@certd/plugin-cert 1.24.0 → 1.24.1

package/dist/plugin/cert-plugin/acme.js

@@ -1,242 +1,266 @@
-// @ts-ignore
-import * as acme from "@certd/acme-client";
-import _ from "lodash-es";
-import psl from "psl";
-export class AcmeService {
-    options;
-    userContext;
-    logger;
-    sslProvider;
-    skipLocalVerify = true;
-    eab;
-    constructor(options) {
-        this.options = options;
-        this.userContext = options.userContext;
-        this.logger = options.logger;
-        this.sslProvider = options.sslProvider || "letsencrypt";
-        this.eab = options.eab;
-        this.skipLocalVerify = options.skipLocalVerify ?? false;
-        acme.setLogger((text) => {
-            this.logger.info(text);
-        });
-    }
-    async getAccountConfig(email, urlMapping) {
-        const conf = (await this.userContext.getObj(this.buildAccountKey(email))) || {};
-        if (urlMapping && urlMapping.mappings) {
-            for (const key in urlMapping.mappings) {
-                if (Object.prototype.hasOwnProperty.call(urlMapping.mappings, key)) {
-                    const element = urlMapping.mappings[key];
-                    if (conf.accountUrl?.indexOf(element) > -1) {
-                        //如果用了代理url，要替换回去
-                        conf.accountUrl = conf.accountUrl.replace(element, key);
-                    }
-                }
-            }
-        }
-        return conf;
-    }
-    buildAccountKey(email) {
-        return `acme.config.${this.sslProvider}.${email}`;
-    }
-    async saveAccountConfig(email, conf) {
-        await this.userContext.setObj(this.buildAccountKey(email), conf);
-    }
-    async getAcmeClient(email, isTest = false) {
-        const urlMapping = {
-            enabled: false,
-            mappings: {
-                "acme-v02.api.letsencrypt.org": "letsencrypt.proxy.handsfree.work",
-                "dv.acme-v02.api.pki.goog": "google.proxy.handsfree.work",
-            },
-        };
-        const conf = await this.getAccountConfig(email, urlMapping);
-        if (conf.key == null) {
-            conf.key = await this.createNewKey();
-            await this.saveAccountConfig(email, conf);
-        }
-        let directoryUrl = "";
-        if (isTest) {
-            directoryUrl = acme.directory[this.sslProvider].staging;
-        }
-        else {
-            directoryUrl = acme.directory[this.sslProvider].production;
-        }
-        if (this.options.useMappingProxy) {
-            urlMapping.enabled = true;
-        }
-        const client = new acme.Client({
-            directoryUrl: directoryUrl,
-            accountKey: conf.key,
-            accountUrl: conf.accountUrl,
-            externalAccountBinding: this.eab,
-            backoffAttempts: 15,
-            backoffMin: 5000,
-            backoffMax: 10000,
-            urlMapping,
-            signal: this.options.signal,
-        });
-        if (conf.accountUrl == null) {
-            const accountPayload = {
-                termsOfServiceAgreed: true,
-                contact: [`mailto:${email}`],
-                externalAccountBinding: this.eab,
-            };
-            await client.createAccount(accountPayload);
-            conf.accountUrl = client.getAccountUrl();
-            await this.saveAccountConfig(email, conf);
-        }
-        return client;
-    }
-    async createNewKey() {
-        const key = await acme.forge.createPrivateKey();
-        return key.toString();
-    }
-    parseDomain(fullDomain) {
-        const parsed = psl.parse(fullDomain);
-        if (parsed.error) {
-            throw new Error(`解析${fullDomain}域名失败:` + JSON.stringify(parsed.error));
-        }
-        return parsed.domain;
-    }
-    async challengeCreateFn(authz, challenge, keyAuthorization, dnsProvider) {
-        this.logger.info("Triggered challengeCreateFn()");
-        /* http-01 */
-        const fullDomain = authz.identifier.value;
-        if (challenge.type === "http-01") {
-            const filePath = `/var/www/html/.well-known/acme-challenge/${challenge.token}`;
-            const fileContents = keyAuthorization;
-            this.logger.info(`Creating challenge response for ${fullDomain} at path: ${filePath}`);
-            /* Replace this */
-            this.logger.info(`Would write "${fileContents}" to path "${filePath}"`);
-            // await fs.writeFileAsync(filePath, fileContents);
-        }
-        else if (challenge.type === "dns-01") {
-            /* dns-01 */
-            const dnsRecord = `_acme-challenge.${fullDomain}`;
-            const recordValue = keyAuthorization;
-            this.logger.info(`Creating TXT record for ${fullDomain}: ${dnsRecord}`);
-            /* Replace this */
-            this.logger.info(`Would create TXT record "${dnsRecord}" with value "${recordValue}"`);
-            const domain = this.parseDomain(fullDomain);
-            this.logger.info("解析到域名domain=", domain);
-            return await dnsProvider.createRecord({
-                fullRecord: dnsRecord,
-                type: "TXT",
-                value: recordValue,
-                domain,
-            });
-        }
-    }
-    /**
-     * Function used to remove an ACME challenge response
-     *
-     * @param {object} authz Authorization object
-     * @param {object} challenge Selected challenge
-     * @param {string} keyAuthorization Authorization key
-     * @param recordItem  challengeCreateFn create record item
-     * @param dnsProvider dnsProvider
-     * @returns {Promise}
-     */
-    async challengeRemoveFn(authz, challenge, keyAuthorization, recordItem, dnsProvider) {
-        this.logger.info("Triggered challengeRemoveFn()");
-        /* http-01 */
-        const fullDomain = authz.identifier.value;
-        if (challenge.type === "http-01") {
-            const filePath = `/var/www/html/.well-known/acme-challenge/${challenge.token}`;
-            this.logger.info(`Removing challenge response for ${fullDomain} at path: ${filePath}`);
-            /* Replace this */
-            this.logger.info(`Would remove file on path "${filePath}"`);
-            // await fs.unlinkAsync(filePath);
-        }
-        else if (challenge.type === "dns-01") {
-            const dnsRecord = `_acme-challenge.${fullDomain}`;
-            const recordValue = keyAuthorization;
-            this.logger.info(`Removing TXT record for ${fullDomain}: ${dnsRecord}`);
-            /* Replace this */
-            this.logger.info(`Would remove TXT record "${dnsRecord}" with value "${recordValue}"`);
-            const domain = this.parseDomain(fullDomain);
-            try {
-                await dnsProvider.removeRecord({
-                    fullRecord: dnsRecord,
-                    type: "TXT",
-                    value: keyAuthorization,
-                    record: recordItem,
-                    domain,
-                });
-            }
-            catch (e) {
-                this.logger.error("删除解析记录出错：", e);
-                throw e;
-            }
-        }
-    }
-    async order(options) {
-        const { email, isTest, domains, csrInfo, dnsProvider } = options;
-        const client = await this.getAcmeClient(email, isTest);
-        /* Create CSR */
-        const { commonName, altNames } = this.buildCommonNameByDomains(domains);
-        let privateKey = null;
-        const privateKeyType = options.privateKeyType || "rsa_2048";
-        const privateKeyArr = privateKeyType.split("_");
-        const type = privateKeyArr[0];
-        const size = parseInt(privateKeyArr[1]);
-        if (type == "ec") {
-            const name = "P-" + size;
-            privateKey = await acme.crypto.createPrivateEcdsaKey(name);
-        }
-        else {
-            privateKey = await acme.crypto.createPrivateRsaKey(size);
-        }
-        const [key, csr] = await acme.crypto.createCsr({
-            commonName,
-            ...csrInfo,
-            altNames,
-        }, privateKey);
-        if (dnsProvider == null) {
-            throw new Error("dnsProvider 不能为空");
-        }
-        /* 自动申请证书 */
-        const crt = await client.auto({
-            csr,
-            email: email,
-            termsOfServiceAgreed: true,
-            skipChallengeVerification: this.skipLocalVerify,
-            challengePriority: ["dns-01"],
-            challengeCreateFn: async (authz, challenge, keyAuthorization) => {
-                return await this.challengeCreateFn(authz, challenge, keyAuthorization, dnsProvider);
-            },
-            challengeRemoveFn: async (authz, challenge, keyAuthorization, recordItem) => {
-                return await this.challengeRemoveFn(authz, challenge, keyAuthorization, recordItem, dnsProvider);
-            },
-            signal: this.options.signal,
-        });
-        const cert = {
-            crt: crt.toString(),
-            key: key.toString(),
-            csr: csr.toString(),
-        };
-        /* Done */
-        this.logger.debug(`CSR:\n${cert.csr}`);
-        this.logger.debug(`Certificate:\n${cert.crt}`);
-        this.logger.info("证书申请成功");
-        return cert;
-    }
-    buildCommonNameByDomains(domains) {
-        if (typeof domains === "string") {
-            domains = domains.split(",");
-        }
-        if (domains.length === 0) {
-            throw new Error("domain can not be empty");
-        }
-        const commonName = domains[0];
-        let altNames = undefined;
-        if (domains.length > 1) {
-            altNames = _.slice(domains, 1);
-        }
-        return {
-            commonName,
-            altNames,
-        };
-    }
-}
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9wbHVnaW4vY2VydC1wbHVnaW4vYWNtZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxhQUFhO0FBQ2IsT0FBTyxLQUFLLElBQUksTUFBTSxvQkFBb0IsQ0FBQztBQUMzQyxPQUFPLENBQUMsTUFBTSxXQUFXLENBQUM7QUFLMUIsT0FBTyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBcUJ0QixNQUFNLE9BQU8sV0FBVztJQUN0QixPQUFPLENBQXFCO0lBQzVCLFdBQVcsQ0FBVztJQUN0QixNQUFNLENBQVM7SUFDZixXQUFXLENBQWM7SUFDekIsZUFBZSxHQUFHLElBQUksQ0FBQztJQUN2QixHQUFHLENBQXVDO0lBQzFDLFlBQVksT0FBMkI7UUFDckMsSUFBSSxDQUFDLE9BQU8sR0FBRyxPQUFPLENBQUM7UUFDdkIsSUFBSSxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ3ZDLElBQUksQ0FBQyxNQUFNLEdBQUcsT0FBTyxDQUFDLE1BQU0sQ0FBQztRQUM3QixJQUFJLENBQUMsV0FBVyxHQUFHLE9BQU8sQ0FBQyxXQUFXLElBQUksYUFBYSxDQUFDO1FBQ3hELElBQUksQ0FBQyxHQUFHLEdBQUcsT0FBTyxDQUFDLEdBQUcsQ0FBQztRQUN2QixJQUFJLENBQUMsZUFBZSxHQUFHLE9BQU8sQ0FBQyxlQUFlLElBQUksS0FBSyxDQUFDO1FBQ3hELElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxJQUFZLEVBQUUsRUFBRTtZQUM5QixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUN6QixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCxLQUFLLENBQUMsZ0JBQWdCLENBQUMsS0FBYSxFQUFFLFVBQXNCO1FBQzFELE1BQU0sSUFBSSxHQUFHLENBQUMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7UUFDaEYsSUFBSSxVQUFVLElBQUksVUFBVSxDQUFDLFFBQVEsRUFBRTtZQUNyQyxLQUFLLE1BQU0sR0FBRyxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUU7Z0JBQ3JDLElBQUksTUFBTSxDQUFDLFNBQVMsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLEVBQUUsR0FBRyxDQUFDLEVBQUU7b0JBQ2xFLE1BQU0sT0FBTyxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLENBQUM7b0JBQ3pDLElBQUksSUFBSSxDQUFDLFVBQVUsRUFBRSxPQUFPLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEVBQUU7d0JBQzFDLGlCQUFpQjt3QkFDakIsSUFBSSxDQUFDLFVBQVUsR0FBRyxJQUFJLENBQUMsVUFBVSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsR0FBRyxDQUFDLENBQUM7cUJBQ3pEO2lCQUNGO2FBQ0Y7U0FDRjtRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztJQUVELGVBQWUsQ0FBQyxLQUFhO1FBQzNCLE9BQU8sZUFBZSxJQUFJLENBQUMsV0FBVyxJQUFJLEtBQUssRUFBRSxDQUFDO0lBQ3BELENBQUM7SUFFRCxLQUFLLENBQUMsaUJBQWlCLENBQUMsS0FBYSxFQUFFLElBQVM7UUFDOUMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLEtBQUssQ0FBQyxFQUFFLElBQUksQ0FBQyxDQUFDO0lBQ25FLENBQUM7SUFFRCxLQUFLLENBQUMsYUFBYSxDQUFDLEtBQWEsRUFBRSxNQUFNLEdBQUcsS0FBSztRQUMvQyxNQUFNLFVBQVUsR0FBZTtZQUM3QixPQUFPLEVBQUUsS0FBSztZQUNkLFFBQVEsRUFBRTtnQkFDUiw4QkFBOEIsRUFBRSxrQ0FBa0M7Z0JBQ2xFLDBCQUEwQixFQUFFLDZCQUE2QjthQUMxRDtTQUNGLENBQUM7UUFDRixNQUFNLElBQUksR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxLQUFLLEVBQUUsVUFBVSxDQUFDLENBQUM7UUFDNUQsSUFBSSxJQUFJLENBQUMsR0FBRyxJQUFJLElBQUksRUFBRTtZQUNwQixJQUFJLENBQUMsR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxJQUFJLENBQUMsQ0FBQztTQUMzQztRQUNELElBQUksWUFBWSxHQUFHLEVBQUUsQ0FBQztRQUN0QixJQUFJLE1BQU0sRUFBRTtZQUNWLFlBQVksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxPQUFPLENBQUM7U0FDekQ7YUFBTTtZQUNMLFlBQVksR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsQ0FBQyxVQUFVLENBQUM7U0FDNUQ7UUFDRCxJQUFJLElBQUksQ0FBQyxPQUFPLENBQUMsZUFBZSxFQUFFO1lBQ2hDLFVBQVUsQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1NBQzNCO1FBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQzdCLFlBQVksRUFBRSxZQUFZO1lBQzFCLFVBQVUsRUFBRSxJQUFJLENBQUMsR0FBRztZQUNwQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7WUFDM0Isc0JBQXNCLEVBQUUsSUFBSSxDQUFDLEdBQUc7WUFDaEMsZUFBZSxFQUFFLEVBQUU7WUFDbkIsVUFBVSxFQUFFLElBQUk7WUFDaEIsVUFBVSxFQUFFLEtBQUs7WUFDakIsVUFBVTtZQUNWLE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU07U0FDNUIsQ0FBQyxDQUFDO1FBRUgsSUFBSSxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksRUFBRTtZQUMzQixNQUFNLGNBQWMsR0FBRztnQkFDckIsb0JBQW9CLEVBQUUsSUFBSTtnQkFDMUIsT0FBTyxFQUFFLENBQUMsVUFBVSxLQUFLLEVBQUUsQ0FBQztnQkFDNUIsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLEdBQUc7YUFDakMsQ0FBQztZQUNGLE1BQU0sTUFBTSxDQUFDLGFBQWEsQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUMzQyxJQUFJLENBQUMsVUFBVSxHQUFHLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN6QyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7U0FDM0M7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsS0FBSyxDQUFDLFlBQVk7UUFDaEIsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDaEQsT0FBTyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVELFdBQVcsQ0FBQyxVQUFrQjtRQUM1QixNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBcUIsQ0FBQztRQUN6RCxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUU7WUFDaEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxLQUFLLFVBQVUsT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7U0FDeEU7UUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFnQixDQUFDO0lBQ2pDLENBQUM7SUFDRCxLQUFLLENBQUMsaUJBQWlCLENBQUMsS0FBVSxFQUFFLFNBQWMsRUFBRSxnQkFBd0IsRUFBRSxXQUF5QjtRQUNyRyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBRWxELGFBQWE7UUFDYixNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztRQUMxQyxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFO1lBQ2hDLE1BQU0sUUFBUSxHQUFHLDRDQUE0QyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDL0UsTUFBTSxZQUFZLEdBQUcsZ0JBQWdCLENBQUM7WUFFdEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUNBQW1DLFVBQVUsYUFBYSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBRXZGLGtCQUFrQjtZQUNsQixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsWUFBWSxjQUFjLFFBQVEsR0FBRyxDQUFDLENBQUM7WUFDeEUsbURBQW1EO1NBQ3BEO2FBQU0sSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRTtZQUN0QyxZQUFZO1lBQ1osTUFBTSxTQUFTLEdBQUcsbUJBQW1CLFVBQVUsRUFBRSxDQUFDO1lBQ2xELE1BQU0sV0FBVyxHQUFHLGdCQUFnQixDQUFDO1lBRXJDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixVQUFVLEtBQUssU0FBUyxFQUFFLENBQUMsQ0FBQztZQUN4RSxrQkFBa0I7WUFDbEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsNEJBQTRCLFNBQVMsaUJBQWlCLFdBQVcsR0FBRyxDQUFDLENBQUM7WUFFdkYsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUM1QyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDekMsT0FBTyxNQUFNLFdBQVcsQ0FBQyxZQUFZLENBQUM7Z0JBQ3BDLFVBQVUsRUFBRSxTQUFTO2dCQUNyQixJQUFJLEVBQUUsS0FBSztnQkFDWCxLQUFLLEVBQUUsV0FBVztnQkFDbEIsTUFBTTthQUNQLENBQUMsQ0FBQztTQUNKO0lBQ0gsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUVILEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxLQUFVLEVBQUUsU0FBYyxFQUFFLGdCQUF3QixFQUFFLFVBQWUsRUFBRSxXQUF5QjtRQUN0SCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBRWxELGFBQWE7UUFDYixNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztRQUMxQyxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFO1lBQ2hDLE1BQU0sUUFBUSxHQUFHLDRDQUE0QyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFFL0UsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUNBQW1DLFVBQVUsYUFBYSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBRXZGLGtCQUFrQjtZQUNsQixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBOEIsUUFBUSxHQUFHLENBQUMsQ0FBQztZQUM1RCxrQ0FBa0M7U0FDbkM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFO1lBQ3RDLE1BQU0sU0FBUyxHQUFHLG1CQUFtQixVQUFVLEVBQUUsQ0FBQztZQUNsRCxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztZQUVyQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFFeEUsa0JBQWtCO1lBQ2xCLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDRCQUE0QixTQUFTLGlCQUFpQixXQUFXLEdBQUcsQ0FBQyxDQUFDO1lBRXZGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7WUFFNUMsSUFBSTtnQkFDRixNQUFNLFdBQVcsQ0FBQyxZQUFZLENBQUM7b0JBQzdCLFVBQVUsRUFBRSxTQUFTO29CQUNyQixJQUFJLEVBQUUsS0FBSztvQkFDWCxLQUFLLEVBQUUsZ0JBQWdCO29CQUN2QixNQUFNLEVBQUUsVUFBVTtvQkFDbEIsTUFBTTtpQkFDUCxDQUFDLENBQUM7YUFDSjtZQUFDLE9BQU8sQ0FBQyxFQUFFO2dCQUNWLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztnQkFDbEMsTUFBTSxDQUFDLENBQUM7YUFDVDtTQUNGO0lBQ0gsQ0FBQztJQUVELEtBQUssQ0FBQyxLQUFLLENBQUMsT0FPWDtRQUNDLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLEdBQUcsT0FBTyxDQUFDO1FBQ2pFLE1BQU0sTUFBTSxHQUFnQixNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBRXBFLGdCQUFnQjtRQUNoQixNQUFNLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4RSxJQUFJLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDdEIsTUFBTSxjQUFjLEdBQUcsT0FBTyxDQUFDLGNBQWMsSUFBSSxVQUFVLENBQUM7UUFDNUQsTUFBTSxhQUFhLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNoRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDOUIsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hDLElBQUksSUFBSSxJQUFJLElBQUksRUFBRTtZQUNoQixNQUFNLElBQUksR0FBUSxJQUFJLEdBQUcsSUFBSSxDQUFDO1lBQzlCLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLENBQUM7U0FDNUQ7YUFBTTtZQUNMLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUM7U0FDMUQ7UUFDRCxNQUFNLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQzVDO1lBQ0UsVUFBVTtZQUNWLEdBQUcsT0FBTztZQUNWLFFBQVE7U0FDVCxFQUNELFVBQVUsQ0FDWCxDQUFDO1FBQ0YsSUFBSSxXQUFXLElBQUksSUFBSSxFQUFFO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQztTQUNyQztRQUNELFlBQVk7UUFDWixNQUFNLEdBQUcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFDNUIsR0FBRztZQUNILEtBQUssRUFBRSxLQUFLO1lBQ1osb0JBQW9CLEVBQUUsSUFBSTtZQUMxQix5QkFBeUIsRUFBRSxJQUFJLENBQUMsZUFBZTtZQUMvQyxpQkFBaUIsRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUM3QixpQkFBaUIsRUFBRSxLQUFLLEVBQUUsS0FBeUIsRUFBRSxTQUFvQixFQUFFLGdCQUF3QixFQUFnQixFQUFFO2dCQUNuSCxPQUFPLE1BQU0sSUFBSSxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLENBQUM7WUFDdkYsQ0FBQztZQUNELGlCQUFpQixFQUFFLEtBQUssRUFBRSxLQUF5QixFQUFFLFNBQW9CLEVBQUUsZ0JBQXdCLEVBQUUsVUFBZSxFQUFnQixFQUFFO2dCQUNwSSxPQUFPLE1BQU0sSUFBSSxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1lBQ25HLENBQUM7WUFDRCxNQUFNLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNO1NBQzVCLENBQUMsQ0FBQztRQUVILE1BQU0sSUFBSSxHQUFhO1lBQ3JCLEdBQUcsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFO1lBQ25CLEdBQUcsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFO1lBQ25CLEdBQUcsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFO1NBQ3BCLENBQUM7UUFDRixVQUFVO1FBQ1YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDL0MsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDM0IsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsd0JBQXdCLENBQUMsT0FBMEI7UUFJakQsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRLEVBQUU7WUFDL0IsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7U0FDOUI7UUFDRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFO1lBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQztTQUM1QztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM5QixJQUFJLFFBQVEsR0FBeUIsU0FBUyxDQUFDO1FBQy9DLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUU7WUFDdEIsUUFBUSxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO1NBQ2hDO1FBQ0QsT0FBTztZQUNMLFVBQVU7WUFDVixRQUFRO1NBQ1QsQ0FBQztJQUNKLENBQUM7Q0FDRiJ9
+// @ts-ignore
+import * as acme from "@certd/acme-client";
+import _ from "lodash-es";
+import psl from "psl";
+import { utils } from "@certd/pipeline";
+export class AcmeService {
+    options;
+    userContext;
+    logger;
+    sslProvider;
+    skipLocalVerify = true;
+    eab;
+    constructor(options) {
+        this.options = options;
+        this.userContext = options.userContext;
+        this.logger = options.logger;
+        this.sslProvider = options.sslProvider || "letsencrypt";
+        this.eab = options.eab;
+        this.skipLocalVerify = options.skipLocalVerify ?? false;
+        acme.setLogger((text) => {
+            this.logger.info(text);
+        });
+    }
+    async getAccountConfig(email, urlMapping) {
+        const conf = (await this.userContext.getObj(this.buildAccountKey(email))) || {};
+        if (urlMapping && urlMapping.mappings) {
+            for (const key in urlMapping.mappings) {
+                if (Object.prototype.hasOwnProperty.call(urlMapping.mappings, key)) {
+                    const element = urlMapping.mappings[key];
+                    if (conf.accountUrl?.indexOf(element) > -1) {
+                        //如果用了代理url，要替换回去
+                        conf.accountUrl = conf.accountUrl.replace(element, key);
+                    }
+                }
+            }
+        }
+        return conf;
+    }
+    buildAccountKey(email) {
+        return `acme.config.${this.sslProvider}.${email}`;
+    }
+    async saveAccountConfig(email, conf) {
+        await this.userContext.setObj(this.buildAccountKey(email), conf);
+    }
+    async getAcmeClient(email, isTest = false) {
+        const urlMapping = {
+            enabled: false,
+            mappings: {
+                "acme-v02.api.letsencrypt.org": "letsencrypt.proxy.handsfree.work",
+                "dv.acme-v02.api.pki.goog": "google.proxy.handsfree.work",
+            },
+        };
+        const conf = await this.getAccountConfig(email, urlMapping);
+        if (conf.key == null) {
+            conf.key = await this.createNewKey();
+            await this.saveAccountConfig(email, conf);
+        }
+        let directoryUrl = "";
+        if (isTest) {
+            directoryUrl = acme.directory[this.sslProvider].staging;
+        }
+        else {
+            directoryUrl = acme.directory[this.sslProvider].production;
+        }
+        if (this.options.useMappingProxy) {
+            urlMapping.enabled = true;
+        }
+        else {
+            //测试directory是否可以访问
+            const isOk = await this.testDirectory(directoryUrl);
+            if (!isOk) {
+                this.logger.info("测试访问失败，自动使用代理");
+                urlMapping.enabled = true;
+            }
+        }
+        const client = new acme.Client({
+            directoryUrl: directoryUrl,
+            accountKey: conf.key,
+            accountUrl: conf.accountUrl,
+            externalAccountBinding: this.eab,
+            backoffAttempts: 15,
+            backoffMin: 5000,
+            backoffMax: 10000,
+            urlMapping,
+            signal: this.options.signal,
+        });
+        if (conf.accountUrl == null) {
+            const accountPayload = {
+                termsOfServiceAgreed: true,
+                contact: [`mailto:${email}`],
+                externalAccountBinding: this.eab,
+            };
+            await client.createAccount(accountPayload);
+            conf.accountUrl = client.getAccountUrl();
+            await this.saveAccountConfig(email, conf);
+        }
+        return client;
+    }
+    async createNewKey() {
+        const key = await acme.forge.createPrivateKey();
+        return key.toString();
+    }
+    parseDomain(fullDomain) {
+        const parsed = psl.parse(fullDomain);
+        if (parsed.error) {
+            throw new Error(`解析${fullDomain}域名失败:` + JSON.stringify(parsed.error));
+        }
+        return parsed.domain;
+    }
+    async challengeCreateFn(authz, challenge, keyAuthorization, dnsProvider) {
+        this.logger.info("Triggered challengeCreateFn()");
+        /* http-01 */
+        const fullDomain = authz.identifier.value;
+        if (challenge.type === "http-01") {
+            const filePath = `/var/www/html/.well-known/acme-challenge/${challenge.token}`;
+            const fileContents = keyAuthorization;
+            this.logger.info(`Creating challenge response for ${fullDomain} at path: ${filePath}`);
+            /* Replace this */
+            this.logger.info(`Would write "${fileContents}" to path "${filePath}"`);
+            // await fs.writeFileAsync(filePath, fileContents);
+        }
+        else if (challenge.type === "dns-01") {
+            /* dns-01 */
+            const dnsRecord = `_acme-challenge.${fullDomain}`;
+            const recordValue = keyAuthorization;
+            this.logger.info(`Creating TXT record for ${fullDomain}: ${dnsRecord}`);
+            /* Replace this */
+            this.logger.info(`Would create TXT record "${dnsRecord}" with value "${recordValue}"`);
+            const domain = this.parseDomain(fullDomain);
+            this.logger.info("解析到域名domain=", domain);
+            return await dnsProvider.createRecord({
+                fullRecord: dnsRecord,
+                type: "TXT",
+                value: recordValue,
+                domain,
+            });
+        }
+    }
+    /**
+     * Function used to remove an ACME challenge response
+     *
+     * @param {object} authz Authorization object
+     * @param {object} challenge Selected challenge
+     * @param {string} keyAuthorization Authorization key
+     * @param recordItem  challengeCreateFn create record item
+     * @param dnsProvider dnsProvider
+     * @returns {Promise}
+     */
+    async challengeRemoveFn(authz, challenge, keyAuthorization, recordItem, dnsProvider) {
+        this.logger.info("Triggered challengeRemoveFn()");
+        /* http-01 */
+        const fullDomain = authz.identifier.value;
+        if (challenge.type === "http-01") {
+            const filePath = `/var/www/html/.well-known/acme-challenge/${challenge.token}`;
+            this.logger.info(`Removing challenge response for ${fullDomain} at path: ${filePath}`);
+            /* Replace this */
+            this.logger.info(`Would remove file on path "${filePath}"`);
+            // await fs.unlinkAsync(filePath);
+        }
+        else if (challenge.type === "dns-01") {
+            const dnsRecord = `_acme-challenge.${fullDomain}`;
+            const recordValue = keyAuthorization;
+            this.logger.info(`Removing TXT record for ${fullDomain}: ${dnsRecord}`);
+            /* Replace this */
+            this.logger.info(`Would remove TXT record "${dnsRecord}" with value "${recordValue}"`);
+            const domain = this.parseDomain(fullDomain);
+            try {
+                await dnsProvider.removeRecord({
+                    fullRecord: dnsRecord,
+                    type: "TXT",
+                    value: keyAuthorization,
+                    record: recordItem,
+                    domain,
+                });
+            }
+            catch (e) {
+                this.logger.error("删除解析记录出错：", e);
+                throw e;
+            }
+        }
+    }
+    async order(options) {
+        const { email, isTest, domains, csrInfo, dnsProvider } = options;
+        const client = await this.getAcmeClient(email, isTest);
+        /* Create CSR */
+        const { commonName, altNames } = this.buildCommonNameByDomains(domains);
+        let privateKey = null;
+        const privateKeyType = options.privateKeyType || "rsa_2048";
+        const privateKeyArr = privateKeyType.split("_");
+        const type = privateKeyArr[0];
+        const size = parseInt(privateKeyArr[1]);
+        if (type == "ec") {
+            const name = "P-" + size;
+            privateKey = await acme.crypto.createPrivateEcdsaKey(name);
+        }
+        else {
+            privateKey = await acme.crypto.createPrivateRsaKey(size);
+        }
+        const [key, csr] = await acme.crypto.createCsr({
+            commonName,
+            ...csrInfo,
+            altNames,
+        }, privateKey);
+        if (dnsProvider == null) {
+            throw new Error("dnsProvider 不能为空");
+        }
+        /* 自动申请证书 */
+        const crt = await client.auto({
+            csr,
+            email: email,
+            termsOfServiceAgreed: true,
+            skipChallengeVerification: this.skipLocalVerify,
+            challengePriority: ["dns-01"],
+            challengeCreateFn: async (authz, challenge, keyAuthorization) => {
+                return await this.challengeCreateFn(authz, challenge, keyAuthorization, dnsProvider);
+            },
+            challengeRemoveFn: async (authz, challenge, keyAuthorization, recordItem) => {
+                return await this.challengeRemoveFn(authz, challenge, keyAuthorization, recordItem, dnsProvider);
+            },
+            signal: this.options.signal,
+        });
+        const cert = {
+            crt: crt.toString(),
+            key: key.toString(),
+            csr: csr.toString(),
+        };
+        /* Done */
+        this.logger.debug(`CSR:\n${cert.csr}`);
+        this.logger.debug(`Certificate:\n${cert.crt}`);
+        this.logger.info("证书申请成功");
+        return cert;
+    }
+    buildCommonNameByDomains(domains) {
+        if (typeof domains === "string") {
+            domains = domains.split(",");
+        }
+        if (domains.length === 0) {
+            throw new Error("domain can not be empty");
+        }
+        const commonName = domains[0];
+        let altNames = undefined;
+        if (domains.length > 1) {
+            altNames = _.slice(domains, 1);
+        }
+        return {
+            commonName,
+            altNames,
+        };
+    }
+    async testDirectory(directoryUrl) {
+        try {
+            await utils.http({
+                url: directoryUrl,
+                method: "GET",
+                timeout: 5000,
+            });
+        }
+        catch (e) {
+            this.logger.error(`${directoryUrl}，测试访问失败`, e);
+            return false;
+        }
+        this.logger.info(`${directoryUrl}，测试访问成功`);
+        return true;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiYWNtZS5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3NyYy9wbHVnaW4vY2VydC1wbHVnaW4vYWNtZS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxhQUFhO0FBQ2IsT0FBTyxLQUFLLElBQUksTUFBTSxvQkFBb0IsQ0FBQztBQUMzQyxPQUFPLENBQUMsTUFBTSxXQUFXLENBQUM7QUFLMUIsT0FBTyxHQUFHLE1BQU0sS0FBSyxDQUFDO0FBRXRCLE9BQU8sRUFBRSxLQUFLLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQW1CeEMsTUFBTSxPQUFPLFdBQVc7SUFDdEIsT0FBTyxDQUFxQjtJQUM1QixXQUFXLENBQVc7SUFDdEIsTUFBTSxDQUFTO0lBQ2YsV0FBVyxDQUFjO0lBQ3pCLGVBQWUsR0FBRyxJQUFJLENBQUM7SUFDdkIsR0FBRyxDQUF1QztJQUMxQyxZQUFZLE9BQTJCO1FBQ3JDLElBQUksQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1FBQ3ZCLElBQUksQ0FBQyxXQUFXLEdBQUcsT0FBTyxDQUFDLFdBQVcsQ0FBQztRQUN2QyxJQUFJLENBQUMsTUFBTSxHQUFHLE9BQU8sQ0FBQyxNQUFNLENBQUM7UUFDN0IsSUFBSSxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxJQUFJLGFBQWEsQ0FBQztRQUN4RCxJQUFJLENBQUMsR0FBRyxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUM7UUFDdkIsSUFBSSxDQUFDLGVBQWUsR0FBRyxPQUFPLENBQUMsZUFBZSxJQUFJLEtBQUssQ0FBQztRQUN4RCxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsSUFBWSxFQUFFLEVBQUU7WUFDOUIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDekIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsS0FBSyxDQUFDLGdCQUFnQixDQUFDLEtBQWEsRUFBRSxVQUFzQjtRQUMxRCxNQUFNLElBQUksR0FBRyxDQUFDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1FBQ2hGLElBQUksVUFBVSxJQUFJLFVBQVUsQ0FBQyxRQUFRLEVBQUU7WUFDckMsS0FBSyxNQUFNLEdBQUcsSUFBSSxVQUFVLENBQUMsUUFBUSxFQUFFO2dCQUNyQyxJQUFJLE1BQU0sQ0FBQyxTQUFTLENBQUMsY0FBYyxDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsUUFBUSxFQUFFLEdBQUcsQ0FBQyxFQUFFO29CQUNsRSxNQUFNLE9BQU8sR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxDQUFDO29CQUN6QyxJQUFJLElBQUksQ0FBQyxVQUFVLEVBQUUsT0FBTyxDQUFDLE9BQU8sQ0FBQyxHQUFHLENBQUMsQ0FBQyxFQUFFO3dCQUMxQyxpQkFBaUI7d0JBQ2pCLElBQUksQ0FBQyxVQUFVLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEdBQUcsQ0FBQyxDQUFDO3FCQUN6RDtpQkFDRjthQUNGO1NBQ0Y7UUFDRCxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7SUFFRCxlQUFlLENBQUMsS0FBYTtRQUMzQixPQUFPLGVBQWUsSUFBSSxDQUFDLFdBQVcsSUFBSSxLQUFLLEVBQUUsQ0FBQztJQUNwRCxDQUFDO0lBRUQsS0FBSyxDQUFDLGlCQUFpQixDQUFDLEtBQWEsRUFBRSxJQUFTO1FBQzlDLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsRUFBRSxJQUFJLENBQUMsQ0FBQztJQUNuRSxDQUFDO0lBRUQsS0FBSyxDQUFDLGFBQWEsQ0FBQyxLQUFhLEVBQUUsTUFBTSxHQUFHLEtBQUs7UUFDL0MsTUFBTSxVQUFVLEdBQWU7WUFDN0IsT0FBTyxFQUFFLEtBQUs7WUFDZCxRQUFRLEVBQUU7Z0JBQ1IsOEJBQThCLEVBQUUsa0NBQWtDO2dCQUNsRSwwQkFBMEIsRUFBRSw2QkFBNkI7YUFDMUQ7U0FDRixDQUFDO1FBQ0YsTUFBTSxJQUFJLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsS0FBSyxFQUFFLFVBQVUsQ0FBQyxDQUFDO1FBQzVELElBQUksSUFBSSxDQUFDLEdBQUcsSUFBSSxJQUFJLEVBQUU7WUFDcEIsSUFBSSxDQUFDLEdBQUcsR0FBRyxNQUFNLElBQUksQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUNyQyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7U0FDM0M7UUFDRCxJQUFJLFlBQVksR0FBRyxFQUFFLENBQUM7UUFDdEIsSUFBSSxNQUFNLEVBQUU7WUFDVixZQUFZLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsT0FBTyxDQUFDO1NBQ3pEO2FBQU07WUFDTCxZQUFZLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsV0FBVyxDQUFDLENBQUMsVUFBVSxDQUFDO1NBQzVEO1FBQ0QsSUFBSSxJQUFJLENBQUMsT0FBTyxDQUFDLGVBQWUsRUFBRTtZQUNoQyxVQUFVLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQztTQUMzQjthQUFNO1lBQ0wsbUJBQW1CO1lBQ25CLE1BQU0sSUFBSSxHQUFHLE1BQU0sSUFBSSxDQUFDLGFBQWEsQ0FBQyxZQUFZLENBQUMsQ0FBQztZQUNwRCxJQUFJLENBQUMsSUFBSSxFQUFFO2dCQUNULElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxDQUFDO2dCQUNsQyxVQUFVLENBQUMsT0FBTyxHQUFHLElBQUksQ0FBQzthQUMzQjtTQUNGO1FBQ0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDO1lBQzdCLFlBQVksRUFBRSxZQUFZO1lBQzFCLFVBQVUsRUFBRSxJQUFJLENBQUMsR0FBRztZQUNwQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7WUFDM0Isc0JBQXNCLEVBQUUsSUFBSSxDQUFDLEdBQUc7WUFDaEMsZUFBZSxFQUFFLEVBQUU7WUFDbkIsVUFBVSxFQUFFLElBQUk7WUFDaEIsVUFBVSxFQUFFLEtBQUs7WUFDakIsVUFBVTtZQUNWLE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU07U0FDNUIsQ0FBQyxDQUFDO1FBRUgsSUFBSSxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksRUFBRTtZQUMzQixNQUFNLGNBQWMsR0FBRztnQkFDckIsb0JBQW9CLEVBQUUsSUFBSTtnQkFDMUIsT0FBTyxFQUFFLENBQUMsVUFBVSxLQUFLLEVBQUUsQ0FBQztnQkFDNUIsc0JBQXNCLEVBQUUsSUFBSSxDQUFDLEdBQUc7YUFDakMsQ0FBQztZQUNGLE1BQU0sTUFBTSxDQUFDLGFBQWEsQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUMzQyxJQUFJLENBQUMsVUFBVSxHQUFHLE1BQU0sQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUN6QyxNQUFNLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLEVBQUUsSUFBSSxDQUFDLENBQUM7U0FDM0M7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsS0FBSyxDQUFDLFlBQVk7UUFDaEIsTUFBTSxHQUFHLEdBQUcsTUFBTSxJQUFJLENBQUMsS0FBSyxDQUFDLGdCQUFnQixFQUFFLENBQUM7UUFDaEQsT0FBTyxHQUFHLENBQUMsUUFBUSxFQUFFLENBQUM7SUFDeEIsQ0FBQztJQUVELFdBQVcsQ0FBQyxVQUFrQjtRQUM1QixNQUFNLE1BQU0sR0FBRyxHQUFHLENBQUMsS0FBSyxDQUFDLFVBQVUsQ0FBcUIsQ0FBQztRQUN6RCxJQUFJLE1BQU0sQ0FBQyxLQUFLLEVBQUU7WUFDaEIsTUFBTSxJQUFJLEtBQUssQ0FBQyxLQUFLLFVBQVUsT0FBTyxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUM7U0FDeEU7UUFDRCxPQUFPLE1BQU0sQ0FBQyxNQUFnQixDQUFDO0lBQ2pDLENBQUM7SUFDRCxLQUFLLENBQUMsaUJBQWlCLENBQUMsS0FBVSxFQUFFLFNBQWMsRUFBRSxnQkFBd0IsRUFBRSxXQUF5QjtRQUNyRyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBRWxELGFBQWE7UUFDYixNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztRQUMxQyxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFO1lBQ2hDLE1BQU0sUUFBUSxHQUFHLDRDQUE0QyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFDL0UsTUFBTSxZQUFZLEdBQUcsZ0JBQWdCLENBQUM7WUFFdEMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUNBQW1DLFVBQVUsYUFBYSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBRXZGLGtCQUFrQjtZQUNsQixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxnQkFBZ0IsWUFBWSxjQUFjLFFBQVEsR0FBRyxDQUFDLENBQUM7WUFDeEUsbURBQW1EO1NBQ3BEO2FBQU0sSUFBSSxTQUFTLENBQUMsSUFBSSxLQUFLLFFBQVEsRUFBRTtZQUN0QyxZQUFZO1lBQ1osTUFBTSxTQUFTLEdBQUcsbUJBQW1CLFVBQVUsRUFBRSxDQUFDO1lBQ2xELE1BQU0sV0FBVyxHQUFHLGdCQUFnQixDQUFDO1lBRXJDLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDJCQUEyQixVQUFVLEtBQUssU0FBUyxFQUFFLENBQUMsQ0FBQztZQUN4RSxrQkFBa0I7WUFDbEIsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsNEJBQTRCLFNBQVMsaUJBQWlCLFdBQVcsR0FBRyxDQUFDLENBQUM7WUFFdkYsTUFBTSxNQUFNLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FBQztZQUM1QyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyxjQUFjLEVBQUUsTUFBTSxDQUFDLENBQUM7WUFDekMsT0FBTyxNQUFNLFdBQVcsQ0FBQyxZQUFZLENBQUM7Z0JBQ3BDLFVBQVUsRUFBRSxTQUFTO2dCQUNyQixJQUFJLEVBQUUsS0FBSztnQkFDWCxLQUFLLEVBQUUsV0FBVztnQkFDbEIsTUFBTTthQUNQLENBQUMsQ0FBQztTQUNKO0lBQ0gsQ0FBQztJQUVEOzs7Ozs7Ozs7T0FTRztJQUVILEtBQUssQ0FBQyxpQkFBaUIsQ0FBQyxLQUFVLEVBQUUsU0FBYyxFQUFFLGdCQUF3QixFQUFFLFVBQWUsRUFBRSxXQUF5QjtRQUN0SCxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxDQUFDO1FBRWxELGFBQWE7UUFDYixNQUFNLFVBQVUsR0FBRyxLQUFLLENBQUMsVUFBVSxDQUFDLEtBQUssQ0FBQztRQUMxQyxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssU0FBUyxFQUFFO1lBQ2hDLE1BQU0sUUFBUSxHQUFHLDRDQUE0QyxTQUFTLENBQUMsS0FBSyxFQUFFLENBQUM7WUFFL0UsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsbUNBQW1DLFVBQVUsYUFBYSxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBRXZGLGtCQUFrQjtZQUNsQixJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQyw4QkFBOEIsUUFBUSxHQUFHLENBQUMsQ0FBQztZQUM1RCxrQ0FBa0M7U0FDbkM7YUFBTSxJQUFJLFNBQVMsQ0FBQyxJQUFJLEtBQUssUUFBUSxFQUFFO1lBQ3RDLE1BQU0sU0FBUyxHQUFHLG1CQUFtQixVQUFVLEVBQUUsQ0FBQztZQUNsRCxNQUFNLFdBQVcsR0FBRyxnQkFBZ0IsQ0FBQztZQUVyQyxJQUFJLENBQUMsTUFBTSxDQUFDLElBQUksQ0FBQywyQkFBMkIsVUFBVSxLQUFLLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFFeEUsa0JBQWtCO1lBQ2xCLElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLDRCQUE0QixTQUFTLGlCQUFpQixXQUFXLEdBQUcsQ0FBQyxDQUFDO1lBRXZGLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsVUFBVSxDQUFDLENBQUM7WUFFNUMsSUFBSTtnQkFDRixNQUFNLFdBQVcsQ0FBQyxZQUFZLENBQUM7b0JBQzdCLFVBQVUsRUFBRSxTQUFTO29CQUNyQixJQUFJLEVBQUUsS0FBSztvQkFDWCxLQUFLLEVBQUUsZ0JBQWdCO29CQUN2QixNQUFNLEVBQUUsVUFBVTtvQkFDbEIsTUFBTTtpQkFDUCxDQUFDLENBQUM7YUFDSjtZQUFDLE9BQU8sQ0FBQyxFQUFFO2dCQUNWLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQztnQkFDbEMsTUFBTSxDQUFDLENBQUM7YUFDVDtTQUNGO0lBQ0gsQ0FBQztJQUVELEtBQUssQ0FBQyxLQUFLLENBQUMsT0FPWDtRQUNDLE1BQU0sRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLEdBQUcsT0FBTyxDQUFDO1FBQ2pFLE1BQU0sTUFBTSxHQUFnQixNQUFNLElBQUksQ0FBQyxhQUFhLENBQUMsS0FBSyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBRXBFLGdCQUFnQjtRQUNoQixNQUFNLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRSxHQUFHLElBQUksQ0FBQyx3QkFBd0IsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4RSxJQUFJLFVBQVUsR0FBRyxJQUFJLENBQUM7UUFDdEIsTUFBTSxjQUFjLEdBQUcsT0FBTyxDQUFDLGNBQWMsSUFBSSxVQUFVLENBQUM7UUFDNUQsTUFBTSxhQUFhLEdBQUcsY0FBYyxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUNoRCxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDOUIsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hDLElBQUksSUFBSSxJQUFJLElBQUksRUFBRTtZQUNoQixNQUFNLElBQUksR0FBUSxJQUFJLEdBQUcsSUFBSSxDQUFDO1lBQzlCLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMscUJBQXFCLENBQUMsSUFBSSxDQUFDLENBQUM7U0FDNUQ7YUFBTTtZQUNMLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxNQUFNLENBQUMsbUJBQW1CLENBQUMsSUFBSSxDQUFDLENBQUM7U0FDMUQ7UUFDRCxNQUFNLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxHQUFHLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQzVDO1lBQ0UsVUFBVTtZQUNWLEdBQUcsT0FBTztZQUNWLFFBQVE7U0FDVCxFQUNELFVBQVUsQ0FDWCxDQUFDO1FBQ0YsSUFBSSxXQUFXLElBQUksSUFBSSxFQUFFO1lBQ3ZCLE1BQU0sSUFBSSxLQUFLLENBQUMsa0JBQWtCLENBQUMsQ0FBQztTQUNyQztRQUNELFlBQVk7UUFDWixNQUFNLEdBQUcsR0FBRyxNQUFNLE1BQU0sQ0FBQyxJQUFJLENBQUM7WUFDNUIsR0FBRztZQUNILEtBQUssRUFBRSxLQUFLO1lBQ1osb0JBQW9CLEVBQUUsSUFBSTtZQUMxQix5QkFBeUIsRUFBRSxJQUFJLENBQUMsZUFBZTtZQUMvQyxpQkFBaUIsRUFBRSxDQUFDLFFBQVEsQ0FBQztZQUM3QixpQkFBaUIsRUFBRSxLQUFLLEVBQUUsS0FBeUIsRUFBRSxTQUFvQixFQUFFLGdCQUF3QixFQUFnQixFQUFFO2dCQUNuSCxPQUFPLE1BQU0sSUFBSSxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsV0FBVyxDQUFDLENBQUM7WUFDdkYsQ0FBQztZQUNELGlCQUFpQixFQUFFLEtBQUssRUFBRSxLQUF5QixFQUFFLFNBQW9CLEVBQUUsZ0JBQXdCLEVBQUUsVUFBZSxFQUFnQixFQUFFO2dCQUNwSSxPQUFPLE1BQU0sSUFBSSxDQUFDLGlCQUFpQixDQUFDLEtBQUssRUFBRSxTQUFTLEVBQUUsZ0JBQWdCLEVBQUUsVUFBVSxFQUFFLFdBQVcsQ0FBQyxDQUFDO1lBQ25HLENBQUM7WUFDRCxNQUFNLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNO1NBQzVCLENBQUMsQ0FBQztRQUVILE1BQU0sSUFBSSxHQUFhO1lBQ3JCLEdBQUcsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFO1lBQ25CLEdBQUcsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFO1lBQ25CLEdBQUcsRUFBRSxHQUFHLENBQUMsUUFBUSxFQUFFO1NBQ3BCLENBQUM7UUFDRixVQUFVO1FBQ1YsSUFBSSxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsU0FBUyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUMsQ0FBQztRQUN2QyxJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssQ0FBQyxpQkFBaUIsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLENBQUM7UUFDL0MsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUM7UUFDM0IsT0FBTyxJQUFJLENBQUM7SUFDZCxDQUFDO0lBRUQsd0JBQXdCLENBQUMsT0FBMEI7UUFJakQsSUFBSSxPQUFPLE9BQU8sS0FBSyxRQUFRLEVBQUU7WUFDL0IsT0FBTyxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7U0FDOUI7UUFDRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssQ0FBQyxFQUFFO1lBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMseUJBQXlCLENBQUMsQ0FBQztTQUM1QztRQUNELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUM5QixJQUFJLFFBQVEsR0FBeUIsU0FBUyxDQUFDO1FBQy9DLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUU7WUFDdEIsUUFBUSxHQUFHLENBQUMsQ0FBQyxLQUFLLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDO1NBQ2hDO1FBQ0QsT0FBTztZQUNMLFVBQVU7WUFDVixRQUFRO1NBQ1QsQ0FBQztJQUNKLENBQUM7SUFFTyxLQUFLLENBQUMsYUFBYSxDQUFDLFlBQW9CO1FBQzlDLElBQUk7WUFDRixNQUFNLEtBQUssQ0FBQyxJQUFJLENBQUM7Z0JBQ2YsR0FBRyxFQUFFLFlBQVk7Z0JBQ2pCLE1BQU0sRUFBRSxLQUFLO2dCQUNiLE9BQU8sRUFBRSxJQUFJO2FBQ2QsQ0FBQyxDQUFDO1NBQ0o7UUFBQyxPQUFPLENBQUMsRUFBRTtZQUNWLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsWUFBWSxTQUFTLEVBQUUsQ0FBQyxDQUFDLENBQUM7WUFDL0MsT0FBTyxLQUFLLENBQUM7U0FDZDtRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLEdBQUcsWUFBWSxTQUFTLENBQUMsQ0FBQztRQUMzQyxPQUFPLElBQUksQ0FBQztJQUNkLENBQUM7Q0FDRiJ9