@push.rocks/smartacme 9.5.0 → 9.6.0

package/dist_ts/classes.exact-certificate-issuer.js

@@ -0,0 +1,393 @@
+import * as plugins from './plugins.js';
+export function normalizeCertificateIdentifiers(input) {
+    if (!Array.isArray(input) || input.length < 1 || input.length > 100) {
+        throw new Error('Between one and 100 explicit DNS identifiers are required');
+    }
+    return [...new Set(Array.from(input, (value) => {
+            if (typeof value !== 'string' || value.length > 1024)
+                throw new Error('Invalid DNS identifier');
+            const trimmed = value.trim().toLowerCase().replace(/\.$/, '');
+            if (/[/\\:@?#%\s]/.test(trimmed))
+                throw new Error('Invalid DNS identifier');
+            const wildcard = trimmed.startsWith('*.');
+            const name = plugins.url.domainToASCII(wildcard ? trimmed.slice(2) : trimmed);
+            if (!name || plugins.net.isIP(name) !== 0 || name.length > 253 || name.split('.').length < 2
+                || name.split('.').some((label) => !/^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))) {
+                throw new Error('Invalid DNS identifier');
+            }
+            return `${wildcard ? '*.' : ''}${name}`;
+        }))].sort();
+}
+/** Owns exact-name issuance and recovery; the embedding service supplies storage. */
+export class ExactCertificateIssuer {
+    constructor(options) {
+        this.options = options;
+    }
+    identity(request) {
+        if (typeof request.namespace !== 'string' || !/^[\x21-\x7e]{1,200}$/.test(request.namespace)) {
+            throw new Error('A nonempty printable isolation namespace of at most 200 characters is required');
+        }
+        const identifiers = normalizeCertificateIdentifiers(request.identifiers);
+        const binding = {
+            namespace: request.namespace,
+            identifiers,
+            directoryUrl: this.options.directoryUrl,
+            accountThumbprint: this.options.accountThumbprint,
+        };
+        return {
+            ...binding,
+            certificateKey: `exact-v1:${plugins.crypto.createHash('sha256').update(JSON.stringify(binding)).digest('hex')}`,
+        };
+    }
+    async status(request) {
+        const identity = this.identity(request);
+        const record = await this.options.store.getIssuance(identity.certificateKey);
+        if (record)
+            this.validateRecord(record, identity);
+        return record ? this.info(record) : null;
+    }
+    /** Validate the cache before taking any issuance or CA rate-limit slot. */
+    async cached(request) {
+        const identity = this.identity(request);
+        const certificate = await this.options.store.getCertificate(identity.certificateKey);
+        if (!certificate)
+            return null;
+        this.validateCertificate(certificate, identity);
+        const record = await this.options.store.getIssuance(identity.certificateKey);
+        if (record?.status !== 'ready' || certificate.id !== record.issuanceId
+            || Date.now() >= certificate.renewAfter || Date.now() >= certificate.validUntil)
+            return null;
+        this.validateRecord(record, identity);
+        return { status: 'ready', certificate, issuance: this.info(record) };
+    }
+    async run(request) {
+        this.options.signal.throwIfAborted();
+        const identity = this.identity(request);
+        let record = await this.options.store.getIssuance(identity.certificateKey);
+        const cached = await this.options.store.getCertificate(identity.certificateKey);
+        if (cached) {
+            this.validateCertificate(cached, identity);
+            if (record?.status === 'ready' && cached.id === record.issuanceId && Date.now() < cached.renewAfter) {
+                this.validateRecord(record, identity);
+                return { status: 'ready', certificate: cached, issuance: this.info(record) };
+            }
+        }
+        if (record?.status === 'ready' && !cached) {
+            this.validateRecord(record, identity);
+            return await this.advance(record, true);
+        }
+        if (!record || record.status === 'ready') {
+            const [privateKey, csr] = await plugins.acme.AcmeCrypto.createCsr({
+                commonName: identity.identifiers[0], altNames: identity.identifiers.slice(1),
+            });
+            const next = {
+                ...identity, issuanceId: plugins.crypto.randomUUID(), revision: (record?.revision ?? -1) + 1,
+                status: 'prepared', createdAt: Date.now(), updatedAt: Date.now(), privateKey, csr,
+                pendingChallenges: [],
+            };
+            this.options.signal.throwIfAborted();
+            if (!await this.options.store.compareAndSetIssuance(identity.certificateKey, record?.revision ?? null, next)) {
+                const current = await this.requiredRecord(identity.certificateKey);
+                return { status: 'pending', issuance: this.info(current) };
+            }
+            record = next;
+        }
+        this.validateRecord(record, identity);
+        return await this.advance(record, false);
+    }
+    async recover(request) {
+        if (!['recheck', 'retry-proven-unapplied', 'abandon'].includes(request.action)
+            || !Number.isSafeInteger(request.expectedRevision) || request.expectedRevision < 0
+            || typeof request.issuanceId !== 'string' || !request.issuanceId) {
+            throw new Error('Invalid issuance recovery request');
+        }
+        const identity = this.identity(request);
+        let record = await this.requiredRecord(identity.certificateKey);
+        this.validateRecord(record, identity);
+        if (record.issuanceId !== request.issuanceId || record.revision !== request.expectedRevision) {
+            throw new Error('Issuance recovery revision conflict');
+        }
+        if (request.action === 'abandon') {
+            if (record.status === 'ready')
+                throw new Error('A completed issuance cannot be abandoned');
+            record = await this.save(record, { status: 'abandoned_unverified' });
+            await this.cleanup(record);
+            return { status: 'pending', issuance: this.info(await this.requiredRecord(record.certificateKey)) };
+        }
+        if (record.status === 'abandoned_unverified') {
+            throw new Error('Abandoned issuance requires external resolution; new issuance remains blocked');
+        }
+        if (request.action === 'retry-proven-unapplied') {
+            // Only an acknowledged rejection of newOrder proves no order was created.
+            if (record.order || record.status !== 'failed' || record.errorCode !== 'rate_limited') {
+                throw new Error('The previous external effect is not proven unapplied');
+            }
+            if (record.retryAfter && record.retryAfter > Date.now()) {
+                return { status: 'pending', issuance: this.info(record) };
+            }
+            record = await this.save(record, { status: 'prepared', errorCode: undefined, retryAfter: undefined });
+            return await this.advance(record, false);
+        }
+        return await this.advance(record, true);
+    }
+    async advance(initial, recheckOnly) {
+        let record = initial;
+        this.options.signal.throwIfAborted();
+        if (record.status === 'abandoned_unverified' || record.status === 'failed') {
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        if (record.status === 'creating' || (record.status === 'indeterminate' && !record.order)) {
+            record = await this.save(record, { status: 'indeterminate', errorCode: 'order_outcome_unknown' });
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        if (record.status === 'prepared') {
+            if (recheckOnly)
+                return { status: 'pending', issuance: this.info(record) };
+            // Prove challenge support before creating an irreversible CA order.
+            await this.handler(record);
+            record = await this.save(record, { status: 'creating' });
+            let order;
+            try {
+                this.options.signal.throwIfAborted();
+                order = await this.options.client.createOrder({
+                    identifiers: record.identifiers.map((value) => ({ type: 'dns', value })),
+                });
+            }
+            catch (error) {
+                const rejected = error instanceof plugins.acme.AcmeError && error.isRateLimited;
+                record = await this.save(record, {
+                    status: rejected ? 'failed' : 'indeterminate',
+                    errorCode: rejected ? 'rate_limited' : 'order_outcome_unknown',
+                    retryAfter: rejected ? Date.now() + Math.max(error.retryAfter, 60) * 1000 : undefined,
+                });
+                return { status: 'pending', issuance: this.info(record) };
+            }
+            if (!order.url) {
+                record = await this.save(record, { status: 'indeterminate', errorCode: 'order_outcome_unknown' });
+                return { status: 'pending', issuance: this.info(record) };
+            }
+            record = await this.save(record, { order, status: 'authorizing' });
+        }
+        if (!record.order)
+            throw new Error('Issuance record has no acknowledged order');
+        const observed = await this.options.client.getOrder(record.order.url);
+        this.validateOrder(observed, record);
+        record = await this.save(record, { order: observed, errorCode: undefined });
+        if (observed.status === 'invalid' || observed.status === 'expired' || observed.status === 'revoked') {
+            record = await this.save(record, { status: 'failed', errorCode: 'order_invalid' });
+            await this.cleanup(record);
+            return { status: 'pending', issuance: this.info(await this.requiredRecord(record.certificateKey)) };
+        }
+        if (observed.status === 'valid')
+            return await this.finish(record);
+        if (recheckOnly) {
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        if (record.status === 'finalizing' || record.status === 'indeterminate') {
+            // Acknowledged processing/ready observations do not prove a previous
+            // finalize request was unapplied. Never send a new CSR on uncertainty.
+            record = await this.save(record, { status: 'indeterminate', errorCode: 'order_outcome_unknown' });
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        if (observed.status === 'pending') {
+            record = await this.authorize(record);
+            if (record.status === 'failed')
+                return { status: 'pending', issuance: this.info(record) };
+        }
+        const ready = await this.options.client.getOrder(record.order.url);
+        this.validateOrder(ready, record);
+        record = await this.save(record, { order: ready });
+        if (ready.status === 'valid')
+            return await this.finish(record);
+        if (ready.status !== 'ready') {
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        record = await this.save(record, { status: 'finalizing' });
+        try {
+            this.options.signal.throwIfAborted();
+            await this.options.client.finalizeOrder(structuredClone(ready), record.csr);
+        }
+        catch {
+            // Preserve the acknowledged order and original key/CSR for safe recheck.
+            record = await this.save(record, { status: 'indeterminate', errorCode: 'order_outcome_unknown' });
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        const finalized = await this.options.client.getOrder(ready.url);
+        this.validateOrder(finalized, record);
+        record = await this.save(record, { order: finalized });
+        return finalized.status === 'valid'
+            ? await this.finish(record)
+            : { status: 'pending', issuance: this.info(record) };
+    }
+    async authorize(initial) {
+        let record = initial;
+        const handler = await this.handler(record);
+        const authorizations = await this.options.client.getAuthorizations(record.order);
+        for (const authorization of authorizations) {
+            this.options.signal.throwIfAborted();
+            const identifier = `${authorization.wildcard ? '*.' : ''}${authorization.identifier.value}`;
+            if (authorization.identifier.type !== 'dns' || !record.identifiers.includes(identifier)) {
+                throw new Error('CA authorization is outside the requested identifiers');
+            }
+            if (authorization.status === 'valid')
+                continue;
+            if (authorization.status !== 'pending') {
+                return await this.save(record, { status: 'failed', errorCode: 'authorization_failed' });
+            }
+            const challenge = authorization.challenges.find((value) => value.type === 'dns-01');
+            if (!challenge)
+                throw new Error('The CA did not offer DNS-01');
+            const input = {
+                hostName: `_acme-challenge.${authorization.identifier.value}`,
+                challenge: this.options.client.getChallengeKeyAuthorization(challenge),
+            };
+            if (!record.pendingChallenges.some((value) => value.hostName === input.hostName && value.challenge === input.challenge)) {
+                record = await this.save(record, { pendingChallenges: [...record.pendingChallenges, input] });
+            }
+            try {
+                await handler.prepare(input);
+                if (handler.verify) {
+                    await handler.verify(input);
+                }
+                else {
+                    let visible = false;
+                    for (let attempt = 0; attempt < 100; attempt++) {
+                        this.options.signal.throwIfAborted();
+                        const records = await this.options.dns.getRecords(input.hostName, 'TXT', 0);
+                        if (records.some((value) => value.value === input.challenge)) {
+                            visible = true;
+                            break;
+                        }
+                        await plugins.timers.setTimeout(1000, undefined, { signal: this.options.signal });
+                    }
+                    if (!visible)
+                        throw new Error('DNS-01 propagation timed out');
+                }
+                await plugins.timers.setTimeout(this.options.dnsPropagationDelayMs, undefined, { signal: this.options.signal });
+                await this.options.client.completeChallenge(challenge);
+                await this.options.client.waitForValidStatus(challenge);
+            }
+            finally {
+                // Persist cleanup intent until cleanup actually succeeds, including
+                // failure during prepare, process shutdown, or certificate retrieval.
+                await handler.cleanup(input);
+                record = await this.save(record, {
+                    pendingChallenges: record.pendingChallenges.filter((value) => value.hostName !== input.hostName || value.challenge !== input.challenge),
+                });
+            }
+        }
+        return record;
+    }
+    async finish(initial) {
+        let record = initial;
+        if (!record.order?.certificate)
+            throw new Error('Completed order has no certificate URL');
+        const pem = await this.options.client.getCertificate(record.order);
+        const x509 = new plugins.crypto.X509Certificate(pem);
+        const validFrom = new Date(x509.validFrom).getTime();
+        const validUntil = new Date(x509.validTo).getTime();
+        const certificate = {
+            ...this.identity(record), id: record.issuanceId, created: Date.now(),
+            privateKey: record.privateKey, csr: record.csr, publicKey: pem, validFrom, validUntil,
+            renewAfter: validUntil - Math.min(10 * 86400000, (validUntil - validFrom) / 3),
+        };
+        try {
+            this.validateCertificate(certificate, record);
+            if (validUntil <= Date.now())
+                throw new Error('CA returned an expired certificate');
+        }
+        catch {
+            record = await this.save(record, { status: 'failed', errorCode: 'certificate_invalid' });
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        await this.cleanup(record);
+        record = await this.requiredRecord(record.certificateKey);
+        if (record.status === 'abandoned_unverified') {
+            return { status: 'pending', issuance: this.info(record) };
+        }
+        await this.options.store.storeCertificate(certificate);
+        record = await this.save(record, { status: 'ready', errorCode: undefined });
+        return { status: 'ready', certificate, issuance: this.info(record) };
+    }
+    async handler(record) {
+        const handler = this.options.handlers.find((value) => value.getSupportedTypes().includes('dns-01'));
+        if (!handler)
+            throw new Error('Exact issuance requires DNS-01');
+        for (const identifier of record.identifiers) {
+            if (!await handler.checkWetherDomainIsSupported(identifier.replace(/^\*\./, ''))) {
+                throw new Error('DNS-01 ownership is unavailable for a requested identifier');
+            }
+        }
+        return handler;
+    }
+    async cleanup(initial) {
+        let record = initial;
+        if (!record.pendingChallenges.length)
+            return;
+        const handler = this.options.handlers.find((value) => value.getSupportedTypes().includes('dns-01'));
+        if (!handler)
+            throw new Error('DNS-01 cleanup handler is unavailable');
+        for (const input of [...record.pendingChallenges]) {
+            await handler.cleanup(input);
+            record = await this.save(record, {
+                pendingChallenges: record.pendingChallenges.filter((value) => value.hostName !== input.hostName || value.challenge !== input.challenge),
+            });
+        }
+    }
+    validateRecord(record, identity) {
+        if (record.certificateKey !== identity.certificateKey
+            || this.identity(record).certificateKey !== identity.certificateKey
+            || record.accountThumbprint !== identity.accountThumbprint || record.directoryUrl !== identity.directoryUrl) {
+            throw new Error('Issuance storage identity mismatch');
+        }
+    }
+    validateOrder(order, record) {
+        if (!order.url || order.identifiers.some((value) => value.type !== 'dns')
+            || JSON.stringify(normalizeCertificateIdentifiers(order.identifiers.map((value) => value.value))) !== JSON.stringify(record.identifiers)) {
+            throw new Error('CA order identifiers do not match the certificate request');
+        }
+    }
+    validateCertificate(certificate, identity) {
+        if (certificate.certificateKey !== identity.certificateKey
+            || this.identity(certificate).certificateKey !== identity.certificateKey
+            || certificate.accountThumbprint !== identity.accountThumbprint || certificate.directoryUrl !== identity.directoryUrl) {
+            throw new Error('Certificate storage identity mismatch');
+        }
+        const parsed = new plugins.x509.X509Certificate(certificate.publicKey);
+        const names = parsed.getExtension(plugins.x509.SubjectAlternativeNameExtension)?.names.toJSON();
+        if (!names || names.some((value) => value.type !== 'dns')
+            || JSON.stringify(normalizeCertificateIdentifiers(names.map((value) => value.value))) !== JSON.stringify(identity.identifiers)) {
+            throw new Error('Certificate identifiers exceed or differ from the requested scope');
+        }
+        const x509 = new plugins.crypto.X509Certificate(certificate.publicKey);
+        if (x509.ca || !x509.checkPrivateKey(plugins.crypto.createPrivateKey(certificate.privateKey))
+            || new Date(x509.validFrom).getTime() !== certificate.validFrom
+            || new Date(x509.validTo).getTime() !== certificate.validUntil
+            || certificate.validFrom > Date.now() + 300000
+            || !Number.isFinite(certificate.renewAfter) || certificate.renewAfter >= certificate.validUntil) {
+            throw new Error('Invalid certificate key, lifetime, or constraints');
+        }
+    }
+    info(record) {
+        return {
+            certificateKey: record.certificateKey, issuanceId: record.issuanceId,
+            identifiers: [...record.identifiers], status: record.status, revision: record.revision,
+            createdAt: record.createdAt, updatedAt: record.updatedAt,
+            errorCode: record.errorCode, retryAfter: record.retryAfter,
+        };
+    }
+    async requiredRecord(key) {
+        const record = await this.options.store.getIssuance(key);
+        if (!record)
+            throw new Error('Issuance recovery record is missing');
+        return record;
+    }
+    async save(record, patch) {
+        const next = { ...record, ...patch, revision: record.revision + 1, updatedAt: Date.now() };
+        if (!await this.options.store.compareAndSetIssuance(record.certificateKey, record.revision, next)) {
+            throw new Error('Issuance changed concurrently; reload its durable state before proceeding');
+        }
+        return next;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5leGFjdC1jZXJ0aWZpY2F0ZS1pc3N1ZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9jbGFzc2VzLmV4YWN0LWNlcnRpZmljYXRlLWlzc3Vlci50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGNBQWMsQ0FBQztBQVl4QyxNQUFNLFVBQVUsK0JBQStCLENBQUMsS0FBd0I7SUFDdEUsSUFBSSxDQUFDLEtBQUssQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxHQUFHLEVBQUUsQ0FBQztRQUNwRSxNQUFNLElBQUksS0FBSyxDQUFDLDJEQUEyRCxDQUFDLENBQUM7SUFDL0UsQ0FBQztJQUNELE9BQU8sQ0FBQyxHQUFHLElBQUksR0FBRyxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsS0FBSyxFQUFFLENBQUMsS0FBSyxFQUFFLEVBQUU7WUFDN0MsSUFBSSxPQUFPLEtBQUssS0FBSyxRQUFRLElBQUksS0FBSyxDQUFDLE1BQU0sR0FBRyxJQUFJO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsQ0FBQztZQUNoRyxNQUFNLE9BQU8sR0FBRyxLQUFLLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUMsT0FBTyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQztZQUM5RCxJQUFJLGNBQWMsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsd0JBQXdCLENBQUMsQ0FBQztZQUM1RSxNQUFNLFFBQVEsR0FBRyxPQUFPLENBQUMsVUFBVSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzFDLE1BQU0sSUFBSSxHQUFHLE9BQU8sQ0FBQyxHQUFHLENBQUMsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUM7WUFDOUUsSUFBSSxDQUFDLElBQUksSUFBSSxPQUFPLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxDQUFDLE1BQU0sR0FBRyxHQUFHLElBQUksSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEdBQUcsQ0FBQzttQkFDdkYsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsd0NBQXdDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDNUYsTUFBTSxJQUFJLEtBQUssQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO1lBQzVDLENBQUM7WUFDRCxPQUFPLEdBQUcsUUFBUSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxJQUFJLEVBQUUsQ0FBQztRQUMxQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUM7QUFDZCxDQUFDO0FBY0QscUZBQXFGO0FBQ3JGLE1BQU0sT0FBTyxzQkFBc0I7SUFDakMsWUFBb0IsT0FBdUM7UUFBdkMsWUFBTyxHQUFQLE9BQU8sQ0FBZ0M7SUFBRyxDQUFDO0lBRXhELFFBQVEsQ0FBQyxPQUFpQztRQUMvQyxJQUFJLE9BQU8sT0FBTyxDQUFDLFNBQVMsS0FBSyxRQUFRLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLFNBQVMsQ0FBQyxFQUFFLENBQUM7WUFDN0YsTUFBTSxJQUFJLEtBQUssQ0FBQyxnRkFBZ0YsQ0FBQyxDQUFDO1FBQ3BHLENBQUM7UUFDRCxNQUFNLFdBQVcsR0FBRywrQkFBK0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDekUsTUFBTSxPQUFPLEdBQUc7WUFDZCxTQUFTLEVBQUUsT0FBTyxDQUFDLFNBQVM7WUFDNUIsV0FBVztZQUNYLFlBQVksRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLFlBQVk7WUFDdkMsaUJBQWlCLEVBQUUsSUFBSSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUI7U0FDbEQsQ0FBQztRQUNGLE9BQU87WUFDTCxHQUFHLE9BQU87WUFDVixjQUFjLEVBQUUsWUFBWSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLFNBQVMsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsRUFBRTtTQUNoSCxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBaUM7UUFDbkQsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDN0UsSUFBSSxNQUFNO1lBQUUsSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDbEQsT0FBTyxNQUFNLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQztJQUMzQyxDQUFDO0lBRUQsMkVBQTJFO0lBQ3BFLEtBQUssQ0FBQyxNQUFNLENBQUMsT0FBaUM7UUFDbkQsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QyxNQUFNLFdBQVcsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDckYsSUFBSSxDQUFDLFdBQVc7WUFBRSxPQUFPLElBQUksQ0FBQztRQUM5QixJQUFJLENBQUMsbUJBQW1CLENBQUMsV0FBVyxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ2hELE1BQU0sTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsV0FBVyxDQUFDLFFBQVEsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUM3RSxJQUFJLE1BQU0sRUFBRSxNQUFNLEtBQUssT0FBTyxJQUFJLFdBQVcsQ0FBQyxFQUFFLEtBQUssTUFBTSxDQUFDLFVBQVU7ZUFDakUsSUFBSSxDQUFDLEdBQUcsRUFBRSxJQUFJLFdBQVcsQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLEdBQUcsRUFBRSxJQUFJLFdBQVcsQ0FBQyxVQUFVO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDL0YsSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7UUFDdEMsT0FBTyxFQUFFLE1BQU0sRUFBRSxPQUFPLEVBQUUsV0FBVyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7SUFDdkUsQ0FBQztJQUVNLEtBQUssQ0FBQyxHQUFHLENBQUMsT0FBaUM7UUFDaEQsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDckMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QyxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxRQUFRLENBQUMsY0FBYyxDQUFDLENBQUM7UUFDM0UsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2hGLElBQUksTUFBTSxFQUFFLENBQUM7WUFDWCxJQUFJLENBQUMsbUJBQW1CLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1lBQzNDLElBQUksTUFBTSxFQUFFLE1BQU0sS0FBSyxPQUFPLElBQUksTUFBTSxDQUFDLEVBQUUsS0FBSyxNQUFNLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7Z0JBQ3BHLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO2dCQUN0QyxPQUFPLEVBQUUsTUFBTSxFQUFFLE9BQU8sRUFBRSxXQUFXLEVBQUUsTUFBTSxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDL0UsQ0FBQztRQUNILENBQUM7UUFDRCxJQUFJLE1BQU0sRUFBRSxNQUFNLEtBQUssT0FBTyxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7WUFDMUMsSUFBSSxDQUFDLGNBQWMsQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFDdEMsT0FBTyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxDQUFDO1FBQzFDLENBQUM7UUFDRCxJQUFJLENBQUMsTUFBTSxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDekMsTUFBTSxDQUFDLFVBQVUsRUFBRSxHQUFHLENBQUMsR0FBRyxNQUFNLE9BQU8sQ0FBQyxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsQ0FBQztnQkFDaEUsVUFBVSxFQUFFLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxDQUFDLEVBQUUsUUFBUSxFQUFFLFFBQVEsQ0FBQyxXQUFXLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQzthQUM3RSxDQUFDLENBQUM7WUFDSCxNQUFNLElBQUksR0FBeUI7Z0JBQ2pDLEdBQUcsUUFBUSxFQUFFLFVBQVUsRUFBRSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsRUFBRSxFQUFFLFFBQVEsRUFBRSxDQUFDLE1BQU0sRUFBRSxRQUFRLElBQUksQ0FBQyxDQUFDLENBQUMsR0FBRyxDQUFDO2dCQUM1RixNQUFNLEVBQUUsVUFBVSxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsU0FBUyxFQUFFLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxVQUFVLEVBQUUsR0FBRztnQkFDakYsaUJBQWlCLEVBQUUsRUFBRTthQUN0QixDQUFDO1lBQ0YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDckMsSUFBSSxDQUFDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMscUJBQXFCLENBQUMsUUFBUSxDQUFDLGNBQWMsRUFBRSxNQUFNLEVBQUUsUUFBUSxJQUFJLElBQUksRUFBRSxJQUFJLENBQUMsRUFBRSxDQUFDO2dCQUM3RyxNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxDQUFDO2dCQUNuRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsRUFBRSxDQUFDO1lBQzdELENBQUM7WUFDRCxNQUFNLEdBQUcsSUFBSSxDQUFDO1FBQ2hCLENBQUM7UUFDRCxJQUFJLENBQUMsY0FBYyxDQUFDLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQztRQUN0QyxPQUFPLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7SUFDM0MsQ0FBQztJQUVNLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBc0M7UUFDekQsSUFBSSxDQUFDLENBQUMsU0FBUyxFQUFFLHdCQUF3QixFQUFFLFNBQVMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDO2VBQ3pFLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxPQUFPLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxPQUFPLENBQUMsZ0JBQWdCLEdBQUcsQ0FBQztlQUMvRSxPQUFPLE9BQU8sQ0FBQyxVQUFVLEtBQUssUUFBUSxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ25FLE1BQU0sSUFBSSxLQUFLLENBQUMsbUNBQW1DLENBQUMsQ0FBQztRQUN2RCxDQUFDO1FBQ0QsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUN4QyxJQUFJLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsUUFBUSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQ2hFLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxFQUFFLFFBQVEsQ0FBQyxDQUFDO1FBQ3RDLElBQUksTUFBTSxDQUFDLFVBQVUsS0FBSyxPQUFPLENBQUMsVUFBVSxJQUFJLE1BQU0sQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDN0YsTUFBTSxJQUFJLEtBQUssQ0FBQyxxQ0FBcUMsQ0FBQyxDQUFDO1FBQ3pELENBQUM7UUFDRCxJQUFJLE9BQU8sQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDakMsSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLE9BQU87Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQywwQ0FBMEMsQ0FBQyxDQUFDO1lBQzNGLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsTUFBTSxFQUFFLHNCQUFzQixFQUFFLENBQUMsQ0FBQztZQUNyRSxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7WUFDM0IsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxjQUFjLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdEcsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxzQkFBc0IsRUFBRSxDQUFDO1lBQzdDLE1BQU0sSUFBSSxLQUFLLENBQUMsK0VBQStFLENBQUMsQ0FBQztRQUNuRyxDQUFDO1FBQ0QsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLHdCQUF3QixFQUFFLENBQUM7WUFDaEQsMEVBQTBFO1lBQzFFLElBQUksTUFBTSxDQUFDLEtBQUssSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxNQUFNLENBQUMsU0FBUyxLQUFLLGNBQWMsRUFBRSxDQUFDO2dCQUN0RixNQUFNLElBQUksS0FBSyxDQUFDLHNEQUFzRCxDQUFDLENBQUM7WUFDMUUsQ0FBQztZQUNELElBQUksTUFBTSxDQUFDLFVBQVUsSUFBSSxNQUFNLENBQUMsVUFBVSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDO2dCQUN4RCxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1lBQzVELENBQUM7WUFDRCxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLFNBQVMsRUFBRSxVQUFVLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztZQUN0RyxPQUFPLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLEVBQUUsS0FBSyxDQUFDLENBQUM7UUFDM0MsQ0FBQztRQUNELE9BQU8sTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxJQUFJLENBQUMsQ0FBQztJQUMxQyxDQUFDO0lBRU8sS0FBSyxDQUFDLE9BQU8sQ0FBQyxPQUE2QixFQUFFLFdBQW9CO1FBQ3ZFLElBQUksTUFBTSxHQUFHLE9BQU8sQ0FBQztRQUNyQixJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQztRQUNyQyxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssc0JBQXNCLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRLEVBQUUsQ0FBQztZQUMzRSxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssVUFBVSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sS0FBSyxlQUFlLElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN6RixNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQztZQUNsRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELENBQUM7UUFDRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssVUFBVSxFQUFFLENBQUM7WUFDakMsSUFBSSxXQUFXO2dCQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7WUFDM0Usb0VBQW9FO1lBQ3BFLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMzQixNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1lBQ3pELElBQUksS0FBOEIsQ0FBQztZQUNuQyxJQUFJLENBQUM7Z0JBQ0gsSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLENBQUM7Z0JBQ3JDLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQztvQkFDNUMsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDO2lCQUN6RSxDQUFDLENBQUM7WUFDTCxDQUFDO1lBQUMsT0FBTyxLQUFLLEVBQUUsQ0FBQztnQkFDZixNQUFNLFFBQVEsR0FBRyxLQUFLLFlBQVksT0FBTyxDQUFDLElBQUksQ0FBQyxTQUFTLElBQUksS0FBSyxDQUFDLGFBQWEsQ0FBQztnQkFDaEYsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUU7b0JBQy9CLE1BQU0sRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsZUFBZTtvQkFDN0MsU0FBUyxFQUFFLFFBQVEsQ0FBQyxDQUFDLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyx1QkFBdUI7b0JBQzlELFVBQVUsRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLElBQUksQ0FBQyxHQUFHLEVBQUUsR0FBRyxJQUFJLENBQUMsR0FBRyxDQUFDLEtBQUssQ0FBQyxVQUFVLEVBQUUsRUFBRSxDQUFDLEdBQUcsSUFBSSxDQUFDLENBQUMsQ0FBQyxTQUFTO2lCQUN0RixDQUFDLENBQUM7Z0JBQ0gsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1RCxDQUFDO1lBQ0QsSUFBSSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsQ0FBQztnQkFDZixNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQztnQkFDbEcsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM1RCxDQUFDO1lBQ0QsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsTUFBTSxFQUFFLGFBQWEsRUFBRSxDQUFDLENBQUM7UUFDckUsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLENBQUMsS0FBSztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsMkNBQTJDLENBQUMsQ0FBQztRQUNoRixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3RFLElBQUksQ0FBQyxhQUFhLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDO1FBQ3JDLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsS0FBSyxFQUFFLFFBQVEsRUFBRSxTQUFTLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUM1RSxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7WUFDcEcsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxlQUFlLEVBQUUsQ0FBQyxDQUFDO1lBQ25GLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMzQixPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztRQUN0RyxDQUFDO1FBQ0QsSUFBSSxRQUFRLENBQUMsTUFBTSxLQUFLLE9BQU87WUFBRSxPQUFPLE1BQU0sSUFBSSxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNsRSxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQ2hCLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUQsQ0FBQztRQUNELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxZQUFZLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxlQUFlLEVBQUUsQ0FBQztZQUN4RSxxRUFBcUU7WUFDckUsdUVBQXVFO1lBQ3ZFLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFLEVBQUUsTUFBTSxFQUFFLGVBQWUsRUFBRSxTQUFTLEVBQUUsdUJBQXVCLEVBQUUsQ0FBQyxDQUFDO1lBQ2xHLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUQsQ0FBQztRQUNELElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNsQyxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3RDLElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxRQUFRO2dCQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUYsQ0FBQztRQUNELE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxLQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDcEUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxLQUFLLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDbEMsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsS0FBSyxFQUFFLENBQUMsQ0FBQztRQUNuRCxJQUFJLEtBQUssQ0FBQyxNQUFNLEtBQUssT0FBTztZQUFFLE9BQU8sTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQy9ELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUM3QixPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELENBQUM7UUFDRCxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQyxDQUFDO1FBQzNELElBQUksQ0FBQztZQUNILElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsYUFBYSxDQUFDLGVBQWUsQ0FBQyxLQUFLLENBQUMsRUFBRSxNQUFNLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDOUUsQ0FBQztRQUFDLE1BQU0sQ0FBQztZQUNQLHlFQUF5RTtZQUN6RSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUFFLHVCQUF1QixFQUFFLENBQUMsQ0FBQztZQUNsRyxPQUFPLEVBQUUsTUFBTSxFQUFFLFNBQVMsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO1FBQzVELENBQUM7UUFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUM7UUFDaEUsSUFBSSxDQUFDLGFBQWEsQ0FBQyxTQUFTLEVBQUUsTUFBTSxDQUFDLENBQUM7UUFDdEMsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxLQUFLLEVBQUUsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUN2RCxPQUFPLFNBQVMsQ0FBQyxNQUFNLEtBQUssT0FBTztZQUNqQyxDQUFDLENBQUMsTUFBTSxJQUFJLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUMzQixDQUFDLENBQUMsRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7SUFDekQsQ0FBQztJQUVPLEtBQUssQ0FBQyxTQUFTLENBQUMsT0FBNkI7UUFDbkQsSUFBSSxNQUFNLEdBQUcsT0FBTyxDQUFDO1FBQ3JCLE1BQU0sT0FBTyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzQyxNQUFNLGNBQWMsR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxLQUFNLENBQUMsQ0FBQztRQUNsRixLQUFLLE1BQU0sYUFBYSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQzNDLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQ3JDLE1BQU0sVUFBVSxHQUFHLEdBQUcsYUFBYSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUUsQ0FBQztZQUM1RixJQUFJLGFBQWEsQ0FBQyxVQUFVLENBQUMsSUFBSSxLQUFLLEtBQUssSUFBSSxDQUFDLE1BQU0sQ0FBQyxXQUFXLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxFQUFFLENBQUM7Z0JBQ3hGLE1BQU0sSUFBSSxLQUFLLENBQUMsdURBQXVELENBQUMsQ0FBQztZQUMzRSxDQUFDO1lBQ0QsSUFBSSxhQUFhLENBQUMsTUFBTSxLQUFLLE9BQU87Z0JBQUUsU0FBUztZQUMvQyxJQUFJLGFBQWEsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3ZDLE9BQU8sTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxFQUFFLE1BQU0sRUFBRSxRQUFRLEVBQUUsU0FBUyxFQUFFLHNCQUFzQixFQUFFLENBQUMsQ0FBQztZQUMxRixDQUFDO1lBQ0QsTUFBTSxTQUFTLEdBQUcsYUFBYSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssUUFBUSxDQUFDLENBQUM7WUFDcEYsSUFBSSxDQUFDLFNBQVM7Z0JBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyw2QkFBNkIsQ0FBQyxDQUFDO1lBQy9ELE1BQU0sS0FBSyxHQUFHO2dCQUNaLFFBQVEsRUFBRSxtQkFBbUIsYUFBYSxDQUFDLFVBQVUsQ0FBQyxLQUFLLEVBQUU7Z0JBQzdELFNBQVMsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyw0QkFBNEIsQ0FBQyxTQUFTLENBQUM7YUFDdkUsQ0FBQztZQUNGLElBQUksQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsUUFBUSxLQUFLLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDeEgsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxpQkFBaUIsRUFBRSxDQUFDLEdBQUcsTUFBTSxDQUFDLGlCQUFpQixFQUFFLEtBQUssQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNoRyxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDN0IsSUFBSSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7b0JBQ25CLE1BQU0sT0FBTyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztnQkFDOUIsQ0FBQztxQkFBTSxDQUFDO29CQUNOLElBQUksT0FBTyxHQUFHLEtBQUssQ0FBQztvQkFDcEIsS0FBSyxJQUFJLE9BQU8sR0FBRyxDQUFDLEVBQUUsT0FBTyxHQUFHLEdBQUcsRUFBRSxPQUFPLEVBQUUsRUFBRSxDQUFDO3dCQUMvQyxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxjQUFjLEVBQUUsQ0FBQzt3QkFDckMsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxVQUFVLENBQUMsS0FBSyxDQUFDLFFBQVEsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUM7d0JBQzVFLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDLEVBQUUsQ0FBQzs0QkFBQyxPQUFPLEdBQUcsSUFBSSxDQUFDOzRCQUFDLE1BQU07d0JBQUMsQ0FBQzt3QkFDeEYsTUFBTSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsU0FBUyxFQUFFLEVBQUUsTUFBTSxFQUFFLElBQUksQ0FBQyxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUMsQ0FBQztvQkFDcEYsQ0FBQztvQkFDRCxJQUFJLENBQUMsT0FBTzt3QkFBRSxNQUFNLElBQUksS0FBSyxDQUFDLDhCQUE4QixDQUFDLENBQUM7Z0JBQ2hFLENBQUM7Z0JBQ0QsTUFBTSxPQUFPLENBQUMsTUFBTSxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLHFCQUFxQixFQUFFLFNBQVMsRUFBRSxFQUFFLE1BQU0sRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDLENBQUM7Z0JBQ2hILE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQ3ZELE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsa0JBQWtCLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDMUQsQ0FBQztvQkFBUyxDQUFDO2dCQUNULG9FQUFvRTtnQkFDcEUsc0VBQXNFO2dCQUN0RSxNQUFNLE9BQU8sQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUM7Z0JBQzdCLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxFQUFFO29CQUMvQixpQkFBaUIsRUFBRSxNQUFNLENBQUMsaUJBQWlCLENBQUMsTUFBTSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsUUFBUSxLQUFLLEtBQUssQ0FBQyxRQUFRLElBQUksS0FBSyxDQUFDLFNBQVMsS0FBSyxLQUFLLENBQUMsU0FBUyxDQUFDO2lCQUN4SSxDQUFDLENBQUM7WUFDTCxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sTUFBTSxDQUFDO0lBQ2hCLENBQUM7SUFFTyxLQUFLLENBQUMsTUFBTSxDQUFDLE9BQTZCO1FBQ2hELElBQUksTUFBTSxHQUFHLE9BQU8sQ0FBQztRQUNyQixJQUFJLENBQUMsTUFBTSxDQUFDLEtBQUssRUFBRSxXQUFXO1lBQUUsTUFBTSxJQUFJLEtBQUssQ0FBQyx3Q0FBd0MsQ0FBQyxDQUFDO1FBQzFGLE1BQU0sR0FBRyxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsY0FBYyxDQUFDLE1BQU0sQ0FBQyxLQUFLLENBQUMsQ0FBQztRQUNuRSxNQUFNLElBQUksR0FBRyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ3JELE1BQU0sU0FBUyxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUNyRCxNQUFNLFVBQVUsR0FBRyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsT0FBTyxFQUFFLENBQUM7UUFDcEQsTUFBTSxXQUFXLEdBQXNCO1lBQ3JDLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsRUFBRSxFQUFFLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxPQUFPLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRTtZQUNwRSxVQUFVLEVBQUUsTUFBTSxDQUFDLFVBQVUsRUFBRSxHQUFHLEVBQUUsTUFBTSxDQUFDLEdBQUcsRUFBRSxTQUFTLEVBQUUsR0FBRyxFQUFFLFNBQVMsRUFBRSxVQUFVO1lBQ3JGLFVBQVUsRUFBRSxVQUFVLEdBQUcsSUFBSSxDQUFDLEdBQUcsQ0FBQyxFQUFFLEdBQUcsUUFBUSxFQUFFLENBQUMsVUFBVSxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsQ0FBQztTQUMvRSxDQUFDO1FBQ0YsSUFBSSxDQUFDO1lBQ0gsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFdBQVcsRUFBRSxNQUFNLENBQUMsQ0FBQztZQUM5QyxJQUFJLFVBQVUsSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFO2dCQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUN0RixDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLFNBQVMsRUFBRSxxQkFBcUIsRUFBRSxDQUFDLENBQUM7WUFDekYsT0FBTyxFQUFFLE1BQU0sRUFBRSxTQUFTLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztRQUM1RCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzNCLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLGNBQWMsQ0FBQyxDQUFDO1FBQzFELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxzQkFBc0IsRUFBRSxDQUFDO1lBQzdDLE9BQU8sRUFBRSxNQUFNLEVBQUUsU0FBUyxFQUFFLFFBQVEsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUM7UUFDNUQsQ0FBQztRQUNELE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDdkQsTUFBTSxHQUFHLE1BQU0sSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLEVBQUUsRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFNBQVMsRUFBRSxTQUFTLEVBQUUsQ0FBQyxDQUFDO1FBQzVFLE9BQU8sRUFBRSxNQUFNLEVBQUUsT0FBTyxFQUFFLFdBQVcsRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLElBQUksQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO0lBQ3ZFLENBQUM7SUFFTyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQWlDO1FBQ3JELE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLGlCQUFpQixFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDcEcsSUFBSSxDQUFDLE9BQU87WUFBRSxNQUFNLElBQUksS0FBSyxDQUFDLGdDQUFnQyxDQUFDLENBQUM7UUFDaEUsS0FBSyxNQUFNLFVBQVUsSUFBSSxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDNUMsSUFBSSxDQUFDLE1BQU0sT0FBTyxDQUFDLDRCQUE0QixDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQyxDQUFDLEVBQUUsQ0FBQztnQkFDakYsTUFBTSxJQUFJLEtBQUssQ0FBQyw0REFBNEQsQ0FBQyxDQUFDO1lBQ2hGLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxPQUFPLENBQUM7SUFDakIsQ0FBQztJQUVPLEtBQUssQ0FBQyxPQUFPLENBQUMsT0FBNkI7UUFDakQsSUFBSSxNQUFNLEdBQUcsT0FBTyxDQUFDO1FBQ3JCLElBQUksQ0FBQyxNQUFNLENBQUMsaUJBQWlCLENBQUMsTUFBTTtZQUFFLE9BQU87UUFDN0MsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLE9BQU8sQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsaUJBQWlCLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUNwRyxJQUFJLENBQUMsT0FBTztZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMsdUNBQXVDLENBQUMsQ0FBQztRQUN2RSxLQUFLLE1BQU0sS0FBSyxJQUFJLENBQUMsR0FBRyxNQUFNLENBQUMsaUJBQWlCLENBQUMsRUFBRSxDQUFDO1lBQ2xELE1BQU0sT0FBTyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUM3QixNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRTtnQkFDL0IsaUJBQWlCLEVBQUUsTUFBTSxDQUFDLGlCQUFpQixDQUFDLE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLFFBQVEsS0FBSyxLQUFLLENBQUMsUUFBUSxJQUFJLEtBQUssQ0FBQyxTQUFTLEtBQUssS0FBSyxDQUFDLFNBQVMsQ0FBQzthQUN4SSxDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztJQUVPLGNBQWMsQ0FBQyxNQUE0QixFQUFFLFFBQW1DO1FBQ3RGLElBQUksTUFBTSxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsY0FBYztlQUNoRCxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLGNBQWMsS0FBSyxRQUFRLENBQUMsY0FBYztlQUNoRSxNQUFNLENBQUMsaUJBQWlCLEtBQUssUUFBUSxDQUFDLGlCQUFpQixJQUFJLE1BQU0sQ0FBQyxZQUFZLEtBQUssUUFBUSxDQUFDLFlBQVksRUFBRSxDQUFDO1lBQzlHLE1BQU0sSUFBSSxLQUFLLENBQUMsb0NBQW9DLENBQUMsQ0FBQztRQUN4RCxDQUFDO0lBQ0gsQ0FBQztJQUVPLGFBQWEsQ0FBQyxLQUE4QixFQUFFLE1BQTRCO1FBQ2hGLElBQUksQ0FBQyxLQUFLLENBQUMsR0FBRyxJQUFJLEtBQUssQ0FBQyxXQUFXLENBQUMsSUFBSSxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxLQUFLLEtBQUssQ0FBQztlQUNwRSxJQUFJLENBQUMsU0FBUyxDQUFDLCtCQUErQixDQUFDLEtBQUssQ0FBQyxXQUFXLENBQUMsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxLQUFLLElBQUksQ0FBQyxTQUFTLENBQUMsTUFBTSxDQUFDLFdBQVcsQ0FBQyxFQUFFLENBQUM7WUFDM0ksTUFBTSxJQUFJLEtBQUssQ0FBQywyREFBMkQsQ0FBQyxDQUFDO1FBQy9FLENBQUM7SUFDSCxDQUFDO0lBRU8sbUJBQW1CLENBQUMsV0FBOEIsRUFBRSxRQUFtQztRQUM3RixJQUFJLFdBQVcsQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLGNBQWM7ZUFDckQsSUFBSSxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsQ0FBQyxjQUFjLEtBQUssUUFBUSxDQUFDLGNBQWM7ZUFDckUsV0FBVyxDQUFDLGlCQUFpQixLQUFLLFFBQVEsQ0FBQyxpQkFBaUIsSUFBSSxXQUFXLENBQUMsWUFBWSxLQUFLLFFBQVEsQ0FBQyxZQUFZLEVBQUUsQ0FBQztZQUN4SCxNQUFNLElBQUksS0FBSyxDQUFDLHVDQUF1QyxDQUFDLENBQUM7UUFDM0QsQ0FBQztRQUNELE1BQU0sTUFBTSxHQUFHLElBQUksT0FBTyxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3ZFLE1BQU0sS0FBSyxHQUFHLE1BQU0sQ0FBQyxZQUFZLENBQUMsT0FBTyxDQUFDLElBQUksQ0FBQywrQkFBK0IsQ0FBQyxFQUFFLEtBQUssQ0FBQyxNQUFNLEVBQUUsQ0FBQztRQUNoRyxJQUFJLENBQUMsS0FBSyxJQUFJLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLEtBQUssS0FBSyxDQUFDO2VBQ3BELElBQUksQ0FBQyxTQUFTLENBQUMsK0JBQStCLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsS0FBSyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO1lBQ2pJLE1BQU0sSUFBSSxLQUFLLENBQUMsbUVBQW1FLENBQUMsQ0FBQztRQUN2RixDQUFDO1FBQ0QsTUFBTSxJQUFJLEdBQUcsSUFBSSxPQUFPLENBQUMsTUFBTSxDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDdkUsSUFBSSxJQUFJLENBQUMsRUFBRSxJQUFJLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLGdCQUFnQixDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsQ0FBQztlQUN4RixJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsT0FBTyxFQUFFLEtBQUssV0FBVyxDQUFDLFNBQVM7ZUFDNUQsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLE9BQU8sQ0FBQyxDQUFDLE9BQU8sRUFBRSxLQUFLLFdBQVcsQ0FBQyxVQUFVO2VBQzNELFdBQVcsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxHQUFHLE1BQU07ZUFDM0MsQ0FBQyxNQUFNLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxVQUFVLENBQUMsSUFBSSxXQUFXLENBQUMsVUFBVSxJQUFJLFdBQVcsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNsRyxNQUFNLElBQUksS0FBSyxDQUFDLG1EQUFtRCxDQUFDLENBQUM7UUFDdkUsQ0FBQztJQUNILENBQUM7SUFFTyxJQUFJLENBQUMsTUFBNEI7UUFDdkMsT0FBTztZQUNMLGNBQWMsRUFBRSxNQUFNLENBQUMsY0FBYyxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtZQUNwRSxXQUFXLEVBQUUsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUMsRUFBRSxNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU0sRUFBRSxRQUFRLEVBQUUsTUFBTSxDQUFDLFFBQVE7WUFDdEYsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsU0FBUyxFQUFFLE1BQU0sQ0FBQyxTQUFTO1lBQ3hELFNBQVMsRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSxNQUFNLENBQUMsVUFBVTtTQUMzRCxDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxjQUFjLENBQUMsR0FBVztRQUN0QyxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyxPQUFPLENBQUMsS0FBSyxDQUFDLFdBQVcsQ0FBQyxHQUFHLENBQUMsQ0FBQztRQUN6RCxJQUFJLENBQUMsTUFBTTtZQUFFLE1BQU0sSUFBSSxLQUFLLENBQUMscUNBQXFDLENBQUMsQ0FBQztRQUNwRSxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRU8sS0FBSyxDQUFDLElBQUksQ0FBQyxNQUE0QixFQUFFLEtBQ3dCO1FBQ3ZFLE1BQU0sSUFBSSxHQUFHLEVBQUUsR0FBRyxNQUFNLEVBQUUsR0FBRyxLQUFLLEVBQUUsUUFBUSxFQUFFLE1BQU0sQ0FBQyxRQUFRLEdBQUcsQ0FBQyxFQUFFLFNBQVMsRUFBRSxJQUFJLENBQUMsR0FBRyxFQUFFLEVBQUUsQ0FBQztRQUMzRixJQUFJLENBQUMsTUFBTSxJQUFJLENBQUMsT0FBTyxDQUFDLEtBQUssQ0FBQyxxQkFBcUIsQ0FBQyxNQUFNLENBQUMsY0FBYyxFQUFFLE1BQU0sQ0FBQyxRQUFRLEVBQUUsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUNsRyxNQUFNLElBQUksS0FBSyxDQUFDLDJFQUEyRSxDQUFDLENBQUM7UUFDL0YsQ0FBQztRQUNELE9BQU8sSUFBSSxDQUFDO0lBQ2QsQ0FBQztDQUNGIn0=

package/dist_ts/index.d.ts

@@ -1,6 +1,8 @@
 export * from './smartacme.classes.smartacme.js';
 export { SmartacmeCert as Cert } from './smartacme.classes.cert.js';
 export type { ICertManager } from './interfaces/certmanager.js';
+export type * from './interfaces/exact-issuance.js';
+export { normalizeCertificateIdentifiers } from './classes.exact-certificate-issuer.js';
 import * as certmanagers from './certmanagers/index.js';
 export { certmanagers };
 import * as handlers from './handlers/index.js';

package/dist_ts/index.js

@@ -1,5 +1,6 @@
 export * from './smartacme.classes.smartacme.js';
 export { SmartacmeCert as Cert } from './smartacme.classes.cert.js';
+export { normalizeCertificateIdentifiers } from './classes.exact-certificate-issuer.js';
 // certmanagers
 import * as certmanagers from './certmanagers/index.js';
 export { certmanagers };
@@ -9,4 +10,4 @@ export { handlers };
 // server (ACME Directory Server / CA)
 import * as server from '../dist_ts_server/index.js';
 export { server };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGtDQUFrQyxDQUFDO0FBQ2pELE9BQU8sRUFBRSxhQUFhLElBQUksSUFBSSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFHcEUsZUFBZTtBQUNmLE9BQU8sS0FBSyxZQUFZLE1BQU0seUJBQXlCLENBQUM7QUFDeEQsT0FBTyxFQUFFLFlBQVksRUFBRSxDQUFDO0FBRXhCLFdBQVc7QUFDWCxPQUFPLEtBQUssUUFBUSxNQUFNLHFCQUFxQixDQUFDO0FBQ2hELE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUVwQixzQ0FBc0M7QUFDdEMsT0FBTyxLQUFLLE1BQU0sTUFBTSx1QkFBdUIsQ0FBQztBQUNoRCxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi90cy9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLGtDQUFrQyxDQUFDO0FBQ2pELE9BQU8sRUFBRSxhQUFhLElBQUksSUFBSSxFQUFFLE1BQU0sNkJBQTZCLENBQUM7QUFHcEUsT0FBTyxFQUFFLCtCQUErQixFQUFFLE1BQU0sdUNBQXVDLENBQUM7QUFFeEYsZUFBZTtBQUNmLE9BQU8sS0FBSyxZQUFZLE1BQU0seUJBQXlCLENBQUM7QUFDeEQsT0FBTyxFQUFFLFlBQVksRUFBRSxDQUFDO0FBRXhCLFdBQVc7QUFDWCxPQUFPLEtBQUssUUFBUSxNQUFNLHFCQUFxQixDQUFDO0FBQ2hELE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQztBQUVwQixzQ0FBc0M7QUFDdEMsT0FBTyxLQUFLLE1BQU0sTUFBTSx1QkFBdUIsQ0FBQztBQUNoRCxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUMifQ==

package/dist_ts/interfaces/exact-issuance.d.ts

@@ -0,0 +1,79 @@
+import type { IAcmeOrder } from '../acme/acme.interfaces.js';
+/** Explicit identifiers never inherit parent or wildcard coverage. */
+export interface IExactCertificateRequest {
+    namespace: string;
+    identifiers: string[];
+}
+export interface IExactCertificateIdentity extends IExactCertificateRequest {
+    certificateKey: string;
+    directoryUrl: string;
+    accountThumbprint: string;
+}
+export interface IExactCertificate extends IExactCertificateIdentity {
+    id: string;
+    privateKey: string;
+    publicKey: string;
+    csr: string;
+    created: number;
+    validFrom: number;
+    validUntil: number;
+    renewAfter: number;
+}
+export type TExactIssuanceStatus = 'prepared' | 'creating' | 'authorizing' | 'finalizing' | 'ready' | 'failed' | 'indeterminate' | 'abandoned_unverified';
+export type TExactIssuanceErrorCode = 'order_outcome_unknown' | 'order_invalid' | 'authorization_failed' | 'certificate_invalid' | 'challenge_cleanup_pending' | 'rate_limited' | 'transport_unavailable';
+export interface IExactDnsChallenge {
+    hostName: string;
+    challenge: string;
+}
+/** Sensitive durable state. Never return this record through a status API. */
+export interface IExactIssuanceRecord extends IExactCertificateIdentity {
+    issuanceId: string;
+    revision: number;
+    status: TExactIssuanceStatus;
+    createdAt: number;
+    updatedAt: number;
+    privateKey: string;
+    csr: string;
+    order?: IAcmeOrder;
+    pendingChallenges: IExactDnsChallenge[];
+    errorCode?: TExactIssuanceErrorCode;
+    retryAfter?: number;
+}
+/**
+ * Storage must acknowledge durable writes and atomically compare revisions.
+ * A null revision means insert only if absent. No filesystem fallback is used.
+ * Keep unresolved records until their external outcome has been reconciled.
+ */
+export interface IExactIssuanceStore {
+    getAccountKey(accountId: string): Promise<string | null>;
+    createAccountKey(accountId: string, privateKey: string): Promise<boolean>;
+    getIssuance(certificateKey: string): Promise<IExactIssuanceRecord | null>;
+    compareAndSetIssuance(certificateKey: string, expectedRevision: number | null, record: IExactIssuanceRecord): Promise<boolean>;
+    getCertificate(certificateKey: string): Promise<IExactCertificate | null>;
+    storeCertificate(certificate: IExactCertificate): Promise<void>;
+}
+/** Safe status projection; contains neither keys nor challenge material. */
+export interface IExactIssuanceInfo {
+    certificateKey: string;
+    issuanceId: string;
+    identifiers: string[];
+    status: TExactIssuanceStatus;
+    revision: number;
+    createdAt: number;
+    updatedAt: number;
+    errorCode?: TExactIssuanceErrorCode;
+    retryAfter?: number;
+}
+export type TExactCertificateResult = {
+    status: 'ready';
+    certificate: IExactCertificate;
+    issuance: IExactIssuanceInfo;
+} | {
+    status: 'pending';
+    issuance: IExactIssuanceInfo;
+};
+export interface IExactIssuanceRecoveryRequest extends IExactCertificateRequest {
+    issuanceId: string;
+    expectedRevision: number;
+    action: 'recheck' | 'retry-proven-unapplied' | 'abandon';
+}

package/dist_ts/interfaces/exact-issuance.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZXhhY3QtaXNzdWFuY2UuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9pbnRlcmZhY2VzL2V4YWN0LWlzc3VhbmNlLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiIifQ==

package/dist_ts/plugins.d.ts

@@ -1,8 +1,12 @@
 import 'reflect-metadata';
 import * as crypto from 'node:crypto';
+import * as url from 'node:url';
+import * as net from 'node:net';
+import * as timers from 'node:timers/promises';
+import * as x509 from '@peculiar/x509';
 import * as fs from 'fs';
 import * as path from 'path';
-export { crypto, fs, path };
+export { crypto, fs, path, url, net, timers, x509 };
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare };
 import * as lik from '@push.rocks/lik';

package/dist_ts/plugins.js

@@ -2,9 +2,13 @@
 import 'reflect-metadata';
 // node native
 import * as crypto from 'node:crypto';
+import * as url from 'node:url';
+import * as net from 'node:net';
+import * as timers from 'node:timers/promises';
+import * as x509 from '@peculiar/x509';
 import * as fs from 'fs';
 import * as path from 'path';
-export { crypto, fs, path };
+export { crypto, fs, path, url, net, timers, x509 };
 // @apiclient.xyz scope
 import * as cloudflare from '@apiclient.xyz/cloudflare';
 export { cloudflare };
@@ -29,4 +33,4 @@ export { acme };
 // local handlers for challenge types
 import * as handlers from './handlers/index.js';
 export { handlers };
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEseUVBQXlFO0FBQ3pFLE9BQU8sa0JBQWtCLENBQUM7QUFFMUIsY0FBYztBQUNkLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO0FBQ3pCLE9BQU8sS0FBSyxJQUFJLE1BQU0sTUFBTSxDQUFDO0FBRTdCLE9BQU8sRUFBRSxNQUFNLEVBQUUsRUFBRSxFQUFFLElBQUksRUFBRSxDQUFDO0FBRTVCLHVCQUF1QjtBQUN2QixPQUFPLEtBQUssVUFBVSxNQUFNLDJCQUEyQixDQUFDO0FBRXhELE9BQU8sRUFBRSxVQUFVLEVBQUUsQ0FBQztBQUV0QixvQkFBb0I7QUFDcEIsT0FBTyxLQUFLLEdBQUcsTUFBTSxpQkFBaUIsQ0FBQztBQUN2QyxPQUFPLEtBQUssU0FBUyxNQUFNLHVCQUF1QixDQUFDO0FBQ25ELE9BQU8sS0FBSyxVQUFVLE1BQU0sd0JBQXdCLENBQUM7QUFDckQsT0FBTyxLQUFLLGNBQWMsTUFBTSw2QkFBNkIsQ0FBQztBQUM5RCxPQUFPLEtBQUssUUFBUSxNQUFNLHNCQUFzQixDQUFDO0FBQ2pELE9BQU8sS0FBSyxZQUFZLE1BQU0sMEJBQTBCLENBQUM7QUFDekQsT0FBTyxLQUFLLFdBQVcsTUFBTSx5QkFBeUIsQ0FBQztBQUN2RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUVyRCxPQUFPLEVBQ0wsR0FBRyxFQUNILFNBQVMsRUFDVCxVQUFVLEVBQ1YsY0FBYyxFQUNkLFFBQVEsRUFDUixZQUFZLEVBQ1osV0FBVyxFQUNYLFdBQVcsRUFDWCxTQUFTLEVBQ1QsVUFBVSxHQUNYLENBQUM7QUFFRixpQkFBaUI7QUFDakIsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUU1QyxPQUFPLEVBQUUsT0FBTyxFQUFFLENBQUM7QUFFbkIsd0NBQXdDO0FBQ3hDLE9BQU8sS0FBSyxJQUFJLE1BQU0saUJBQWlCLENBQUM7QUFFeEMsT0FBTyxFQUFFLElBQUksRUFBRSxDQUFDO0FBQ2hCLHFDQUFxQztBQUNyQyxPQUFPLEtBQUssUUFBUSxNQUFNLHFCQUFxQixDQUFDO0FBQ2hELE9BQU8sRUFBRSxRQUFRLEVBQUUsQ0FBQyJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoicGx1Z2lucy5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uL3RzL3BsdWdpbnMudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEseUVBQXlFO0FBQ3pFLE9BQU8sa0JBQWtCLENBQUM7QUFFMUIsY0FBYztBQUNkLE9BQU8sS0FBSyxNQUFNLE1BQU0sYUFBYSxDQUFDO0FBQ3RDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxHQUFHLE1BQU0sVUFBVSxDQUFDO0FBQ2hDLE9BQU8sS0FBSyxNQUFNLE1BQU0sc0JBQXNCLENBQUM7QUFDL0MsT0FBTyxLQUFLLElBQUksTUFBTSxnQkFBZ0IsQ0FBQztBQUN2QyxPQUFPLEtBQUssRUFBRSxNQUFNLElBQUksQ0FBQztBQUN6QixPQUFPLEtBQUssSUFBSSxNQUFNLE1BQU0sQ0FBQztBQUU3QixPQUFPLEVBQUUsTUFBTSxFQUFFLEVBQUUsRUFBRSxJQUFJLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxNQUFNLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFFcEQsdUJBQXVCO0FBQ3ZCLE9BQU8sS0FBSyxVQUFVLE1BQU0sMkJBQTJCLENBQUM7QUFFeEQsT0FBTyxFQUFFLFVBQVUsRUFBRSxDQUFDO0FBRXRCLG9CQUFvQjtBQUNwQixPQUFPLEtBQUssR0FBRyxNQUFNLGlCQUFpQixDQUFDO0FBQ3ZDLE9BQU8sS0FBSyxTQUFTLE1BQU0sdUJBQXVCLENBQUM7QUFDbkQsT0FBTyxLQUFLLFVBQVUsTUFBTSx3QkFBd0IsQ0FBQztBQUNyRCxPQUFPLEtBQUssY0FBYyxNQUFNLDZCQUE2QixDQUFDO0FBQzlELE9BQU8sS0FBSyxRQUFRLE1BQU0sc0JBQXNCLENBQUM7QUFDakQsT0FBTyxLQUFLLFlBQVksTUFBTSwwQkFBMEIsQ0FBQztBQUN6RCxPQUFPLEtBQUssV0FBVyxNQUFNLHlCQUF5QixDQUFDO0FBQ3ZELE9BQU8sS0FBSyxXQUFXLE1BQU0seUJBQXlCLENBQUM7QUFDdkQsT0FBTyxLQUFLLFNBQVMsTUFBTSx1QkFBdUIsQ0FBQztBQUNuRCxPQUFPLEtBQUssVUFBVSxNQUFNLHdCQUF3QixDQUFDO0FBRXJELE9BQU8sRUFDTCxHQUFHLEVBQ0gsU0FBUyxFQUNULFVBQVUsRUFDVixjQUFjLEVBQ2QsUUFBUSxFQUNSLFlBQVksRUFDWixXQUFXLEVBQ1gsV0FBVyxFQUNYLFNBQVMsRUFDVCxVQUFVLEdBQ1gsQ0FBQztBQUVGLGlCQUFpQjtBQUNqQixPQUFPLEtBQUssT0FBTyxNQUFNLGtCQUFrQixDQUFDO0FBRTVDLE9BQU8sRUFBRSxPQUFPLEVBQUUsQ0FBQztBQUVuQix3Q0FBd0M7QUFDeEMsT0FBTyxLQUFLLElBQUksTUFBTSxpQkFBaUIsQ0FBQztBQUV4QyxPQUFPLEVBQUUsSUFBSSxFQUFFLENBQUM7QUFDaEIscUNBQXFDO0FBQ3JDLE9BQU8sS0FBSyxRQUFRLE1BQU0scUJBQXFCLENBQUM7QUFDaEQsT0FBTyxFQUFFLFFBQVEsRUFBRSxDQUFDIn0=

package/dist_ts/smartacme.classes.smartacme.d.ts

@@ -1,6 +1,7 @@
 import * as plugins from './plugins.js';
 import type { ICertManager } from './interfaces/certmanager.js';
 import { SmartacmeCert } from './smartacme.classes.cert.js';
+import type { IExactCertificateIdentity, IExactCertificateRequest, IExactIssuanceRecoveryRequest, IExactIssuanceStore, IExactIssuanceInfo, TExactCertificateResult } from './interfaces/exact-issuance.js';
 /**
  * the options for the class @see SmartAcme
  */
@@ -12,6 +13,14 @@ export interface ISmartAcmeOptions {
      */
     certManager: ICertManager;
     environment: 'production' | 'integration';
+    /** Optional explicit ACME directory, for private CAs and isolated integration. */
+    directoryUrl?: string;
+    /** Enables isolated explicit-identifier issuance with durable recovery. */
+    exactIssuanceStore?: IExactIssuanceStore;
+    /** Bounded number of admitted exact-identity operations (default 64). */
+    maxPendingExactRequests?: number;
+    /** DNS propagation grace period for explicit issuance; defaults to 60 seconds. */
+    exactDnsPropagationDelayMs?: number;
     /**
      * Optional retry/backoff configuration for transient failures
      */
@@ -66,6 +75,10 @@ export declare class SmartAcme {
     private smartdns;
     logger: plugins.smartlog.Smartlog;
     private privateKey;
+    private exactIssuer?;
+    private exactRequests;
+    private lifecycleAbort;
+    private started;
     certmanager: ICertManager;
     challengeHandlers: plugins.handlers.IChallengeHandler<any>[];
     private certmatcher;
@@ -92,6 +105,15 @@ export declare class SmartAcme {
      * Stops the SmartAcme instance and closes certificate store connections.
      */
     stop(): Promise<void>;
+    /** Bind durable work to the current account and issuer without creating an order. */
+    getCertificateIdentity(request: IExactCertificateRequest): IExactCertificateIdentity;
+    /** Ensure a certificate whose SANs exactly match the explicit identifiers. */
+    getCertificateForIdentifiers(request: IExactCertificateRequest): Promise<TExactCertificateResult>;
+    getCertificateIssuanceStatus(request: IExactCertificateRequest): Promise<IExactIssuanceInfo | null>;
+    /** Administrative recovery; embedding services must authorize the caller. */
+    recoverCertificateIssuance(request: IExactIssuanceRecoveryRequest): Promise<TExactCertificateResult>;
+    private requireExactIssuer;
+    private runExact;
     /** Retry helper with exponential backoff and AcmeError awareness */
     private retry;
     /** Clean up pending challenges and shut down */