParams.getAll('caps').join(',') !== MARKETPLACE_BOOTSTRAP_CAPABILITIES
+ ) {
+ await cancelFlow();
+ throw bootstrapFailure('result_denied');
+ }
+
let cancelled = false;
return {
authorizationUrl: verified.authorization_url,
@@ -119,7 +133,7 @@ export async function beginMarketplaceBootstrapFlow({ pubky }: { pubky: string }
cancel: async () => {
if (cancelled) return;
cancelled = true;
- await post(`/api/marketplace/bootstrap-flows/${verified.state_id}/cancel`, {}).catch(() => undefined);
+ await cancelFlow();
},
};
}
From 3be1ffd84c7d173aa3ecb27482e5623ce5f418f6 Mon Sep 17 00:00:00 2001
From: Bitcoin Error Log <18273620+BitcoinErrorLog@users.noreply.github.com>
Date: Thu, 24 Sep 2026 08:17:37 +0100
Subject: [PATCH 3/4] feat(marketplace): caption the Bitkit purchase QR with
the client Bitkit shows
The bootstrap QR now says which client Bitkit will name and that the
request covers marketplace purchases only, read from the authorization
URL. A fixture pins the staging bootstrap URL shape (signin_grant with
caps, relay, secret, cid, cpk and only the marketplace-service
capability), and the client test checks the Shop's capability pin and
caption against it.
---
.../MarketplaceSessionConnectDialog.test.tsx | 16 ++++++++
.../MarketplaceSessionConnectDialog.tsx | 13 +++++++
.../marketplace-bootstrap-client.test.ts | 37 ++++++++++++++++++-
.../marketplace-bootstrap-client.ts | 14 +++++++
.../marketplace-bootstrap-url.staging.json | 8 ++++
5 files changed, 87 insertions(+), 1 deletion(-)
create mode 100644 src/test/fixtures/auth/marketplace-bootstrap-url.staging.json
diff --git a/src/components/organisms/Marketplace/MarketplaceSessionConnectDialog.test.tsx b/src/components/organisms/Marketplace/MarketplaceSessionConnectDialog.test.tsx
index f68100da7..5b9250dd8 100644
--- a/src/components/organisms/Marketplace/MarketplaceSessionConnectDialog.test.tsx
+++ b/src/components/organisms/Marketplace/MarketplaceSessionConnectDialog.test.tsx
@@ -108,6 +108,22 @@ describe('MarketplaceSessionConnectDialog', () => {
expect(screen.getByRole('button', { name: 'Open in Bitkit' })).toBeInTheDocument();
expect(screen.queryByRole('button', { name: /open in pubky ring/i })).not.toBeInTheDocument();
expect(screen.getByText('Waiting for approval in Bitkit…')).toBeInTheDocument();
+ expect(screen.queryByTestId('bootstrap-approval-caption')).not.toBeInTheDocument();
+ });
+
+ it('bootstrap QR carries the caption naming the client Bitkit will show', () => {
+ view.status = 'awaiting';
+ view.authorizationUrl =
+ 'pubkyauth://signin_grant?caps=%2Fpub%2Fpubky.app%2Fmarketplace-service%2Fv1%2F%3Arw&relay=r&secret=s&cid=marketplace.staging.shop.pubky.app&cpk=k';
+ view.isGrantSession = true;
+ view.grantEnabled = true;
+ view.requestsGrantBootstrap = true;
+
+ render(
@@ -156,6 +159,16 @@ export function MarketplaceSessionConnectDialog({
/>
+ {bootstrapCaption && (
+
+ {bootstrapCaption}
+
+ )}
+
{session.status === 'awaiting' && (
diff --git a/src/core/services/marketplace/marketplace-bootstrap-client.test.ts b/src/core/services/marketplace/marketplace-bootstrap-client.test.ts
index 1f0b20250..f754f4a9c 100644
--- a/src/core/services/marketplace/marketplace-bootstrap-client.test.ts
+++ b/src/core/services/marketplace/marketplace-bootstrap-client.test.ts
@@ -4,7 +4,12 @@ import { AuthErrorCode } from '@/libs/error/error.codes';
import { ErrorCategory, ErrorService } from '@/libs/error/error.types';
import { HttpMethod } from '@/libs/http/http.types';
import { HomeserverService } from '@/services/homeserver/homeserver';
-import { beginMarketplaceBootstrapFlow } from './marketplace-bootstrap-client';
+import captured from '@/test/fixtures/auth/marketplace-bootstrap-url.staging.json';
+import {
+ beginMarketplaceBootstrapFlow,
+ bootstrapApprovalCaption,
+ MARKETPLACE_BOOTSTRAP_CAPABILITIES,
+} from './marketplace-bootstrap-client';
vi.mock('@/services/homeserver/homeserver', () => ({
HomeserverService: { request: vi.fn(), delete: vi.fn() },
@@ -167,6 +172,36 @@ describe('marketplace purchase bootstrap client', () => {
);
});
+ it('bootstrap url matches captured fixture', async () => {
+ const values: Record
= {
+ caps: captured.caps,
+ relay: 'https://relay.example/inbox',
+ secret: 's',
+ cid: captured.cid,
+ cpk: 'k',
+ };
+ const url = `${captured.scheme}//${captured.host}?${captured.params
+ .map((name) => `${name}=${encodeURIComponent(values[name])}`)
+ .join('&')}`;
+ expect(captured.caps).toBe(MARKETPLACE_BOOTSTRAP_CAPABILITIES);
+ expect([...new URL(url).searchParams.keys()]).toEqual(captured.params);
+
+ fetchMock
+ .mockResolvedValueOnce(jsonResponse(challenge(), 201))
+ .mockResolvedValueOnce(jsonResponse({ ...verified, authorization_url: url }));
+ const flow = await beginMarketplaceBootstrapFlow({ pubky: PUBKY });
+
+ expect(flow.authorizationUrl).toBe(url);
+ expect(bootstrapApprovalCaption(url)).toBe(
+ 'Bitkit shows this request from marketplace.staging.shop.pubky.app, for marketplace purchases only.',
+ );
+ });
+
+ it('shows no caption for a URL that names no client', () => {
+ expect(bootstrapApprovalCaption('pubkyauth://signin_grant?caps=x')).toBeNull();
+ expect(bootstrapApprovalCaption('not a url')).toBeNull();
+ });
+
it('cancel posts to the bootstrap cancel route once', async () => {
fetchMock
.mockResolvedValueOnce(jsonResponse(challenge(), 201))
diff --git a/src/core/services/marketplace/marketplace-bootstrap-client.ts b/src/core/services/marketplace/marketplace-bootstrap-client.ts
index ecf21aeab..6711c5d2e 100644
--- a/src/core/services/marketplace/marketplace-bootstrap-client.ts
+++ b/src/core/services/marketplace/marketplace-bootstrap-client.ts
@@ -43,6 +43,20 @@ const pollSchema = z.object({
/** The only capability the marketplace bootstrap grant may ask Bitkit for. */
export const MARKETPLACE_BOOTSTRAP_CAPABILITIES = '/pub/pubky.app/marketplace-service/v1/:rw';
+/**
+ * What Bitkit shows for the marketplace approval: the client id it names and
+ * that the request covers purchases only. Null when the URL names no client.
+ */
+export function bootstrapApprovalCaption(authorizationUrl: string): string | null {
+ let cid: string | null;
+ try {
+ cid = new URL(authorizationUrl).searchParams.get('cid');
+ } catch {
+ return null;
+ }
+ return cid ? `Bitkit shows this request from ${cid}, for marketplace purchases only.` : null;
+}
+
function bootstrapFailure(code: string) {
return Err.server(ServerErrorCode.SERVICE_UNAVAILABLE, code, {
service: ErrorService.Marketplace,
diff --git a/src/test/fixtures/auth/marketplace-bootstrap-url.staging.json b/src/test/fixtures/auth/marketplace-bootstrap-url.staging.json
new file mode 100644
index 000000000..7f8c5d006
--- /dev/null
+++ b/src/test/fixtures/auth/marketplace-bootstrap-url.staging.json
@@ -0,0 +1,8 @@
+{
+ "source": "Staging marketplace-service createBootstrapFlow through the Shop BFF (pubky-marketplace-staging), captured 2026-09-23; relay, secret and cpk values omitted",
+ "scheme": "pubkyauth:",
+ "host": "signin_grant",
+ "params": ["caps", "relay", "secret", "cid", "cpk"],
+ "caps": "/pub/pubky.app/marketplace-service/v1/:rw",
+ "cid": "marketplace.staging.shop.pubky.app"
+}
From 6c814e5d5debf02bda6a3a8b0e720651d9878474 Mon Sep 17 00:00:00 2001
From: Bitcoin Error Log <18273620+BitcoinErrorLog@users.noreply.github.com>
Date: Thu, 24 Sep 2026 08:27:31 +0100
Subject: [PATCH 4/4] test(vrt): Linux baselines for the Bitkit purchase
bootstrap scene
---
...-bitkit-bootstrap-desktop-chromium-linux.png | Bin 0 -> 47158 bytes
...t-bitkit-bootstrap-desktop-firefox-linux.png | Bin 0 -> 42251 bytes
2 files changed, 0 insertions(+), 0 deletions(-)
create mode 100644 src/test/vrt/marketplace/__screenshots__/MarketplaceSessionConnect.vrt.test.tsx/session-connect-bitkit-bootstrap-desktop-chromium-linux.png
create mode 100644 src/test/vrt/marketplace/__screenshots__/MarketplaceSessionConnect.vrt.test.tsx/session-connect-bitkit-bootstrap-desktop-firefox-linux.png
diff --git a/src/test/vrt/marketplace/__screenshots__/MarketplaceSessionConnect.vrt.test.tsx/session-connect-bitkit-bootstrap-desktop-chromium-linux.png b/src/test/vrt/marketplace/__screenshots__/MarketplaceSessionConnect.vrt.test.tsx/session-connect-bitkit-bootstrap-desktop-chromium-linux.png
new file mode 100644
index 0000000000000000000000000000000000000000..c2960d798de1b1e90d65fd47bb6aae534114581b
GIT binary patch
literal 47158
zcmeFYbzGEN`!6irt#mii4T2ycAs~W^lynJ53@TmH(ls<}Kt!ZLq=t@R7`nT=yW`xW
z+x^>nKj(S>f6qDV<7b>%_gYteuWMavt(%Z%PZja7DY5U|xr3*yB(Hhr4ywcdvJE(|xP4umqKaP=aw~)$|LnLb*%N51L`$V1FDj(+ukFpKb+K8~Dxw8Iq
zHtsmAViGko1zC`KBJ381(-BJlwJB!)^qd?@VM6q0i!NBEXZ*A2bj!&9*~*grg8yu0
z!Wh2?!>sXtkBu3o{ymmCU;Ou2B`qhyzX-4V-$?kJh$x!NLcCqNb%D+Vu!T6QXKRd<
ziC7O{jB!|GaIhIgXbK9Gf{tv0uIxD>1XX~7oOn$^UVbU@T|$#17feLyyKL5Ql&#?B
z2W!TJMA2LGit_Sh{^nnCo_E$zxN=Z?p-jyB_!U#0T+u$5!~^`1O9{4t;mH_uX!7+4
zc=#{RdrT||gKgpjn@1Qh@Bi2-*MOKM+uHAD{_hX)H}Jx
zSW9{!L^)#MS{GFggxz%7o{qt+OsXM}aOwz#DI5e>{B
z^|VER*$mcQPHhQH|HuH>JL3{Z15Zi9LsF?#_+}RzurpY48)H%|i72dshzYw^*#Xz;
zpIsr;pA(CUwOn^;ky-K(KrdKU>nEd$fPLn!XE@?Z#j#}8m%_#urZC_v(U-ykQD#0g
zr4XM6nKD4YCH^=*xLdA0#(GSsxq5b7{-eZT2c#(9hrQxg{ASh0Wo;@g4h_ba3Uj^O
zqfblDe7YD~;I|eI(o@}^!;ImA_^|Kh&4ttYDW+%L&+#!zRllySOkmArLmA{+it!{)
zsV;OBo>oq2V-~Y;%_GyJxTiavnRbBW7;L>ejZYciYmpxg=aF0B?sLhqp$UQWUM(l#
zjTz2P+o*f}Or~dxym-g8YpZ^oQWM=n{BtP8;rPAR_(gTqDUJ*m?uT}pJye>MRHQ?BjVNkn=gBr{C{LQI-hlVdk4nyv!I_sdUZpdc#&lsRBWf;*ZL59}
ztU-nkjjb9wLEHDhbqycBUWCXwwS&49xq=ADF=f2c+hBhE*>in%asuWQu4&5?oVc}K
z>(7qk5TlNR=trSgT=hQYYhFQy1i%tlh9g-KMd`~pi#qbaBJ@KieH|)g}DSX$PW
zM<2-aXAtW|l}cqvlgl|1gSa
zOF*_Kuc8oJC=a8;z`qvYkaHU9OXu5qE8v2p;uS2F6qhM(ZKY0rB0>SVE|NKcYRGqz^IgBJZHEsYY#?q3PT9dsg3;5ZHJRoR7^d=ab2x
zVt~&E`;6PIA?My)QVE+wqrW>BhTxXX;ED-S)KMb;u*LTopTa1O{ue6Kq
zf5$}%4CHbZ50tya4RYdQsnmVKDq|CCY@d&)6nG505P4JS2gQNxbZ{y`#4PBVOQm?#
zYlrW?ZS}%^_?fIqu`2opA#%!1>YjL#vM@M?2iQi+THK<8S!HGycQsax{N%e%QMwsL
zMrjn^cV=9p_4xIVBh!HqxFygMPLvS*8UBpOY+N>w2L!JrMBov+%G!gf4Q#7%q;6h{
zLd>*dV%r~qg65xL
zcRb1(euR(eJNm&-upQJUw&y5d*eFonA;1h3_|muV
zY4eUHog!*WiWp0dYR;Cza&B>{9;-1WoFF4;C_XpM9J*L%jNwH0(HpQ?_I%EEpd1C?
z>woYthVgD&TnMR@_3sUQXvxH_at+2!oR3LCU?CAxJ6vE1u
z!b)D;c0gH-;lp%gM-wMDLC)NF5+cjb@F`BdQ(RC?IO{xM)#J%9vTAvRE?`=7-g@_9
z>pVQO`rgL?bb%;}!EUxMeU`oU)C&x7<_Laj53CPMdaT`BD^KVLjmP#==a2D?GUkut
zSi+2V?c_x3aA65Xie93zc0cr$Bk^0{!hO;6sQ)13)j$j3_Mc@|NX9-oaX#9cv5g@GsdPmO*pXNWb$`J;0;taJ%C;KYAk
z9~V}+bU{CEvbOR9{77mEFTgBxUMW!OX#`6mfub(nHce_HaYqm&Gs>2q8V2}`^`5iS
z-piJrTY)2>hU*CEMwErf=q1d$#$BlL=tEQ(4CC0ZygNXjac=sIl-`r0$L`?EmH9b;
zu5EE}5M6!g9F$q-=k($8utSs}|7Tr>Hdu`WE{3xcW#9|W&x8~%;!Iq%UY2W?KtSPS
z&>>16-BT(LIj$BzaEr2E$D_5UR0d}`k*5inbwuftC_(s+*mCYnl9d?vGz;pDeKVN7
z+rDx^gwfBJ!oQ2P_kCytYAC-T#Nu`T{V@J$oUS~2Efbd9rk&jV7CmZZa$RRCO^O@l
z2xeR$+Vg-4>=P^pTw{nRZ{`*dbNw@4K^e|WvyB%jfI==9k^z{Y{E$V?QbLgeQLQ>4
zs?}A33Hpfh>4lrUOrRVj=L`?Ix3_KMA6C-#Y-r@k>SGs*Cvi$B#~ix#nOE
zzJoHmkJ(&{MOi`S9fSzg_}7_?_#yr1AzEYC?m=c$?_5)x5vEQ7{0&16^a2}j5Ex8i
z6mL6;wXas51p&?orjFeyGZP3D1W>2+VGrP<)7sYy`ldP&r40N4A-AjpS~J(40kuAt
znOG8#ZT^JE7Z3F{G7s+kjPaUI6ZL9(6$ke|MN)zf1tsLZUlcjJtL?dcqram
zP?6fH3&dh@M_aqD3a=?HRNH3V96{4#pNSDft79V`T>&1%LPbVJ<|*1-s6lFM+C60e
zVn|?&T6`d&BI-%b9^|QJ-rd))U#E8bCh?O4u(>1>CjdBf=)%{RmY4ZKODyE3Ya0(_
zU%mP?YN*~f{2tX5h)p2kBUuQ^JNq(`6v8kC%sL1Kl5mUbMn10QhylzE+R5E?ehFnp
z4+u?RG@|>|tZ?~Vdqf?z4L1gUt2m7f;*^LY?t#QZ;9rCzb&!LL5Dg6tlzwdP>{#61plIWeu&TB?Qa?2>
zT$Ufv1?GJ63+}j6Is#&};m!q3-$6sm95qc)^4NDZDMox9KZoH80R&G0Q;y@(rTfiF`=6YAKpdH&PE1U6^fuhh=!K4J19oub
z1vH#N0i-M&0ew^9f#nt!;vviFRK$c!^WZMu|Hw~;kY9&>ZeVyg0HG!1
z<^AD+O>{yc@r<7gM&GY*Y{(*How*;s!AR%;$dUo1V+hWOZcljA>S6!*`cFh@pIu9N
zNJ-ZTBnhp*3p~uJmGGP0MZq-^r?TO02bPr?MCFKRWa6f{O-4}=h`vG?dDA*%znuY}
z=7GFGQmZb!Q6M-tRUKHu5RFGuDkD;bhXTfup#O1pcXd0AJQ^BIi
zNOY(wfFUfBA~VEb8{h-@&P+)D2`GtrfFPnN8$rk`piQyJ_hCyr5TB;mUHIJ^VS5+_
z4*85a0$4LxfL{**XadG%C>;^7o6-)%qiTNygHg1Pm70>1qXUl-TMD2pG4gwyIUF1u
zkXvOwi!yErWMBkk0>@;CR;`3k>Rj`g0|j89`@iM$*+lPv!REJdslY8sh>uAMDG#wC
zsz>rmvP-{KLl6;SgsmN9U%{fc{vHr31#71?mGT(O>n5%#%fP}>G
zTU*S}gKv6X>WnMCvA18{n{SDW_l$Fjhnf8;YbqIV00^W>e@cSpAP_GZt@*|E?fzIT;&cX{$HIV-UjRlfi`IK|UMPs=
z^wB}Q+zzwc%MzC$8b^guOVRTXnQ@WfV&TJw3a1(Wb~4Qe^-%-jP8_!zZ@av|M#vXL
zT&$qUx62*1ZEsoUDn@;>A9_|-6=iVDDb>ksSjf~Q5gR*Wde7RSa2zq6sDo;A
zf4WGbL&EAmT*5aKMRPu7l@i)mH<{k45G_52akok)^pmJ?G~`7Q)_r{8Va#87eNIlkEeh1;?>`wCy>%~7>E=2)na(`C&}CU;jc;$RfhD8^$ed<0343_u
z>~ty(E+qR`vdvzYYAJGUXHcEVCC4y5u^^VyIHC_tp>`(ArW%aqPI>IWMu&4qO0WA+
zO=Uns_iV74
z%1eo4=!{m|-u7qP+8#CT5~oXs4{Ux)BBlr-^A5NmGn_jQB*!Aayyvt^M(W^6zPB)R
zbqEYSSX>{KcAlCG3FqxS?^1Y+b1
z(pSA}11IoX*bG53e_R9X03UHC%uAu
zkgIVXa2~gWvVON;Ewbe15l83_2h-Na%IxHLs)e}Oa-T^!)JfHB#YD?LImAx4Wy8|c
z1z1C+fr@Txx;BHeh&+ft@U(ft?qq9R<<%$=0Dm(?XogdLIT{gYK05gN`t-esx?cAI
zi0nWmNlz;MSWV64$cZgZquPamsBseA;9M8n!!aioc_AE{Sb2m+Ow##P9}9UBQ>Kv1K#berQA2YC=Kgk9&I<9Iqi@
zHrhm)#OEw|o?l~J;rSu%sjX?xe#*DjA7yrZn!nHbrwj5`qSMfIMRv+A!Sa|sxgsjq<-FzZt=g0=_BeJ_v*-gT+$5nbj7Y#f`w$14)*U4A==?(x)
z0G8~xx3^nOy7e8~mVsGqDtkgqfZ=M>c>tKBE(|
zkhE<5C!}6!7^`H&bJLEwJ*IZ0Dh-+Xb#uF40kp9asW0^NN?se(S6&>(`HLxkJu(2#
zz78HuZe1i#7-)lQYa00IiDh8Cno)Tp^-$8J_hq@G3JKOlz^Y_pb|{?uc0NGzES|!D
zJ)XJ7oPLgXH({06zM%`yUy1UmX^&(
z+pIb*)_O*=S_na{-Jl9)5#u3Zniy+5slx&aTV7xXwly)V3ha?~UjQGqAA|?{`+b8u
zjOKtUB)`hvK2gRsQOaOZ%Q{&%*zM(zcTU)VK4yGRrpeWVtZ-WUc(cP8ovzytDCtzj
zJE9r$A!tN@_#|Z{wP4WAqbiH=CbeDJi_TROt#}<$q-zr*VJDs^iF@o3J)P6Iz2|KC=1M=lEvsp2p^*r>_fpzIgQ2PoM_XtW!{eqhWo+PqU-dcR
zeU8clizlozCW%AS$%Sv$q1L(q+E0;g=a#
z2Zp;j>YG|Sx2>-WrogRf5Fa|bD|{!Y+}ES0b}5jE_|(Sm@{^)*E-wLeQ_GU8Txko~
z3o`bli}lBMsn^U#i$yd9MdS~vUrt>{4z~{SJT`RsM5YCvM}9o`Md17q$K&cFWn0}&
zHtC9pM2z_)xXV%KASSck*fQGMz58{sj|KgX4k$~}RdnQyx4@}erj@mx}~s*@|IsP@+8+r|#Y2IY6_6BwndNL1LV`#V#T
z^L1)Vks@gg!nh+JsvYgPa~$|dl=?Rl6+-gP9l_Tvl-4KxOdZE`DKbRY3k?&EE3AosvvIk|AWo;ayLB^TKnw(E?(`xl^FcS7*F^TC@H^$FM
zq~qbT=-d)Vy+UG*3v?8>PRtm}cO-s)FOWhfVT#g|J%4YUK0(EX^&TsoJ1lVMIYoZ_h*XD&w-TDp7
zYj{F{l(FDSdwIH>J6dAgLjK?#rc_3TL6T}Ra2WCK!w19$8#ow(G47mct~|vV=xyQF
zX*{s+!O&M&1;xRS%i+Nu4Zc6;2;oGqKx$ColU9|EJexrc5mIEy^S+WHmF`KAT@>TlcI;bJGjRVHTYb0tmU33F
zI%>e9=j-;Y*1qWGlk@qHvJOlyxT+F9p`Dgd2is4!PS_V3Eyv<95AZZy@j>r;?ihQW
zi9cm(?6@N2jx1cTABjI`K?|5u_^R!|dk<&FT%2(BM@Yr2Zc`^4m68iY@J*y2tzypF
zk)&kfGWC`|H1$)1g%kDEm26SQHO0;9?5xUTvF3te$*zNoNRam@=UzPGg|9!@k0lm>
zViDH>*m?f+M2s3@e}b2wbWUB=3#`^z<2dXKg;Sdr0yYb$!6GiHt-UaPve6vF2Qp=$
zi&v>#?;T%X_sH3v+MN8)!UJ_1&=nVDw
zf(~M2n;9P8Q(pZj#b
z4b6$2mxGx)OWkFI8eEhn^LS~|1N4|CL}*u{xFRI^y&FxX51Sgv
zC4!c3OMF(PD*~+~5GO?-U*Jw7hI?xNMHdf?yfiN@(+GG$?dDGAK2bAIltlQX-F>t7
zawu#dXaeY3KH&mA(jZg0O|>J(P%jLOKeH6UyL=JCbBsq@CmZ`IDN3c`2RS!Qs=5`*Z4>vR_$g@{@qp
zM@h4n!|xhU?xCC$eNw0%s&twXJjc}yf=g(89#X4lg=;3QVq3d1cG
z9O~FNZ=sA@P7xjqU%Wu9MA8p+$F$Eiq^`Ab2{3!l@tr+=7m;O}(TJwB?-9Hznj5^7
z1nNbui`iM@HX5SF95V}w=$ClZWBp-@sAPLtR60M*NcM$1Wl3`RS!Nd-XUI!El_f=$
zTx?NAwc1+ZInR!y2%K#xLT^r;wH*~v9XOJ76wF@I9B*H}sbUI|Z>Ckz8@Jbl`
zWN)$`g+gQL>#D8k-(GmC_k&$gv4hQ8I6OP
zq1AC-%ZBG|WpApg;-((>WeMZ8ipkvIg1t9ws%ED^n1>
z4(vVgPHXkV=fDn^o`)fQyeE@|kT|ZzBgrhiZ!Yz9VW0FdyCE4by?6JI>4r!k$5JTJ*PK1yx~}QYS(VrN3VJNw3|(~Va&erfKJUA|GS(9Cb>i;?`;d`
z-XVE5{Pt5$xnF9U;?_7_iMb(#6ZE5Aeb{cHs^e{?wWEDaE_S?#E
zzjGIQ7S$ER(q3*dZ7
z`=n3x3l}HT5~=37`t8$YX~!7(VagGy(Po{0Gx&0TDx)Rs%6l&(v@hT4M!-ufgO+6it5LN%8}SAPjrTl
zU9VrasGPQC{t=~A1WmD(xZNM4w6^p1`9$b%r>k(hW1iY-V{)AwF8}ZkM;bV7GAz#A
z+)OZZ+knWyKK{DpEb%x3jD!w9ty7vh#6r`zOH3Uy>W~n~R*-p_|3+sk1zc@u|cm
z=0dfh0=>?w$Ftc|P2<}hsTf)>NLH)lryr2cXu&qn2_U2*UdQEA4IF_`4TG?770&a4
z;)PVI$gx<%mDmiosBSe{w*BO>k|mK9=@*KO-4YJ|G`G$~hY3fxQ?GRB~
zl-1g;-dO6M#o9!co=+MswWri~1g6ni5_?;SAKs@kcZyYPpnsJhkNE)d(w)TSb`&Ji
zzP|XhAwiKWf#{uB;h7*j>D4)VN{ZwKT6GPxYzOeN2v9TdEsDu;0q@`XRDcD6bL!r{
zUOtO1tBFYh#36bB`|tB;HzCQ6AbW$SLfWcr!VLHdn|aeoONo75L9X-b0rG48d-Qbm
zuHyYh{P#xv#mEbDfkQm!78*Sz7)G;;`$ou)>caj^wJ8qA`6J9-0=%K!L$Q?q&&h+1
zhd3M@??OaH2vzoqe$F%^GB*5ZHLaCZ2ob%Zk6s`y>QO1F`{7#!O$xwfzt3eN+zZuvZD~?ucdpE3X+Cw{ePb)ca-&l=!je?l-3{Reii`=Z89{qPl8Vb@a=vxu(zkjcj`+mf@|(KB
zAiJN_7Po%=jKPy!2*+y`r~CQe&+CuFwqN%!z(vzP-q-(cZaTaz$B-^@Ob<$1ZRlOn
zxD@cLzATd%ge=B9ZJ+E1Pieju5H4OwPvq9)({W>TN_pHlf9(wh8GxCuK
zsb+2_*O@o%b|bN~t4=#p;y*9Oo;-X=M8=~(7cM%3Dw!ggKyF$^i?~~^ydQ+X8lt`X
zPK`(dh&Ip<`qc;A_$tDGW(Pz!4fp@4g9qN&D(T-RQUpIGT!Q0*54DTTvJ+>-T0x#7
zVI1+Dad7h|b*{2-XVh~6zhz0V%{coPQT$Q}Q%3>?*J^2pdy@ixon!E_J2cP}cZb?^
z)JV0_8TzZQ=g&Eu<9zD&_VSI+yuT(vBtCj1HGyd1?(jfYH+LrF8KPgTXY@q6NKV`3
zeV2);+K$>8z^4&-rf%+ssQT@JOYWB)7*hhj`fbpDNh3k_YvN8=xQW{$AsiTgcyywG
z3aS0Yfy!Ur*e5vH!+wd7Xq`{v_O75{Bwx9ERL6moC5#|aP+aPfR2apCxGYDR4~z5}
z{blY4LY<-(Vz6`%Z;waJ`ntM+;HACm!R$45gO~Pn8_e@n3g2qf9FbauxTey{n!bIaQ(%%pJ}=TF*3e@Z`t{F`)-_Cd>{Y6L-4
zB_#K+@snKV^Ny@gj1E0JoY2n-8E#>7M?VL5y7XI4Y_;vv6(0#`kFaauSN{k4a0GFzC!~hwvHUFaM&y6ZMz4
zH2?GbR8_k^@|qw_1NUqP^{?4M&?M?xEHB{X3YLAT*a5tPw&YG96s*KnN|e(irEM6r
zfd3?OnNozlQxO%+Iqt(wN2FbJSH9KJ-#iwN@j#=ouuMi?3cF+q3%b!vt=^mV`QB9b
z-WdCJ<}$VjGaXbONw0GxLF|m`Hp1|->$bW45D)uw2Ko#)AIC}Zp>xa^6snnDHaW7$?}jls(vpcPpzme^6RmF+pkFiVEWEj
z0`6DX!3X>rjrVK`qa%^IUg7-wC2afb55n)-;vj$CSGr<|iF9cCOu@m6m~hs=1p8CX
z(UPBb(C;p-;e!r3vAuaPLoDx_#W!dDODgVPvO?MdodqRDo_Jd!{WjQo7)&@Q_7ld$ez_A33$0FadVQjH5a`0`IZip*iB
zkxuqQb7SSVg17t9H<2DE%jIJSy?e2@eS4&TCu$2rmp>0~1U(1ap|j?acj^^E(TUF4
z|LFcpwvTu)C}5#U>ffF-js4Yg&o+(?n|l;gz|*yVG^LyzQHdsh4!EPnmXK(b37N-K
z?!Zy?uERYQ!ev+xm=l%Ak=l6NEL&2;YWx!dLO#n+WB>{%JHfx`Igjnx1ws|p3ApF9
zUnefESI_3Y_nibB?{U`wYWpZI5|b;T6jdYL!-|OL+{=`RXq{e!i+?OZL+9)vd2Qr8
zsI}7sCx~T67=E;ej`!*h@&MGLo_t=<=;awhBR3bnK+b1jvdFJihZE{MK)bwrg4VE)
z$PZz3dsBxhcX!=`LqNfcStA06L905-hg+%V%uL}eT{MN!(+}MqF*FskCU%*RU3R@_Q?`uv8_T(bn0C^<{QE0-4<Ru34M-(Q`1r>iUMoScQk>O+j=uVM%MPMG~#{
zN@FJF^>fp>8u#GSr>11}9mH?JU%g|lYj;<|rLXVM!7}F0<%BPC+u7fr67Ht8^H5uO
zu{5E1ZlzLY4^7KKoGEJ^63?GB_FWV3Yv4QT59wOm>`8KlEK1mR)tySW%6ntJ>yNK%
zk46d7Ry~+-0TYme6T;Cn%9U$S1%oTA2!JE*9Rr85%}`dl#Pmk=J?(>Dzt2QnxwL?W!X$VfCpu)#=Awst_k?!g1U69
z(id`CaEAPdPP$b~r_&cx1I(5&gGfi%)umeH#ZkGKRUja%^d}1?=l>iLQ4}Rc&(6Q!
zD3-Hhw@^3e&t|X^e-Hi-BO=@QMg9#vQFT+p
zv&f>3GUq5n*B){G6^D&g%$E@gIsonKFo)5A&F30?2;_X%aFaE9MO@wlH@J?{4*@im?Caq>JGPx4F5F9
zKaJL~lvABOB*0VlJCuE6nfoy>ExwG|^*Z**mVx}`6kjP(r~EwunSjPzXftZvqBeNYlRhMCTj>>YN}o0x=^2u-GynQ27O|COnh
z$6aq*RO3*}xN?T?z#r`Xm12Bjzw19bzk!aw^$xn77;Ec|{9DkkitFwguMUyt?9c*{
zFc!dDcK2HH65}Q~+q*g5wyP&eU0^`0YpS0zDV%&l5PlXAdzDEyZ~AXv`2NBbTHLO8
z>hy`26K`P@DC9rVG|ft@8(r)roe?`hQhA?bn~I@6tJhj=m=M08^LGUcrofXfft?7x
zQ_X<8MA1FKAB(P&gTG3u^1G+K`X;Pz*q%-^8PfCJN_>XcAH3n)dmu~V=G@I!cWJoS
zj*Xg`<2F|g>GPj?EvUMCLk1~D2ETvmaii1o{SRjoaL9rU8}SP
z`5wGr{Fch#=n;f>IVN73;^nr+dD_&;K$;Tqwd+ekPrl;QGEa-R_Ibaq;s*<_Avw8{
zO|47QLyB}1Km-|MXr|c*~y2EAuy@AIHdj*%pYQ4I^g9}qg(ls?n+o;QalB>0j(rvoV2kE_0
z>TAK0CiL8ubW?tA0e->mzGuANLwBfb9jtf6Ne3B81P5{PjvcdfSt#A3_M3I^rOF$>
zg_2L4Vv?8^?-y>ZlJi1(LVKxmz-?Por^*V_HQ}p~sb-g5?BOjKNrv53`h>dQFr?r(
zYHQQNEk`?!-<%Fp7caOrQ_rr-Q{Tw!wsI{7jJob8We=4lrd>+G*47lyw%?b0@EdgM
zElpe*7rw^KmSgc+@(}&;!N0e=Fbeg0%k|x-v>fRr4@Z9!P^u+C>Su~La>^^?o$+J(
z#ei~Z4-4OyWc=TEiCEk34@Hc05JWyxjX2!$jTQ1Emh&UZ3}{8t2@hamWA6!jChg%9
z@Nz9J(LC#nl2=Mlof~I;RuH~}ag&_wjs6=*)F~Sfw>S(>
z29m7(LTCK$tNaTc2I~JX&^>F#d^3F>#j9C_H@J8uAF6i)0828j6uzrKw`7TJDSp<4
zoX=xoHOr(L_VO!Dp<@W1h?p<}LeU{fZvwp*P$ZrI!MN?;$T^TMX_uzk&LtoEipGK-
zN>P#hUX!P^wT0)7V9+bQKjkT_>y%97fuPPzz#_N>1fYH
zX`XA`|D6pZAO1^&?Pro8G^ZPifKE>%IHA!vwoKwN0qgJN27*h!KGWe|Zt!^T>g
zOX7cqpi44%kz0A0*;3)l_$6mUyG!8{^L3%zR~z~!+vvHg02I5+Z7zruf^PV)rE6mU
zlR#A~i;Pts?HL!ZP^R-J?qDr6uZJcFTq-$>N^O$}5_Eo`0h)s}nn+{2xKl7j(Wj(91Vc-sPK1rv0AC&)tFpv61~x
zXgNmbIA6)M;}jn*2rA~8^Glq1#-!0n^@>a`98EcKeR2JuCf&UDEaWQ){S~{BjpEtV
z6t;3-Z@Oac*nXvVka-$OhBsJ{8v)4z%On(a-jWSQ^wTcQGJP|I|Ni$On7SO0yP8)W
zocXYP>j$uj|BvXMA7%nH7W_-&A1k^q5=O|W{s%XPhSwZYS{~tK8A-X|fTP_c^HUTx
zN{oc6m;bV~&UG59o<#HNik8wxuM^1!Z9TQOQ2{x^?FyG1=)%@AAx$O<+g53aOdcaA
z|M~e?@IeHlNH^xE$IZ4V3o@OqDth1-c@@-iR>K>gWmKhnxbie@#2fp+4J-R4dfd^`
z%uW|8VF(ao&VTjBOg~PuScv|<1}3%g`w#^O0zXe84Ofh|t={uZf*X_qZazsV*itL`
zGLOpGE9NptcmKEgrdG%sbi8?qaY;IR97e6(T%##?tT(B_tZQ3ymNN0N=@W5VUXGJ{qV3*&5d|;
zc@}J>6k8<*eAou3kY=N>>v6#BoYSG&jSO|naK4ZL&y&1Yl!TuCv^YBX3J)El3N;FI
z2~j=nbm$6ig!tKpTR#k-Z=8sdr8a)+JHM~Y%GS>AtkYayyI#x5oL}6hgfzM|Oy=d+
zOH+8DR>Z6FZAcg2;k)(wfj^X}b?lf`tcOT2ehGAsl4C9za?xzRSDo$MDe7DB5-?ha
z?$8E@?dF1>w_Eb_3Ofb1(}U2#)Bai0(vheUDzkmD!N~3sdx+A-#r=B1e@eg@{hs+4
zT}QI#$W(BPiZ@1!v%tc(JMiv8RDnTGw4=t8x&faxrX%f+7|P>TN5Nm(ReT+OJ~k3i
z0r;wU0=Z=|R`qF^#!i{P=VRdD!pny)Laxj$UID!-PPam4Z`qv?8yVm4UQCQfdY_
zZ&CD_{)gaXO^H6oub;x-j_=km{!_=%d8G}!GMChKsKuD50dt|2cK6sXI~Zn0BNxH)
zd9Truub6q4*DJ#n@imuC9G}I89BJbc@DA|
zh&v?4x9%H&Y}@8XHecl9QIoyoUd?AD^fRaZm7{6rf5|fx1E?dq1tQS{;=unsz%M_6LGs9M{XPL
z6s{3nJLW=2*J{QMvF9}kE`DU0eN8JT27Y;rm;(JX!9aZ
zi>k^6!_N~53^&8OkEe1z<7J!uH2*l^MY+@mTLSI;A?4~YiC$MObxQiZ;r5nMD6dQOY#vvh!8A~A{lHQa56#6FhJ#^cV!>0T0BuTXJ
zHvnMz5Wl8+9HIMowytrRGk2)Ki7rRV>4{wXemjz@rT)|4{P6{Rg-fP_aP~-C!fMjO
z*6186!g%(_NE)t*r8l$%%l8opP>3>&L-GeH?zdARJ9oUV9Nvq`{(
zf|9zGF99LJwgu>GXnRs@7oCI}XE5gN3DsD7aDhgS?%TNq8r%~!ZLa-3JJz5Yt5k8=
zRq5dOkH|T+aIk)-t{@A0Bp*4(*dLLZ(ZnL>P9rpWPOIXPEI_#vrJ`f=WE)Rvzb+RL}11wRDygvvP2|HQsB{&?)RSMb-Mep1XWTAB?8{5_t9!9
zk!GI)R{7^VUGHD;fjhTZA{_q4ze&vJkB&Vhx@qucNvm9K67@!w;|lX3^ywfrcAOhm
z3Zm%wA=&xN-Um-bRq}#!>vEs2u>_6kS(v*LC!4l*!LwP+bu8{z4nHA431~#mE+9Fe
zSc%5-xj^{2t-AckS4|*W?c<~G)-(c6at>mYKP^HosPwdO{zul?0068QY65wUTm1Puuu*Q3nXY1v!wRgKg-M2-;veL9Vk)V
zz7+~sG@Qe%WL=}MxcFbxy$4iON%t>0W&r^KMGz1rN|u~K1<64{$w6|?IS(QrS#ky)
zk_r@|Gv^WwC
zR#(u1^Qt^6qt`8s5+xc~N{~Ibf;~LRt2#=!Y<39dVrks>NRcEy(u_IsMoQ^>9&z=X
z6S`|{(!`V9Jdr+n#>fmBVx;uE42c1AlJ?dnb*wH?cB08Mlf-u+<+skHU*&
znXM3f%31aGi-Pd3!WsG|c_{$|MYyR~NfCWjRlW0KMmc|QpZtGLC~q4{3FCU<9MdwC
z5yRz?l>JI;$~Ms=mFVT&sLa#kbjuUY*kfxv7*$z~3>PBHRiDW+x32p;(~CCZTr4(oq*wnICy0#`v0d+bH(UA-4G?`MsUpI~EZ>B-jea4mM;
z@B6Jg!h`b{nUFGGoc6K>>jl(SrSbRG!3rh=3$anyi&54Nyc8P7cljMxWCmDE=au;F
z5*i)-TVTn$VP^UEQQpytN=&D>RIUD|T(uCL-Ckz=8Ja!*J&I0yyi~BV{OMU!Urom_
z^4Nvm-O)c2maOfMX`ELwn4eVA15=`x`uo_q>wmZCuhv6S*=U-F^+#n^X!&%@zf=i!
z;OeGGDL06t7LixGsTE(_7LAxs-kgdFAkJxQATE@b>fmdPa7paxyGrDy1}ig4;Azt4
zYpj7KeH}7?V+&U4OPVd&WRdp*(rD7}dHBPd4
z$+z8+WOLVzh;6CN%-i$zoR
zDJ^DOFG5zH3vngbGNYy=KERh-HzOv_$)9GQCnF1!dpgmS~hb5{q&$6J~sV
zQ6}(E&ZwXEBg~P9DFoLB~tl$SgLFNdF;!<1#7neBBRyf=mWIyv=O;-Mi7N>-+;V)dt~O
z;ZwPl{;7+cTn=l*6TCm}Iq((V_(*9~(wu-=i3Rr#uo;95#Z?$sV0PesCpwFYcvB9z
zwV8k|7B7tp+XpvZg`bGfwUpljA2`w?c^D16-aTwKq$HeRAQJw1_K
zK{8KgHbYc>Dd&KvNwvn{tKJ+zz%lXCixk=F8zl7@PtEYXzN
zxm#`>;CLXBwer&dlL~NhGuKkNeu;L#5*$#47rs?!b!gN>V=xbrjLR;(EjpYXZcPbY
zSa=2Xd08#$TdSjNIlY!$q-q$Ybevk79$Hpb)pGq7g^NSTH%ag4KN*Nstx`L9Xa>-?
zE=jErl1mx)_S3taI)ydr6tkE&L+wpzB;(ke)*p}T^E#qV4J91NL#uzYg=38sI4j3R!tq!_gPAN%ueGSJsb3?Ag
z8!T6`#;Tdeiwe(jIIdURTj!6z5r4yB>=lJ{ZC!;8{6M4dg%oirTRcs$!{9?IEV;Oj
zTfWV^Lq9&+LfdD&gG=-SdVx>8&*-g9l&dRL;BAuteVg9GyGGNY?>}?eaMelTbcE(M
zy-7(?_DfYR1h^5-mxfr4K#wXJR#pJ|Lz)%6kkVXGGAR`!Sx1MQN}?!s8aU05?l<|r
z_uyGg)n6HRoRR)g)MDeu?6Zt|^hcHyV_66Ixjs?VzFNqBlC+PsPvshISo*}|XoU^5
z^{P42*_n({t^5m-MHQMOhZ7@nlO;d&j0f{qSg0T4gFlOgsJ&g#{;t%NxwEGnfM4kc
zM+rfPpcjwI|6dyGL(dlo-f9pWZ4edYX_rOJVtxKB@UA(B$6;;#V0a+va7i)Ral69~
z%qrCeJYhmOmE3fsG)NPFw_F*-S*t~Qd?D~^c4#1ISXhwVWogu7WZ7d?$S6*lE<4{fpUzhAVASS==Q-gxd7w7ht(%Y@ee=EP
z#N@UhL<&6=WPAeb0VUh2(a)K44rH#12Z-q)5Q^VV;?TKK*5K0B7sy=fv|b_KL}32a
zMK+$-%h?^pWZ}C_+KCbJu+v}aolAsg4yTiweg$d
zHq?R4rj0IL3ZP$Fof~H3E~VOmA3IRv0Xd=_*NuR3SjSz4K?AgPeuq}DJrjh&(tqAk
zSOn=|A3RBebEX=uU$s9nUreZDxIJ#;hmw8JABX{5JdW9iW1U|WxWL&6
zY8@y^fIz7EY6VV#K2TkT{P*$Rjb6~X;ZX0=mBZ4MfBVOHri}y*eLw)9tdXf|I4-19
zlyCbE923-l}r2Efv}p}IK^
zwyT0?iZ%b^j!HJ@F+;AJo8#N&kD4rj27qFLqJc(#b_&UPcG&zYK|=@74UpkX``_lP
zGyVbwxNhz3{yi{((6)bOhB)x#FJYb}W*=n#naJcnhC1&Odi!hm!{gV1Q@AJ_pdQ4+
z|BF_B>Ho}&0sg9|QMv@zn>V4TBK0JKV{QR4>@K=3*n^t{;_
z?!e$;2LHU%6=fG&`gMND|9O81{=*|ckAwa{i~^iu${5TUJP!a2Th{sm5*4q2cb**t
z!!e%WAd%*uchmlBXlSlnr_(%i19Vf4_rqbz3D^0d4ZYwE^lskd()HIgA;(bD4%DLi
zVca3$Qb05?mA~PI6WB}tFQ5S^ly3FqF&5as839lJ*C6)Kn}j<6#>q(92pTBQ=l}~P
zR_=T?+#W>}X9G6`Ij#=@#Q|U#&_PlIJ3{6>qZE|&eqaMo3g`p!oYP-acIGYBZj15iCBs@HR-1QR^>4v5#z6n1VmfRi4S??6Ow#y>>>NN3nro2~{Aq!#9p
z|K~vZZ+XbgP=^V{nyup-*w|L&XLeZyjtw9TNCy(@oJ9b01KEL;cvaRujMZa>(sf!j>n^coSvlXDlE&+I$S;eb=b4fjv_d@6ZD1<2W
z>yHouMuOOo^RM9{vO&4Xlrhx&EQkOG22tRr-vCB~m=lr~P&Y75ckKTL2Be_N1}QmQ
zYvStHiu%vGoI9>(pnmR?M%Dq#j>+84@VuOZT?s8~dt4&c%nn
zBg%if(#d!fjeKG3=jH%K5aIyN>|Syu89D{E2GZ5;aBIJYQXycg!gdGZ9eEmZgc
z*+a2E;@^F^@Ap*r8xD>wIe5><$EhU7TFsj9GvWD!rvZ%!_VJcM-N+|B7=I`
zPsi0ifA#lB#DF27m$IyUW-;Rt8X{2khDD5Cs9*X6NfZ_FuPK%*#$3+EGyXH$?Zh~SdoJmCy`D17;f
zxGf%#{W}oSX1-my)V%r{YbE>9F&#ZUz2#K>v-?W7Y{jOXDYW!URVdrfU)dRvKwQ+T
zC@JbS5Sd>V7d+Dp%oB`?hm$Rg>;3LEH%?tp*jG7dl=Wgr7br1!D85TWa!Nolf&Q|~
ze(6i0{>Ko`DsRBlcdOn_iim4-p9?!CeAyzJLIL+oV4(4L*FXDR{~Y?&`fP%z`2h9K
zozDx%L4xB6_48j8duBgMzu%oUVeW57jKL^p08g3Of84LjU6)nXRXFbq}h4K4&4>LJb;Hoj~npS2a~;U#ZDy$
zU*CQ^k!P2loIGBc0fK1B`>)mzh=8_%WI#bE;6{pRXQD)S25CrC_*)RvfL;``ewDgG
zXM)~xzssW{)s))W`uh5d;71{s-#mNbOOY!Ike&7F7xVt2A~Xo|17g#OH-TXbh|dst
zhS=aUYo8gKhoT@1GSnN$N>6Y(!y$x25aRsj$(})oUffprG7t|125{LKPWvF=0B)xg
zO!4{LU!l=~AB@uC)B$k52TuHNK6wTmYLsI`#sL^WQ2^xnkd7cR%_AsyfcO37fG8L#
z1wbeJ!a)CE{D)$YPR8SZ@pd|`a}LnwXQ%@wofU*P?4JRzM$w8k3XPKD05N9{5DEcx
z1oHm;mykVB(^1Mfhb`!8Z~Wyy>;3-#n(0K4_O6Im;X#ww1Y%r)zyYQf3Bdq$4gmI{
z*tEX?bpT
z3N&K!;71_+2`bPWC;`RTAgzS*3h>V&GGIWc+yBDf(rMkFzqFfTlD%2>yN>Vo
z3_N=CuJRsFjsga2<)KWXb5v+(#~Bg4p*YKAg3i$e=nJJ=C{y%?l#j}zfGj_nSy`HTb4nH2;bC|07;%Xrj?d=L#zeJf|NZ=)H4n})>|9!IZq<61Fl_)q&KZWY$^%$2t
zDvDq4%`_k+9Fjuig88_R-=(2q&^hZPaZ%0%*vR)R89B>vK>|0Hz-<$iqq<(#ZXSd{
zpkrWQsFhpdT*tpc5>|c>q=z{QzhpkYWYn22RqlYZPlPS`aq7ql#7qaDlecMP^cidE
zb53N+cd@V(#yZ47f#E#;f%2Gho(3odIe!q8(f}7z@`FU;gh=r$gh4XbS^p2UgbO8D
z2I5eB2fp`f%>XhrpcX)VAPof3`CK!om~llMfEKt4_=1X=D65GILzO~x=095lH4gmQ
zWljmm=}_4=%JY7NevoqbfSLlrA%F#lV&_~8rU>6EqodHILdOusHF4k=qJfP4zF#yZKrbPENZ94HC;QLdpQK`j5XHKEpv3*n#`15(F#*LQ_`jb@xzV>S$@2%4R^{GmI
zq|CyA0lLK4Y@#O79DE9fAjSEwz8OmHd$>A*xTRm#ntVFMIarJQ?O$WtQ01^g?eRtZ
zvToEH$j{eMW$$=jFtJl0ecPkT+lBNqvdA4I6t&04pm+$b*{?;q)f_Y;F^g2Euo06U
zQ+jlVP)2dhD~+ln5$X6@$bwTNZ-!9Ei40*d=%>l}-vOxpVPJ$}#r$jb|9i_Uuw
z=LRwgU-sCd_GrzNM`FiwoRUGe1|C(uV5)jlXCQd&gcz$m)?_YHwKzSBc=w^txFF)Z
zii<=Q{4?F!3l|pRPz99)DAf^h*n?Wn
zu=~Y5f35a^vD`l+^8e+=3QP?0GD^xS=?NQa;ZZcyRm-W750-Wx(9$4Jx>@GlmZ8pv
z7qbXg3kXv}ieF(c4>vz1)7R%rRH8UKIx2TPM0ZNk*;{-6$gvCAPI`jvGFUJ(0G=X_
zL6j98dpLq|}gBDYj|?=^CR9-gi-Lt7>yM>vlcFYtv((9vtyg6|7rO1V?Iy6F`<&2D1y
zT)3bh%p<`#Y@12)uXg2P$FxX_O!KJ;S9fe852~4y3Af~c)vPMKu+~S(gF6?-59*!`
zD;|bM9CdbWwInCc2+FXxRN&C;sw44`r+MQYFo6y1la80+38a~(^A1Ru3(e`O1NX!{
zL)a2Nq65C4ziGhIi5%On7_4dKB~PnazOaYgWo^F1o@?zUt`{R~di0yc$t2lomTjoq
z#O`m$z6RW!yLT0tT`ZJp1t`e?SU{F|wrW8M!RC%)jLQ@=7D@bl($V&{0!^)A1Q{&(
z_^NE!cfl%OvyuBoHFeM2=`(Mz#FWOmtkKB0xf0dZtTqU5&8qA)Esc7X7UmN0cio5Al|GBE}P#+6ih0fN=*-}A8BTqv7fhk#M
z-c_XYXJ;}5#N+j)X7AaUtjzy>5)Wkd+SQ^xr0+^}@e2@-tdj^2WD&1?!pbC{6ZOF4
zTeCG!ckBJzacng5o$+ji3B_`hW}HT)Huz~TuhMlib;v_aikGxB(yb9Kh8!caseik$V;l1m){AAya%-a~#W*!Q
zwb)balQ|pK;tHyqM@p-g`oF)D)6W->qD-Evuwi13pL-vXsnGVG-B6dC#7OTwx-?5G
z#p=}#4hso7ua}11sZ!h)-Obj(B*kN?L!FCaSwg)>xVdU^X-~Y*+6E>^yu3;%HIiU4
z`||3wg*JE$cXDVr3s;plWOj||#)`MQy0dc^y7!3TM1F^Wh>aRyT=t8>}($k5GZN^^?l}Dde8n<_q5PYJP0#r?d+uFcOm^B~a>mx=L
zvQ+{25vLbkmOW{4QG%K+Vll?OmYG
zJ`Y#9(ThtJOsszr$?;xp#9pwri1|U=yyM~y8`0X(Qx?u^m)K*tTBkOR%5{jYHI;rD
zrO(;D)JuzO9*Q3CN)&Vr%e$BSAk$1|y^}-s-o1<$Bznlfhb^PTH+o-BKlBh_t0Kr&KM5E)2;#*nG!2fHk!Hg1VbH1fToYt*9*dvIVD(-!1ufu3p^NtQN
zLdL5#oj=elVfw3y>fq`3xAZ36hPl+zULTKslkdSC<{n7x74ZP!rec4y#%{Y^y_E(V
zv+gSn7D;kS&5XN9I_b=Y!`+u0t6HWr6I*wf#@nbp%zmG5r|kZCfiVb))sh
zT>WK0<5Q7`DMouow~FAG=gxj;QDUt(Zh)CR&%@q0Z6lp36DaZi+XPBi-Q5jzoQR2xN?^w9w+=
zXC+a+88>3rg#oedh`rhHz~rvQT8wv8NTX@JI3dfUS;>4IB5}L7V=h^`)WIwQefoxu
zo}?U|+YK@Bofh%C+=5}53=N(;$IjnO5a1RkH+XT(7Y^6ZFTOg#eMq)4
zD8g~d<{RAcsCeDR_23Z3wX?eYh^y7J!0d)BpUl-_1DUO_c=9jp`M->BiDQw*|KZy8
zWDg7bd6Hq+oOC+1{!r;0`OB`k8)hp8=F>>>EVDDYsalpRxs*J6sHu%+t6rgP4TTf)
zbD$ByxXN{6JazpS{gg}14zKswa0?L~$HpJrW0FN+`qm7j$EMv_M-W#okxuV%2o@$K
z6OnlOr4Zi*-n%|MS#!Z%;-~Q39mftH!Mk08O&=|ied}Ie1)AwNPFocc7cORS+nR<2
zmKk>?%=%HMe_C<=y?QR3Sb*c%VUpJh2|}?LY+nAD$PjTgjx#~u-G_9lqwH#S4N)*><{oEc5T?&;s+gGM@aV>
zXVc-TtjH4^w)N5GbZNAf
z(e0Dk2_9IV`u^6pI|4#+)y_OZKB)Zw15
zW5C;IWgte=_WBBTc%`U?hif{=ZfA6U)U1g1t=S;#UU?Qw%H4W7D>U4IaFrsh8(jQT
zbUYU8Eqjr8lP$X0)r5rLgtu>>+8kZcFAHMfOL)E>KR3D~_>_UVi)Hw6Jxea*w@&bZ
zMNn4esp#KZ*)~n4GdJ1y-Zu%S)(ca1ms(GO#`z)SZ*89${$XIC1UYUeUZ9G@+gtWB
zGNLl|tFD$k_Yk|mcXiFSW=}^&0!Z}<&D<%(3CnHXN|;3TDB>OceWnSNTM60U@3(no
zix*WVdDe_LUJ?6qwHi51t_5H$vuniqFi^%6|vPKDx5lkM7
zAp{m!1#`LBRz#9>Co|p&2~a+WY?h$;vmbf=kgD^f_-W@|@TA6XzhgS#_u?P2(H@Z%*F
zXCg(7+NUZxFT~~k+`T(T;prXNWE$Qy+e7R;i+$MoF@xLbsIq+`shex_p(di6lzE(3
zyG@-Pmj_pYvdgf2ZfC$G^)b(LgWo|0YtUCn*x9jHpa;i4f@{3~EPe;gLPD-}?(Jv7D8;*Lj9yj+SWka&=Z#T?Pe%3J%}=b(|S+jsvO-K)IayCR`Rg%s_1?z-+oE_Tn6
z@BgMWR^ap50Vto>Cb{G=)k!fWXro_7($tTWjq
zZ1ZDRzR3XWpx@+X4q;95%IgVF4j5Jl>zMwFLmB(E$`Ez#)I&B{7vd6zs*<*+VzQgh
zKGMO(aYHLN)?h1>TuNV!71k>i-yzh~&c+%iZ!=3IPi3ItJDj*O>Ofj)Ew*hGoSaB$
z@WRF1KUO!;?OLwo)~nZ^%XAYhoo@RDbiQoK^9Mu9)=|c+cGHADu)U4R25xS&4nIJQ
zd|f+!1~Egm(bq`L!}Ykix2u@9aXUIH9XBR|t=-d~@pgG~$Wte2IhtZ)3nYYxe@i&9
zL0IqoDt2dBiM)Oo^B#$z&B_K>k6F}r{iUz0H$qmY>U=BolUg!@AH_aN>}!pQjq#Lj
zXqRe#f8o-J(hphPn_2N3EZ4_uh>w@J+S-0Ln&W0=Dj6&|zHo0iDm1*FUhre1hrs3y
z*5m!H$p*8+>}N@3P7@ydO+uu}a|=`930=y6boBZe5ZoJS@WQs~;0u=}(PHu9;k>U>
zbtD&{Iez*Zwpm-V6RD+la{v5E1vMe*(GA`SBtODN@5j^}6EejOyQG=J0}Ix_+?GN7
zwx#SYO^veUgPZQLtM09`Y&s?E)FdQPE(EC)&QgJ3ZnmgZ6CVpnDs9mf%9Nzz<;iD
zxF||wt{?H=8)X-+uVn+}cP-4T(nkzh&OC-ILbq^NNFo%j5@ttaj=z8h8^>N2qw~6<
z031(&fH?d8Z=m3+laQ#8OAEUw9=kMoKay<<29>|yV0}nhA6U)cad;_r)>=*+4
z?kt*k^g8x!@_VQUaLipoE}e%
zu|?1o`uyH_ixPVVADb|XQ$(Hs^Rv%RftPr%8FoS`@BR1#0XHJSFD5n&SB=r|M6qnb
zaP~riK>Azv7?Ud4+R-)6c1B}w{ZD4W0qqY_kE~`N&Eyp?id_>OD)YctHh?!@Gq&7&
zC|biWYPRFPhgoK*c2++mZ*~xWJ3go&LB@s13N}rxvwbohZyVgW>{~njAyEfZi+jP)
z`W34SHRb!RQ}z&#Q{s*-sy&hey`_n3uR*#VRRbsV|q=TgB^DXU*=~aJ!WV;C@h>XsH<^O;MZ982gXVmtuRo
zs`hJSWvWV+ERwz(E^D(8DmY8$n>0VWSk$hMHiw94@)JGWiblNKoWH5M_GhT2bkg^j
zw#B>wF;CkMoxfq;RqiY-G@=5l%X%cJt7;b&1%P8*6VfH(@cIC=N6D_}_2GK(>DM
zkNy3Zn|J?wm-yHHB){D0`~SM}>OU{I+l;v%uLcGqSoX)t0wzv6WVbd$EU3EjHkPvT
z3JW8aUPsFD&TPFJ2TNc>&wV(@%iCY^fThY;-S#5Kw1Si*#QNpdvGXR;6|H~RTEc!=$&(m7S%H5m3Bd{rXqPUC%EiM$sERSdhxse9eQ3+5~>9yH3l8F50NZJ~k_6
zNHBVLS)S~TLRO>PulF!r6rGXB6J2nDeJ6pV?;$J#2x)MGf@y0|M-v{YsG;>L44r8G
z_!jRHjfDiQ>F_D{y}{a`j}e@deU*dN`-%h-i)3le1Jx_UIpOJErk`EN`zU^V-{MFU
zS{bbMm3A{LRFIKj5+@ktYeJ9+rQVYJ(_yTw^E(d>9Ub;W8)9OtZB2c@z-8UQabapg
zXJU+0eH1Kk)8r+;s5_5^*4vw#j;L74YGTT;#Kpque%CqGdNQ~0Ft
zVaTw%(?n_XSHJ={~IYm}I%qch5Xo%=ml?)gqlCAKE;C8-WA{iu{#jgHlJlC@V;1NQAR
zGQL5!3jA*N!
zeQ=P~{{7j<9J|soRY#I5C*BEFaw$?z!=$ZF7G@GmzD)LC3LJ|JS2T_g7b~O*CUpxN
znmQ#WSfv)ny9>VuZ$6;(@mO}Z$BOoR>pJh0*W8ntxkx?V7g>g*iOS2Qe=4=?HJFT;svW~{;+SR-c+`DopV5}*}
zjj<9>T0N(>y9En)9Dq*na2SQ2s6U0c^H?mm4OIx=mZU~Y46}~o
z-jKmi{8L!CX_gya&TiXc+#os;eo>VU+Z`!0%8Ak-KZg7%MgI4s(y%a#?X*4f*2BdF
zkHgpmzTBX>m6watp1?mx(=2p{a>|NU4-Tb_ryS(Er>)Iv_0SU8th=9)&L3pzEVkAL
zl;N+>r8DJx$WZHQ$H<#LaZXY+gin}j3eWtwI`vR30THHJvm^PrZC6SV*^uBc@4UA5
z##)PeqH;0Alz!`?kwBVGOWC2E3+LR4ZD;L?RIm%<`!0vglz8*B>i6A_-HmF_<1MBK
zh`iq;Tx$YI$870Vy(5~!8RxsV$LpsvKBy^m?wcRc5Czc8%(okuA4!@Yb~7z94zQk{
zVB3txnw0P6+7Bz5&g8IWbeC%r^6$!X*UWJzDJi5{^pqVc|23}6y@4j{JxWRjM);m;
z)HiW*YV{qh;N;Piy~l#h<7gnd=g3yGW#Lzx;F3>F9cT3Otioo-=;y>yc#?^qKEh`8+)EO
zNqeimxZvX#89nEIzD}DI>hEC&87$uHW~LAGFY*v
zNu}?~>Ftt{LzOH{dPH082?BnLtjmi^1xZKT(c7B=vMFi#p0`8j
zwVoNovNU|S!8gzn$G%!zmN!{fiNDnote+l~qixa3ze;Z+$&F|aCyXWo)46{(odVcB
zo&Ie3!D!_o{Q|2Q5ul&0CamsQ>YiaF1(E;b3g4iyl6F2L+^(F(50Ck!b4qOaHt_J7
zOmu`iFv9Q3%k90qD%Txx`VBT*YQ~m$qLAL7@tzd6nIWCV4AZ!^F#JunZAY9feI+8}
zP&y}dr2o637SocEaZcKdXL7!yG7-^{YD{lTSeTrk9aZ?!5KWrXQoNy4u2(J@Z(6Tx
zVoR#Cy@XNH5tT~PvaV_@|3CEj{9%#2Cng=oqobVl>Ed)O1=H(nCH>u-Uu2c4vV$;B
z8KjJ*#0lMvbm-(&U%wWeb<(>}DSepp6qcvtI)Lr;dynHfZ~6;ZQtM-hxQmDSR5GSi
zT{36y$rp{tXQ+Zx1fGRaRClHVM;b_69l}enG&a%Sw#4B%UuG;j5&Gj;_7J`nqdV%2eKr9RZKn}Vp--=^
zj&x2{9d0WX@MulY?$B2z^7deqPtFYV#O1;j>39~5beURh8C9i@z3*5a_8Gij%t&oy
zKiSzU*^x$)YiMAb+;a-+Vf^f$1;?j}KBl=eLL*PlVKqPJ(dd*q3-N1IkGhXl1Py*X
z*Y;NJG@sm-?dBJCxX$C8;0H=A*+An
zbKCUc&U=9^iVStz+lpNba*X@(`Z1|AhnWV}hcMX`sidZ+h_%}eMUKm=F)p_%Z}AvT
z*ki#vl41URXtl3aWXT!zQ5#ALt)ml@#tWp(%px65Y?)9fQBHMpGo%ePk7w#ne4EBorE9RRp(r(xzQg
zcEEjixy{yo@43EMYx&T2#Rom+3Dpzgpj|y4UYCbO4n}U|K}McyNi2C3Ii#@iBeJnX
z{#&7`cZ`jVQ{^)A_1YBf7fR}iUH7a;dvIU;m<|Gy`Ir@~7I28L4BzHu{dTV4AR^9<
zv32)o>39z2(N=F64txUq!_4)`Ees@fl4?=XJrPzTXSxyhBRupK)rxOIoX2@;3%WX<
z(GTx@9#Wdri^Lc+rQh&x^}hFcNO0~cH4%mw7{>T%*eqF??QhzFE7F0X>K7|7H-%WF
zJs*_u@DL2!aXHja?{X!VSN$-vIah2(|6E@;ZFj~{#${oJW=q@Xlq;_19*>K^Soc(K
zZ?9OIoK{;@&STx^=Jz)*y5K#19JZ$jGJ@``kAu?3h33QDu0U)aCnqp?A{bjw{tbnA
z82HD+@C16J5RZ+zk2;VlB?+PtI3Sl!2^xY=G(EVe17Q(HXs83?t;Ls7Z7K9r{tvoI
z1D@Hy*z^u7`R2vEC<1clk2fy@w%(8c5b~7{#JL`L_Z95Zi@)J+{>mpeMTWzh9TvrxY{cXU!ee)KHRfyt?>OTT(m
zk8y=9f$Y%r9)Yx^Bx_{r{j~1i#>P|^R#z$Cei3`eT$pk5;&3GaIkSk*+nZpXEf2kU
z@fvv(WLzG$2bX=m68JIW0wYskCIeHjWorjY#XRx^B=?>I&Dl&M>@Bm72&>ifW$i%X
zPXy#bPp=yuyuC?)s{=B{vnx!s0|QB1Zee1kWd14f%|tbfBJdu6T!BtJ&{3^+pyBLa
z%|oC8=(Ph=je=7`%pZvV`E6O~)vMd0q;5Bi;($nWe$0ic*DnNR6OaR|egmLM6~foi
zZ7zVxP(h6)!zhSdR&;^LL!=KbvspjA4q8lw1GM=xz7QpOW@i@+bmfNj;JLbb2RP7J
z^OfNH6yDRD<@pJ=eO~SK)wRAPcq6{|a!)DRk*Ny(SclP!yA1%dYd`npVn358W
zOP*oAMbmz_HgQgJWPzbTwqo8$ibzv5I8mb7RHGz#4YyX2^YE5_&_w4}n%Pd&LG@?Q
zz=)>6sgK85@;at)_!b=W%+O|Cz{3_t6`{W`j?VFD&M&
zIQcuqFxGXR3*@RJl}v(|g$4F8ljwFf*v2zH)NYzNUv~BL!EQ)RM@K+ZkE(V|-*=wl>UQ3e
zfGb(Uj-TS)n!h_Q`5yFA_GIdpt!ArOV@#-Q+$TxnQ8B2EcFM3Xm|VoQv*7pcPI0h8
zF5%|DH5xPKZHp#9Gg*6Z*2;@6uk5p|_cG%1ssFK-lkwbnhjC4F4CX1(1Co58fvbb@
z0Q%ak5j4dmIkO%oAzd5R3b|_H*F7&q!^OGs*qbjeqz@x+uGPCrSbf{^u7tYnPL!jk
zr+v+FMORU|1G)`kjlYwP;8$-+Qh0h=b+(2hgCgVG(OC!UF>V9-CFOddtV%~Gw|_c*
z{Lt$4)9bwh1K&qR8Z7;p3rD_-mTh=qS0#T>5iJ_It*C}2jL(F?Mr;d`zV?`%;7ew5
zJCx{rH~|ZaR`0^@mzk2yJtiA)N5tD^J5wtnXN`PjVI7m@1^n439X+?4LW@0hCS2*W
zkJ(LJxPH@9K#UO*yXl4AY3C6xiDhNXx!=Wj5{X^}NlAr{x9Gt5ho0D&9XXewm=hgPm<~x!e
zv-8@W#;v=b5@pAo66VIs|6z9eP`}gkW88(|nqxw9rQ%>*A?qrw@jK<_GMpH>$LR50
zrxyo0Xug-a-(oc=ecth#*~IA$PI?tlzdN+Mx!Q}}c504Gwh}j5Hhr8lCqGx{aYSZ3
zD!F?wsaS3`JOTc{!^1?LIN8&i9;e@jBJh#?$o4cf{<8M;ty}2|mq<_0Ic1K~2gY_D
zRuji8Eg1t612JF}aXPU+Rd6?0+aGhLH~r!xnvvo
z37MdWHu3sNgU*NYC{hjN?a~@#n`TKJ&Is
zpye9;lyI!agd6@AH^AbAZQnKsUSC`8kHN$p=`s3SUy8~njonuQ`zdH@C!5$-)1yOD
zH6A2c$BxSX_0(XRGtV83?JJ$MujB_t9~&()oESPWy`L%5#@=^d78rNmb)jK60cKs&
z-l`J3V$IfmbkoCab8$AxJ)8(1aR>9xr2=1^;sf=Z#$%nS3d4Gwj^nlF%GR`$IrAP)IMN^b3O4Z~w5|@gZx>Z4vFhW0=dx!h%MlPylI$L9gRDpBrCa
zgdx|I>9||JU+;yKxR4ZXZ_m{%CF^zT{xbeA({ubcdP}~==;U23&C_nFZd0Dv`z;`P
z|Izb-r#iv>rWrb~h|J7t^_^6iFpDN&jYV-zlzl1VUnxoX5;sYZO&u6f-_*4Sy>Akr
zy?XU(MKVq9fpiv^?xBuTTQ*_7GY-a@YfPl%olP&^q~FmjrWoX#9;FU$KN38cBD;6o
z;dV0Vg8f}tFvuz%kqC3dfY-QPg;k%b$xNfI)xepZ9rYU5e9LD_pYathDBzDCvo#*2
z5Jq~rZZE1G9|mxl?g9%
zF{iN@kG263kaQYtRl?6;y9`5I7Q%!+P9mfoY1sUUR=F<2*oFg;cljoEWXE
zMWjcczM6GtJ>|=59-iRCWM!P!fw$ie0gH6(6i|x9@#wjBd2jD*W@d}chJ-DBb$psS
zLwhyY+Q|vOrQg95;N)S&ozZJH{qb4bBH`Pm7dezIlv~PVe&@Ck-6zs(eq~glasE+eEjP?Nk+x-chk8CImF{iLL
zWJ@1Cc7U0SJa|?GuimcMYfGLhEMqTR^@BOuF7h}wa91I-b&L|W?8lKX)@H#|f{+}S
zs0W8lg0rXV$3jg(yrF_l6PbZ@*}6k{QP%q;A)y{4qKAVcuZKtil!h7}(Aa~(q^RCx
zK-#&T)aBvXCesd9cCc!1fh4fmztLSJB-el|!DX!?LP8G#e&8X9rI302#JuLC@VY1?
ze3VYGrQ*w%dC`NZ2@l_AZOM9DXkQ-RNs||7>4;{#sLpo~g8Zs3N%VTxY`vE8S(m
z&yWX~^xfCc84=CA2c1;zSzDtse4jsmrG#s=!SB}8+i~(sFkK_-p3u}SKkb-MYkQxb
zF5)A(>8E&ey^H;t4mTnOtYI0s26YzBG}hSI8V)=L5$iL-$^1`3g%nquVk{8J
znzO5dh>HUrhfKJ;GLGn8RxeK0-ZuA#M&&?TCnp>qk6B8j3
z&zMDwO-y2Wc9p^?rXEWtBSaW$PtXNU7i;I|To)xZ=SL=LV)yp!eMEyf+mAt@UDU6$
z)0{<^Ymg~&Cbh^fEvT0H2MYufczJp8?e^aFZzOwgdG8jgM7x%fn;V>z#Ml%_C|RI1
z+lW|9HlK>Fb$x5$I)l_JpQUb}ET6xpfS5P(*RwaC3}iwk@G_~l^%=PS4zjc%dH2>U
zqbEh{HftWI+%^*)baVk#OWJ`qK$WidLSCLcQo@@-we(`BIvJ>LR-~_A5Fge=CAX`C
z%#YLLK28&aR^;rdv*X`%k-_sBh~#J3IMSGgP1i9h46Y9fMe&z2?wXUzWCT
zcQvb-zIBK8>nGVy;|hoK2TDNU;>a52@$U&Dho5?z*W
zlL8nFsB%La)$xbW+bEOCDX_D%%VoYCEYzdBIYh|U1_)w*yV>FMdIt%Jo}B$y;a(>oCv)I=fX
zgGxUvjw3cGo+3j>sl;D0_tE#zDPe6aw9jeN8R`EB=Q`M!ho6r6Vp
zB~)_s_{tSqXn^9u)bncrY;ZvZF6_(L)SPrym4*V*M1%uF`?8Y%$TGnI7z0z?eMReK
zYiFjlyOi;c**YIwMgtZzGy+5Uy`d$9251QZGYbd<6zz1hm@!nShasOX^~dMWaTJ-_
zV6oz^QRoA(6mjX&rEJx*Bv7(~1pq9C>z)MUm5t3Zpt2tpWERn&|G5$%4Amnnsh|vX
z-c{K;yt}lt^eK-NRLbli979t@e{l1EwRfdaO`U02A!SkU#26t^q9nOeg2?WMiYQwy
z5rF^#l>jb)tflNwmtql7A(#}QfC6Gbh_Z-)1A?L`BFJLcL`BD{C<3u%Q|r>c-=*iw
z%#Zow%>0>C4u8nK_gmiYU7q)O?g^Ut{C~pOB
z;_@MK_xzi*L1>?VTzE^cC9_?13iX%`L@LxcKTfJJCr49SJx?{?zUaDuE)S8E_=LI{
znr|UAq=oK85=lD=N!aXXI0&#YFetDS6_tW!ZJ<=~eKatr4>eY9^B$sF`
z&3M=(Z2t01+THntp$;QLD#0y@>@-9ColpZ@0b-W^Q-bO9hGF8&mJ|$cD+l{TVO*h@
z<&-L9FtFbK;nK1)V4`#!T!00OfkbiiCVlG78y9^wF!A>o9p_;qN|ar@drQo7a&k(_
z%9dqul^Hw0WXRO)U^%jemX_F6&smpxuQv3{bulVrNW}sYTNFitbKO1h>^AgDPW)55
zfOdrFhoCq=&(+OMh$%z-rE2svUF@2X4!$!(p~cHA;z$=3)I@7JI5;Gcm4Kua3AO+Q
z1hfHdU5tKOT3S?$MRRTFc3ecl+ay%Ht&+z2QO9BT)JtOwhcF6+QvkoIu3chfkOe_&
z183D%2=|p-ySAx#>nVFae+5nfPfoZndt-GfkY%P_>#fj@IWTAejrFvJZWS830vEyb
z)rL6FCUVj_Rl_s~NS}ZYt5+|AEL_EehsDLka15H5pAUbM`pBp*+kC-QFTQCiT@p%2;0Ql_IyuXw6c5WI)F)iANregmNbk9>w7c^EEXKr`qA)%**~fs=H~>A
zS4~ZHhJ6=b_&I57SqlyZk=j{`T7ky8d17N$Q>F
zcOiUx7tgCmpBGn3Dn#BR+`2~m`1Pl)<#9N43-&%L0cKrtBbLh^T1LOby}h-
zJ-bom0MkfUb#B-Pz4=))CcB?FY=~-nPmQQE58Cedgf-yRIreLx%HS25h1%Ya>!MCg
zABY?}NeLabGmiA1->1?&Gt?E{To|44syKYuFW>jkn6m4|o+cexVPQxW;K{at+sgdg8l%
z=R6w17auxM;j#DW*}AjA>(xKqbn}Y4
z9g_LDl7!nG`G<#-aXSfRi2HgtuRhi!wsYB?Jd;!XuYwXrgK(}<
z<-WyS8Nc&4S+u_QehVN4x;-9nnyc0BeK3`I)(ak4{B6AAMdbFd^#Pxzzbo~ptA2H|
zQy#x6
zi~nwG1ozVs#o~`^^VclS+!$rZl?|#)8Wd!!FLy4y5wp@Aab$gf^;AW254oSLha
zRqr{V*uiP5Ct5xBatI6-(Q_OzX0ng{OCJzB%sy!pyh`1BhB4fE{!HwbS{sVKs9)-L
z_j>+?hFGfVnR}Na)I-zD3w!r!2At~N!f#ggifJy}J6f?-{HD}k&yp_cs-FJZ?1y)H
zvLmm@MR3e{8TRrV-Zn9Zmkj^pn((sH-jCX=A3GJkVP!?i>@05AjrC3j@88>e>D}D}
z(^98N?Erq{+<~FJb31@VK+G*)9{m$bLnni&3y!0r5S(}~~eM_xW%X1_1jb0}HN+ETr4*-f_
z>`%H`?EtF3M#vBM1Zbks*VEH(+7-fRF@X#Va9+$~Ukn>k0QfXpDPV#YfKZ|BnPKMU
z^(C%)H)x=-+y{&aQ}&lV;9R(uj`_JAg?xrALLRJ-UfyM~-S<^58#3fdCC_D$V2TeV6AggOBZ{Cq&WVgkOQ)9F()7VQX1
z@zfx3Bp(74Q}qA}NppYM_P~%3-`)~uI3)nY3`-?949W!CN6BTmq9scM*^NF
z=;wA&L7>_IOoJm7d*}nRTg6UlItHji%(6L((RTobQzJn9T3D=92rQVum#9k^dz6A8
z3I4fa*XLmoZJfod+Fs|SgD{}TThCTEYx#OZCf*F{oUKQxD>J_W$#jM%x?X6YV6x>M
z#L_D1>taANNkdOapa$-|kb|
zhD-3~wtLiu4Z&C-=$Wh3h77iW4%hlT0&tl!D(5uao`HdM;%m&`p1+MN=~TURczygUqmGU#`$FM??s5&*Blsb?%ZVV_N7fs9z-q}x5<
zju18XSrJoYMga&{nPTair9=X7M?JRg<@obhCfH2l+-KM<|x3Zbn%P
zf$|C7LZvZ2fU1#J%IscjiR3~~Y?@?t%^%~Vj4{2uGIn7~gDa@Yb8*cuwrEO{Vo8!C
z$CbkA@@lQMnRrDq71v}iK%avPhKA6_0&;}O^u<
zgP7_WvK$d|QNJKNhua?)FGSZcT+sl=Q@u26AYj}fg-NfV*cHN=vhp%8d-3*D)eaM*YKGek(;0=iJ-ve@cWtK_2|M}Yrf0_9Iz{I~V
YwP)OaeJm}dcnt@Un;1%n|{rt@_
zL#CG(q^)n@b*QBEJOAQ5sIHm2{4Uwl%;Hy8!)@iXC9Rde+`
z7qaj6vf({1x`M%Ouuq!q=PxCHKhIZZLBTWV<(%dd|1?_cAi^
z)cWgf3~FR}u&9ugsbfwfox%EL0Ilh
zU}Bc4du=>VF)7ZlbUqP|MZEwa=9-0M$aD4&zPx3cm~%*^=E=yTKgS}8b0`z0^f(6c6Q>97(CdKz=-
z5=LRWz*|dlbt_*OCaB(9FtK}_y*uvZ)4t@>%*f0)IP76Dyrgi(5!cb&)ZD!27cFEWPEAD$0_ez;oTFud5!k5RrBz
zKPXDias2e@m*aCj!xRk6IZ>&e=`qL%Az%cJy2hu4w-Y6qJfCjk9kwc^&NgQ8AoZ7^
zT!=hHL#v{4!o~5B-2_>dkp{lXCmvP(Dn9-z-c7_Vjun1mS4__zP}-JZ()@n#!!+er
zMhf}Ch4R
zo)Kb}F;bG6-wKw{*B^F#Tyw~2cG^=w=ZH^&XFfj-Q=o`wO&1y7olWV)#82I6`}xyP
z2pO3MDzck5p>Y|B=U
z{~*)eQTUYRf1q&r*|?~n-meW$hlA)|tSQ9PBC^G+4xc>r85g=LTb&uWc9|0uW_@U7
zWn8am%Q_9r2Y<0TxI{Ln&hAETjrZEp6dV)sa=3Q5bWb612ZO;h*Z9)(~!dmSL)Xci^7
z?+q}DzOsLonaii7jsuUl8JWrSjt6(+Jyr4n$Gcql&{H`LyqDh7;>>|b)0cT?6BM|9
zXjJsy2$QT&3eI=zIJiVhEpd|gqrKawI2t?`2mGb+emU=^Yk6dPJWggBmrorGh&nP`
zLi1i{_nK-QFYPeCHDM$9$Btb?q-pYkV4b%y{0he3XyDx>=kW(B_?$)Tzh0nfOv!p3|E9
z3s?PpT+Ey=OMFCzAI|emr}ojimU~8cHGpvck6h8ao8;r)xfq$fv}I+NgwHc_#Fo`t
z;;9wAvTcSf0`TNnNeG|QdqynbiAjl+lLkC(pL*PAp7{7IFN@w(3eV@hqfYMx6V2i&
zV~HLIN)uZjKmOj`@RNwuQ&;ldO=*0*t6~B&TJlHievxK9Fp<)toD+ZKSw`x$6-4iO
zZqO=$FyY)!52-CKg2@AY{im<}5FPxq9mv5ne|BlkheRv+E(kH9;4<=CJ<0Tr)Toq)i$(Y7_GmC%nazhW{{#zFX
zFlB5Xz61$Q{-6}ykeo>Jymc&Y%S|qw=Vgktt>i+{mF_Jc@bj;)#ZNUWNNgk+j$XEB
zhUj60Y?*War5HWa(TSIJb$)^?W;}To$8Ig!$T>9lNa!;`_}|(!m193t)WG0((3PCS
zhUxZ5c}>Rw{>;NZW^Jr`bMwUOy=&3MCt6B$0w&Lcne~jZ`&2G#b%+s*DCimFdgaj!
zyd&G1VbbUnykztbUZLIv!1_
zKh4IV*+Fpeo6G&GhX;u7oCqR3aE|M+TtmQkmq@}L-GC`_JRuHUmfh}6&7b2#uQrK!
zAURX=^VBp=Un^kySvmaSX}~e3S&O&l9%s0%MK4{Y6ceh+dxmF~d8F?1L;hGsIMQ)t
zsrYhY&F>Yu2N=7^q>9%J>fYC*{X4m+UA}qZ!^9~Dnqw&@E%$*wv|j?EV9I}D${Vr;
z0Cy`z%6nreL+MXZ5t4o|Xb(JxRaHI=S}NB>~6*ms@vlwzDzv
zap--+odOyl=>sg{M>gk6{RqMd|2#K^%cmszUlF@Fd>ZA$J5I14Gf`0rtv;B!&^2>dm5fu2;rd*eZ7gT6BEsp3s^~?4wC{vPX^=>dF4v9SO
z;(!u;5F$d^53rZZUJ)ZE1H08<=Y^Cr$_&&Z-P}#&3HdvQk8WNVtoL;YudolE*{eVU
zzbK$3YFre!JC{#Mr2*fiIikVAc<7mLmYp`h%lcu&!!}pEPBjxz@w3Xvo5B?cR81dL
zy~py9i;`SdB?CuuM_0PO?!u53jvpY#ETfc0h{c_Fdeedlk-^T2V83iw-(nadRb6>J
zPoh#OhmvX`RO?)<2;^`}(i7GO0hVq|anAIKrjD?pb@{`O!lL11G;_b<&88n7=i^T3
z_{y^~Mff)JIIuXnZ~WqVRl}6vwB*f-uN-vXJI)G#gj3(t2-w{(KH-nmI~GleoT%^6
zxz1An8o;TQagn57*Wde8#1ZqU;Q=&fJE{Yz7Q)wkLC%1cKOfo2Q%DD7LMri%Y?ZXi
z<&!{mcYPQMANk~O+an?Y-tfK*t`w#PxrsTpFe*5g?e6puRO0xaM0E}h!<_p+Km3mo
z{$KNi8<>gsYrnp~t8Z#z;NW=P-hS~Bz(2gGa!Q(7@V@8Mr-xG0%-*K=JjQJ2V5M<8
z*uWP8cAMkJbb%!EbEzRbutfj*0g&rVBEXFMjEot+($$OV{8qbG5)^_8S7
zT-O(aZB>`n&=7j^Tr0!(LVHe^l__bkV;Y9sUqw|_(x03oI8hSHv=b?w
z-`{Dfs;TXLQ_;|n?A`6$LxAMhj)Wvio~P&Fcy@r`H0*C9HRatqW)_w+U<654_+n%*
z_f-aRGtfUK(%AhN>EWg4C$Yj_VDx+U?(Myt`f6aGiHV6^>#I|YSZ}GzT9k*X^mxF^
zrKzXS=qDy7&h?`^0p&xlJ-WclYw|6XSx86-4iy&{r_{5vy=ijq-pj(msL!9zBReOK
za*|<%$M^5V10pAKsX93D#|qmsvay8{g~AseJP_{e?EGNWAJ^4&TVCO#s=9hD1
zVNXJ=@CyJr_)?~qXGMjpjjioEJ6LeMGlzhTjLf`$M-10a{f2Q*-Qncpd(L^MF!=fN
zdht}nXnq4j!}*yaO%vogQK7KOxBJn8&F>U~YVo{&3_MS|Bje86;6b_8atyT6KwF&C>}Y!;W*);^P@
zBpOLiNchMzMOFDM7gx|&yhoriE;RHphL0dc4z7HiL|##GD3n_8eY`jAgW!p_W`oaR
zq`qdo!V&1-2MAUcv8}DGa5#T0L|(owSw%;uS&~RpZgoaNe`A2
z>{dM{+KGJhX#d%(FY1yZ-2e8`)U>p943jLaB!so?=%ved?$FrV+c!oo8Vfse>J8Va
zxZ)-!O))7#zg-S@4g8%(*zV_0@%D=F&3Cu4@P)&Ce7TqAKE>D9*N=t*pfG^d&LaqF
z{a})8+bmk9J5-|x%V8{XoE^PZxV_SyKb5WEv^G$nb-!HNRV7JLB-UkS{rDLHOTE@a
z(#{eW0Z@9{J37D_WsQu^(iwuQxV|VXybViP7lie}drW&bSt1JoC&t#3-~MQ+SP{&?
zrrYj;OB%YC~W6Md9ZFeoO5`p^mLPg%8rx_!m#uC!LgS$=&b
zF7px)>$<&#%RL^ubOoz@{iIMaQRr-W$SEicP31HXYxWoV^%gnunzqZ;1kuU%R6J46
zaa}($_+VwKyerr0c&IIo{5v|}B-dyb1s78m6Y2+pSWIjsJJWp7lHQR9o6UzueOmzu}pTxJZ%
zTNuo{mQDcp4BV~%^2M;qXCQ!*C+3x;_x<_m2x7;vSV!w>vIrjIrpl?llIVQ>K&t9z
z0`3v{qAn}%VTodCE;9uY@bUL1Z6fTqKY0CzPhckeuc@g?D=HpG5fTFakdoTv4Uv>0
z*Q#C>K-ISXa-uESy7G9x?1u40j~&v+_+5O0%IS~&<)v=l3=9%&d#r0OfMo_bi|6*c
zujGhme6$o5=yM`PzjZ#WFUH^9*P#=CupJ@W&EhLpn&U)o6|Ec}jC){;mt(9`$>p&=
zOKsbDZe^;o@^z3{%`<^MDMLeMYmc?ck{H`2jjCtVLQjz~(lvNZ+Rg^ST0%WGKWeTw
z=#Z0i
zT)JO~?^?SrgvMu?b#N+)OrIKUT<6_8(Rvn-XI>7|T`JeJpU@Nj$Tg#g6>&_?$_g2%
z^tS%Or_STLb`5~Dv)K7)(4`9z@ms^jH`LV^b@{FOF6-*zef##!Zl));+p6ptU?=&$%9up8{vrac2~ao_|V2CvR!V87*Kn
z5F$GYw%ZDT=p{LHY`poKdb82g51tQZ9pTy8HUJ`DEIw|(P}kO|_g=50n;C%vWVEdC
zB0a~-syp2!;Nvoxa!||m%g6NzWh>+Mw;@ygW%1xvKfBDzDj|H=F}pjnWr^wO0lN;o
zTqQRef0oOVc9iXgq-%bR`w}g14aknxg9j&IDKFo@_w*8(S>ti+nb+qm+ls!lyTvGW
z6+q&;R=6vf=ginHFF*!cb+ynSCMYH1P*xBg^0!7>#k*hRt?VerjvE{-o
zIallPAp3CM@vHm%d2sRVyLaH_{Y>QkfPvWaxFxdt3-v4^v9XFhTkAoKgZ^CBT_(vV
z9Y-VEG_nTC#I9;<(>7mPr10|-ChbU3W#KGY(vu0KE=R}fvFjcc#bO$=2soF8NcedzXwy8{);;}9ucN4bhU!JVvotV!3>^DNzh${z=vwcK1;
zU1vnlEM&WL708pdy7oFpIG0YjVZ@zB7#h>#$B!2;HW@7}E+U-qkdl@@*!{5#sE8~B
z96z^yjU5TC+Y(Qls|_B(32J)Ft`EFG9Ef;rh6&G~KMzi}2+qdVSzyaz{rJ%FVLvv`
zp~om8YFZXNYg3MIiV-3rrNGB?>|0j_6Wp8ppSL
z&iUp4%FtPOW~KGH^-Xn^{lxXES$9VPpb(eVhxZQxC8Fdtx_B54p9Mma_KoJpjIBWm
zM;urVpff`I!9mren8wFMVp1q;Edn_zj_?|Jz6sEhzz0~Q|P!-t@iKAqMPT#Da}jp
z8f(`hz;5=~nGFjI!_7@w=_qJH7>I9t<){L8vz{p!vz^Ksavt{62!s$#zm-m#ujg=Yb~_>)aGt_lXrE$V2Cr
z+M2oTCr#LI%~6Oox~=vqK;H5x+MID&+n${rszh{${m$*H6>ZAmmF+3XS$E5IfDm-8
zOm{nv#eQl3{(au$TYEdo)xYVr7SL;KhFaRqt5Fvp=KJ{_31`=khmZw6VAPuEd+O9M
z?}H_tQxv<;iMq->#FOJ52)}vL?b{9B1n3Z%&)Xc+gghmx5Y~`CkreIg0%jfWEuuI;
zaN?y!ciz<)!MI$rj*$DnSk5ZNRGhIY#`Y)*^vVJ4vMyVz&di@oHS^tUi>JN&C8}e*
zEBB~=O+b=PS?Q&PI<2Nlw!+q-EXu>3#_>!5*z;9tH*UPY_f^j_e?SBrlh|?Mjrv@R
zWYEcv@FF0;GC&c6)fb|hr}eTZ=|&bB%IbRx7JXa>o<#h}x8|6bn1B^MEH1tz7PNN^
z+taf?A~X5=6CIgc)|tiGxJ);T)7Hr0Q1&2Ij=6#^IrTp7;__yHf9;zHZHXQL;L0ez
zOyZ{u2M#T<%zS!yAjWl}W4z^+C=krSZ|dsAj@=gGM(7Ad7V4OMezm+ha5zYGMbPYf
zadi}*RTh}vZbnOvot$ar(a|O*Ha7o!2N)Zii(Pa7Fd)*+X>HFmWIz~aIkCveg0X}|HPXsmeB%z-p#x~mHe|E0$%d$478Q-n-`-rcg>yy}FFie>
zw3HS~@arLonAP0OSa}o~%9rL(J$v@73X*0#HuNkB%2TYIJ8X1IlWA$^IC_;T5~LO6
z#^EgJmez)pTiXF=j!_GG=DTliWI0R=lb~FVT&QAhpi=JE`@0N>H&!##`kqFPQ7bSwh=a>lkU12>*$wA@zV>C~
z)RwZI*U>0gP}6puH$=y>vGHIKXrfXD;sdj8vxi6?tjS_TCQ(j(~T1oUezk~E3$>Im*`c?>*O65qaP)D)u#
zUsjy%Es985ndw#dP3;W~44^ufR&`mOd6R;}T_;&surW!^$Oug8`d}hik!R6;&$K(w
z0`tM7?I{R5$jZPxUR(8xK`hjH9Uj6u4Ts43nzbbzKMZAMf@-po>kC*o9<%EUa4c0F
z9c9%wZ{F;=!(RM?iAcKgEF>$C{Zm1Z0Qx6(RqdNtRBC1>3j^?v(#>8g+g^M1P*_(5
z2p8)wqpeDxK%I(!1v2*47u<1&Noz>eRaD9$vdbZF$VBs7$c?wBkfO@A@`LF&zkmCc
z8e=5is6w8`;7fdBVLd-7p`k&=%F23-vL#+;dy?}IkysSO_lxQ7{;|An_r@_mj>FU4
zA72+2Q-ko}=8O#eJT<`!lFn>a8%S4RTGmG*V{!7YQZg~ZZ1)u
z8ya3KMqe64agy^wZ2OpH;e^a!pS#O}vaOL!=jCr|P&Gr@>VHw~&YdsoV>)&A9d6#f
zq%7Qa<0osLiNsYBi3jjoblvZF+buuJwe%(-;gQ$Y7AH!HLAE>V6gIu~{knryhmX++
zdszIQP(*fleAa|5Ubv>ZC0vum#Gw>FODd)#fg$)gkIGP})D
zOKr;z_yP*aL<2Eowy6N#QW;az^M@m}Y=r*)8$z2&wlwEAW;%FIdV8MGLqV3%NoP3nHQ6P@F@B9J9iX&
zpqQ+HB<|}nl~oJk82!w1^_w_u!_Nj$QT)?(Mqi@p8za?8KqeY%2R-K%=#5J=z5e+%
zH8S5bJ)%=n&yzeoL38B_1h?eVW20@i^UQ?~8^_G^Rd8blN;hW=p+-T)>5-#H*VvIE
zy%w9xf^~K`ETNKB0*AeK9yCG3eJSoN*~6tOwpVvU*fO`sWod(5pBO)WQkjI>$
ze!^Uhybzg$2q2)*1>4c*iOI>fU!`@%68uY>Al2mW?ugrrJntW@VtO
zBau!L=$|3Mp`n$sz6m~FVPU7lU(&}1*?v^7537*Ol6j6zd#
zUCQfPTk7xzr&yD+`vOy;{jbkWu|@e?3kp~)mSG0&uMesLqM;ZB9-FhfqE@8^Pji~Z
zLV;r~ns5LzL%4p0D&x@c({-fEjrub^&d2D)0!Wo!T