@serve.zone/dcrouter 11.0.5 → 11.0.8

package/dist_ts/opsserver/handlers/certificate.handler.js

@@ -0,0 +1,421 @@
+import * as plugins from '../../plugins.js';
+import * as interfaces from '../../../dist_ts_interfaces/index.js';
+export class CertificateHandler {
+    opsServerRef;
+    constructor(opsServerRef) {
+        this.opsServerRef = opsServerRef;
+        this.registerHandlers();
+    }
+    registerHandlers() {
+        const viewRouter = this.opsServerRef.viewRouter;
+        const adminRouter = this.opsServerRef.adminRouter;
+        // ---- Read endpoints (viewRouter — valid identity required via middleware) ----
+        // Get Certificate Overview
+        viewRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('getCertificateOverview', async (dataArg) => {
+            const certificates = await this.buildCertificateOverview();
+            const summary = this.buildSummary(certificates);
+            return { certificates, summary };
+        }));
+        // ---- Write endpoints (adminRouter — admin identity required via middleware) ----
+        // Legacy route-based reprovision (backward compat)
+        adminRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('reprovisionCertificate', async (dataArg) => {
+            return this.reprovisionCertificateByRoute(dataArg.routeName);
+        }));
+        // Domain-based reprovision (preferred)
+        adminRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('reprovisionCertificateDomain', async (dataArg) => {
+            return this.reprovisionCertificateDomain(dataArg.domain);
+        }));
+        // Delete certificate
+        adminRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('deleteCertificate', async (dataArg) => {
+            return this.deleteCertificate(dataArg.domain);
+        }));
+        // Export certificate
+        adminRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('exportCertificate', async (dataArg) => {
+            return this.exportCertificate(dataArg.domain);
+        }));
+        // Import certificate
+        adminRouter.addTypedHandler(new plugins.typedrequest.TypedHandler('importCertificate', async (dataArg) => {
+            return this.importCertificate(dataArg.cert);
+        }));
+    }
+    /**
+     * Build domain-centric certificate overview.
+     * Instead of one row per route, we produce one row per unique domain.
+     */
+    async buildCertificateOverview() {
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const smartProxy = dcRouter.smartProxy;
+        if (!smartProxy)
+            return [];
+        const routes = smartProxy.routeManager.getRoutes();
+        // Phase 1: Collect unique domains with their associated route info
+        const domainMap = new Map();
+        for (const route of routes) {
+            if (!route.name)
+                continue;
+            const tls = route.action?.tls;
+            if (!tls)
+                continue;
+            // Skip passthrough routes - they don't manage certificates
+            if (tls.mode === 'passthrough')
+                continue;
+            const routeDomains = route.match.domains
+                ? (Array.isArray(route.match.domains) ? route.match.domains : [route.match.domains])
+                : [];
+            // Determine source
+            let source = 'none';
+            if (tls.certificate === 'auto') {
+                if (smartProxy.settings.certProvisionFunction) {
+                    source = 'provision-function';
+                }
+                else {
+                    source = 'acme';
+                }
+            }
+            else if (tls.certificate && typeof tls.certificate === 'object') {
+                source = 'static';
+            }
+            const canReprovision = source === 'acme' || source === 'provision-function';
+            const tlsMode = tls.mode;
+            for (const domain of routeDomains) {
+                const existing = domainMap.get(domain);
+                if (existing) {
+                    // Add this route name to the existing domain entry
+                    if (!existing.routeNames.includes(route.name)) {
+                        existing.routeNames.push(route.name);
+                    }
+                    // Upgrade source if more specific
+                    if (existing.source === 'none' && source !== 'none') {
+                        existing.source = source;
+                        existing.canReprovision = canReprovision;
+                    }
+                }
+                else {
+                    domainMap.set(domain, {
+                        routeNames: [route.name],
+                        source,
+                        tlsMode,
+                        canReprovision,
+                    });
+                }
+            }
+        }
+        // Phase 2: Resolve status for each unique domain
+        const certificates = [];
+        for (const [domain, info] of domainMap) {
+            let status = 'unknown';
+            let expiryDate;
+            let issuedAt;
+            let issuer;
+            let error;
+            // Check event-based status from certificateStatusMap (now keyed by domain)
+            const eventStatus = dcRouter.certificateStatusMap.get(domain);
+            if (eventStatus) {
+                status = eventStatus.status;
+                expiryDate = eventStatus.expiryDate;
+                issuedAt = eventStatus.issuedAt;
+                error = eventStatus.error;
+                if (eventStatus.source) {
+                    issuer = eventStatus.source;
+                }
+            }
+            // Try SmartProxy certificate status if no event data
+            if (status === 'unknown' && info.routeNames.length > 0) {
+                try {
+                    const rustStatus = await smartProxy.getCertificateStatus(info.routeNames[0]);
+                    if (rustStatus) {
+                        if (rustStatus.expiryDate)
+                            expiryDate = rustStatus.expiryDate;
+                        if (rustStatus.issuer)
+                            issuer = rustStatus.issuer;
+                        if (rustStatus.issuedAt)
+                            issuedAt = rustStatus.issuedAt;
+                        if (rustStatus.status === 'valid' || rustStatus.status === 'expired') {
+                            status = rustStatus.status;
+                        }
+                    }
+                }
+                catch {
+                    // Rust bridge may not support this command yet — ignore
+                }
+            }
+            // Check persisted cert data from StorageManager
+            if (status === 'unknown') {
+                const cleanDomain = domain.replace(/^\*\.?/, '');
+                let certData = await dcRouter.storageManager.getJSON(`/certs/${cleanDomain}`);
+                if (!certData) {
+                    // Also check certStore path (proxy-certs)
+                    certData = await dcRouter.storageManager.getJSON(`/proxy-certs/${domain}`);
+                }
+                if (certData?.validUntil) {
+                    expiryDate = new Date(certData.validUntil).toISOString();
+                    if (certData.created) {
+                        issuedAt = new Date(certData.created).toISOString();
+                    }
+                    issuer = 'smartacme-dns-01';
+                }
+                else if (certData?.publicKey) {
+                    // certStore has the cert — parse PEM for expiry
+                    try {
+                        const x509 = new plugins.crypto.X509Certificate(certData.publicKey);
+                        expiryDate = new Date(x509.validTo).toISOString();
+                        issuedAt = new Date(x509.validFrom).toISOString();
+                    }
+                    catch { /* PEM parsing failed */ }
+                    status = 'valid';
+                    issuer = 'cert-store';
+                }
+                else if (certData) {
+                    status = 'valid';
+                    issuer = 'cert-store';
+                }
+            }
+            // Compute status from expiry date
+            if (expiryDate && (status === 'valid' || status === 'unknown')) {
+                const expiry = new Date(expiryDate);
+                const now = new Date();
+                const daysUntilExpiry = (expiry.getTime() - now.getTime()) / (1000 * 60 * 60 * 24);
+                if (daysUntilExpiry < 0) {
+                    status = 'expired';
+                }
+                else if (daysUntilExpiry < 30) {
+                    status = 'expiring';
+                }
+                else {
+                    status = 'valid';
+                }
+            }
+            // Static certs with no other info default to 'valid'
+            if (info.source === 'static' && status === 'unknown') {
+                status = 'valid';
+            }
+            // ACME/provision-function routes with no cert data are still provisioning
+            if (status === 'unknown' && (info.source === 'acme' || info.source === 'provision-function')) {
+                status = 'provisioning';
+            }
+            // Phase 3: Attach backoff info
+            let backoffInfo;
+            if (dcRouter.certProvisionScheduler) {
+                const bi = await dcRouter.certProvisionScheduler.getBackoffInfo(domain);
+                if (bi) {
+                    backoffInfo = bi;
+                }
+            }
+            certificates.push({
+                domain,
+                routeNames: info.routeNames,
+                status,
+                source: info.source,
+                tlsMode: info.tlsMode,
+                expiryDate,
+                issuer,
+                issuedAt,
+                error,
+                canReprovision: info.canReprovision,
+                backoffInfo,
+            });
+        }
+        return certificates;
+    }
+    buildSummary(certificates) {
+        const summary = { total: 0, valid: 0, expiring: 0, expired: 0, failed: 0, unknown: 0 };
+        summary.total = certificates.length;
+        for (const cert of certificates) {
+            switch (cert.status) {
+                case 'valid':
+                    summary.valid++;
+                    break;
+                case 'expiring':
+                    summary.expiring++;
+                    break;
+                case 'expired':
+                    summary.expired++;
+                    break;
+                case 'failed':
+                    summary.failed++;
+                    break;
+                case 'provisioning': // count as unknown
+                case 'unknown':
+                    summary.unknown++;
+                    break;
+            }
+        }
+        return summary;
+    }
+    /**
+     * Legacy route-based reprovisioning
+     */
+    async reprovisionCertificateByRoute(routeName) {
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const smartProxy = dcRouter.smartProxy;
+        if (!smartProxy) {
+            return { success: false, message: 'SmartProxy is not running' };
+        }
+        try {
+            await smartProxy.provisionCertificate(routeName);
+            // Clear event-based status for domains in this route
+            for (const [domain, entry] of dcRouter.certificateStatusMap) {
+                if (entry.routeNames.includes(routeName)) {
+                    dcRouter.certificateStatusMap.delete(domain);
+                }
+            }
+            return { success: true, message: `Certificate reprovisioning triggered for route '${routeName}'` };
+        }
+        catch (err) {
+            return { success: false, message: err.message || 'Failed to reprovision certificate' };
+        }
+    }
+    /**
+     * Domain-based reprovisioning — clears backoff first, then triggers provision
+     */
+    async reprovisionCertificateDomain(domain) {
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const smartProxy = dcRouter.smartProxy;
+        if (!smartProxy) {
+            return { success: false, message: 'SmartProxy is not running' };
+        }
+        // Clear backoff for this domain (user override)
+        if (dcRouter.certProvisionScheduler) {
+            await dcRouter.certProvisionScheduler.clearBackoff(domain);
+        }
+        // Clear status map entry so it gets refreshed
+        dcRouter.certificateStatusMap.delete(domain);
+        // Try to provision via SmartAcme directly
+        if (dcRouter.smartAcme) {
+            try {
+                await dcRouter.smartAcme.getCertificateForDomain(domain);
+                return { success: true, message: `Certificate reprovisioning triggered for domain '${domain}'` };
+            }
+            catch (err) {
+                return { success: false, message: err.message || `Failed to reprovision certificate for ${domain}` };
+            }
+        }
+        // Fallback: try provisioning via the first matching route
+        const routeNames = dcRouter.findRouteNamesForDomain(domain);
+        if (routeNames.length > 0) {
+            try {
+                await smartProxy.provisionCertificate(routeNames[0]);
+                return { success: true, message: `Certificate reprovisioning triggered for domain '${domain}' via route '${routeNames[0]}'` };
+            }
+            catch (err) {
+                return { success: false, message: err.message || `Failed to reprovision certificate for ${domain}` };
+            }
+        }
+        return { success: false, message: `No routes found for domain '${domain}'` };
+    }
+    /**
+     * Delete certificate data for a domain from storage
+     */
+    async deleteCertificate(domain) {
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const cleanDomain = domain.replace(/^\*\.?/, '');
+        // Delete from all known storage paths
+        const paths = [
+            `/proxy-certs/${domain}`,
+            `/proxy-certs/${cleanDomain}`,
+            `/certs/${cleanDomain}`,
+        ];
+        for (const path of paths) {
+            try {
+                await dcRouter.storageManager.delete(path);
+            }
+            catch {
+                // Path may not exist — ignore
+            }
+        }
+        // Clear from in-memory status map
+        dcRouter.certificateStatusMap.delete(domain);
+        // Clear backoff info
+        if (dcRouter.certProvisionScheduler) {
+            await dcRouter.certProvisionScheduler.clearBackoff(domain);
+        }
+        return { success: true, message: `Certificate data deleted for '${domain}'` };
+    }
+    /**
+     * Export certificate data for a domain as ICert-shaped JSON
+     */
+    async exportCertificate(domain) {
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const cleanDomain = domain.replace(/^\*\.?/, '');
+        // Try SmartAcme /certs/ path first (has full ICert fields)
+        let certData = await dcRouter.storageManager.getJSON(`/certs/${cleanDomain}`);
+        if (certData && certData.publicKey && certData.privateKey) {
+            return {
+                success: true,
+                cert: {
+                    id: certData.id || plugins.crypto.randomUUID(),
+                    domainName: certData.domainName || domain,
+                    created: certData.created || Date.now(),
+                    validUntil: certData.validUntil || 0,
+                    privateKey: certData.privateKey,
+                    publicKey: certData.publicKey,
+                    csr: certData.csr || '',
+                },
+            };
+        }
+        // Fallback: try /proxy-certs/ with original domain
+        certData = await dcRouter.storageManager.getJSON(`/proxy-certs/${domain}`);
+        if (!certData || !certData.publicKey) {
+            // Try with clean domain
+            certData = await dcRouter.storageManager.getJSON(`/proxy-certs/${cleanDomain}`);
+        }
+        if (certData && certData.publicKey && certData.privateKey) {
+            return {
+                success: true,
+                cert: {
+                    id: plugins.crypto.randomUUID(),
+                    domainName: domain,
+                    created: certData.validFrom || Date.now(),
+                    validUntil: certData.validUntil || 0,
+                    privateKey: certData.privateKey,
+                    publicKey: certData.publicKey,
+                    csr: '',
+                },
+            };
+        }
+        return { success: false, message: `No certificate data found for '${domain}'` };
+    }
+    /**
+     * Import a certificate from ICert-shaped JSON
+     */
+    async importCertificate(cert) {
+        // Validate PEM content
+        if (!cert.publicKey || !cert.publicKey.includes('-----BEGIN CERTIFICATE-----')) {
+            return { success: false, message: 'Invalid publicKey: must contain a PEM-encoded certificate' };
+        }
+        if (!cert.privateKey || !cert.privateKey.includes('-----BEGIN')) {
+            return { success: false, message: 'Invalid privateKey: must contain a PEM-encoded key' };
+        }
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const cleanDomain = cert.domainName.replace(/^\*\.?/, '');
+        // Save to /certs/ (SmartAcme-compatible path)
+        await dcRouter.storageManager.setJSON(`/certs/${cleanDomain}`, {
+            id: cert.id,
+            domainName: cert.domainName,
+            created: cert.created,
+            validUntil: cert.validUntil,
+            privateKey: cert.privateKey,
+            publicKey: cert.publicKey,
+            csr: cert.csr || '',
+        });
+        // Also save to /proxy-certs/ (proxy-cert format)
+        await dcRouter.storageManager.setJSON(`/proxy-certs/${cert.domainName}`, {
+            domain: cert.domainName,
+            publicKey: cert.publicKey,
+            privateKey: cert.privateKey,
+            ca: undefined,
+            validUntil: cert.validUntil,
+            validFrom: cert.created,
+        });
+        // Update in-memory status map
+        dcRouter.certificateStatusMap.set(cert.domainName, {
+            status: 'valid',
+            source: 'static',
+            expiryDate: cert.validUntil ? new Date(cert.validUntil).toISOString() : undefined,
+            issuedAt: cert.created ? new Date(cert.created).toISOString() : undefined,
+            routeNames: [],
+        });
+        return { success: true, message: `Certificate imported for '${cert.domainName}'` };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2VydGlmaWNhdGUuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL29wc3NlcnZlci9oYW5kbGVycy9jZXJ0aWZpY2F0ZS5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxLQUFLLFVBQVUsTUFBTSxpQ0FBaUMsQ0FBQztBQUU5RCxNQUFNLE9BQU8sa0JBQWtCO0lBQ1Q7SUFBcEIsWUFBb0IsWUFBdUI7UUFBdkIsaUJBQVksR0FBWixZQUFZLENBQVc7UUFDekMsSUFBSSxDQUFDLGdCQUFnQixFQUFFLENBQUM7SUFDMUIsQ0FBQztJQUVPLGdCQUFnQjtRQUN0QixNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQztRQUNoRCxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztRQUVsRCxpRkFBaUY7UUFFakYsMkJBQTJCO1FBQzNCLFVBQVUsQ0FBQyxlQUFlLENBQ3hCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLHdCQUF3QixFQUN4QixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxZQUFZLEdBQUcsTUFBTSxJQUFJLENBQUMsd0JBQXdCLEVBQUUsQ0FBQztZQUMzRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FBQyxDQUFDO1lBQ2hELE9BQU8sRUFBRSxZQUFZLEVBQUUsT0FBTyxFQUFFLENBQUM7UUFDbkMsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLG1GQUFtRjtRQUVuRixtREFBbUQ7UUFDbkQsV0FBVyxDQUFDLGVBQWUsQ0FDekIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDbkMsd0JBQXdCLEVBQ3hCLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNoQixPQUFPLElBQUksQ0FBQyw2QkFBNkIsQ0FBQyxPQUFPLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDL0QsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLHVDQUF1QztRQUN2QyxXQUFXLENBQUMsZUFBZSxDQUN6QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUNuQyw4QkFBOEIsRUFDOUIsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLE9BQU8sSUFBSSxDQUFDLDRCQUE0QixDQUFDLE9BQU8sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUMzRCxDQUFDLENBQ0YsQ0FDRixDQUFDO1FBRUYscUJBQXFCO1FBQ3JCLFdBQVcsQ0FBQyxlQUFlLENBQ3pCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLG1CQUFtQixFQUNuQixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsT0FBTyxJQUFJLENBQUMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQ2hELENBQUMsQ0FDRixDQUNGLENBQUM7UUFFRixxQkFBcUI7UUFDckIsV0FBVyxDQUFDLGVBQWUsQ0FDekIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDbkMsbUJBQW1CLEVBQ25CLEtBQUssRUFBRSxPQUFPLEVBQUUsRUFBRTtZQUNoQixPQUFPLElBQUksQ0FBQyxpQkFBaUIsQ0FBQyxPQUFPLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDaEQsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLHFCQUFxQjtRQUNyQixXQUFXLENBQUMsZUFBZSxDQUN6QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUNuQyxtQkFBbUIsRUFDbkIsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLE9BQU8sSUFBSSxDQUFDLGlCQUFpQixDQUFDLE9BQU8sQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUM5QyxDQUFDLENBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUVEOzs7T0FHRztJQUNLLEtBQUssQ0FBQyx3QkFBd0I7UUFDcEMsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7UUFDL0MsTUFBTSxVQUFVLEdBQUcsUUFBUSxDQUFDLFVBQVUsQ0FBQztRQUN2QyxJQUFJLENBQUMsVUFBVTtZQUFFLE9BQU8sRUFBRSxDQUFDO1FBRTNCLE1BQU0sTUFBTSxHQUFHLFVBQVUsQ0FBQyxZQUFZLENBQUMsU0FBUyxFQUFFLENBQUM7UUFFbkQsbUVBQW1FO1FBQ25FLE1BQU0sU0FBUyxHQUFHLElBQUksR0FBRyxFQUtyQixDQUFDO1FBRUwsS0FBSyxNQUFNLEtBQUssSUFBSSxNQUFNLEVBQUUsQ0FBQztZQUMzQixJQUFJLENBQUMsS0FBSyxDQUFDLElBQUk7Z0JBQUUsU0FBUztZQUUxQixNQUFNLEdBQUcsR0FBRyxLQUFLLENBQUMsTUFBTSxFQUFFLEdBQUcsQ0FBQztZQUM5QixJQUFJLENBQUMsR0FBRztnQkFBRSxTQUFTO1lBRW5CLDJEQUEyRDtZQUMzRCxJQUFJLEdBQUcsQ0FBQyxJQUFJLEtBQUssYUFBYTtnQkFBRSxTQUFTO1lBRXpDLE1BQU0sWUFBWSxHQUFHLEtBQUssQ0FBQyxLQUFLLENBQUMsT0FBTztnQkFDdEMsQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUMsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE9BQU8sQ0FBQyxDQUFDO2dCQUNwRixDQUFDLENBQUMsRUFBRSxDQUFDO1lBRVAsbUJBQW1CO1lBQ25CLElBQUksTUFBTSxHQUEyQyxNQUFNLENBQUM7WUFDNUQsSUFBSSxHQUFHLENBQUMsV0FBVyxLQUFLLE1BQU0sRUFBRSxDQUFDO2dCQUMvQixJQUFLLFVBQVUsQ0FBQyxRQUFnQixDQUFDLHFCQUFxQixFQUFFLENBQUM7b0JBQ3ZELE1BQU0sR0FBRyxvQkFBb0IsQ0FBQztnQkFDaEMsQ0FBQztxQkFBTSxDQUFDO29CQUNOLE1BQU0sR0FBRyxNQUFNLENBQUM7Z0JBQ2xCLENBQUM7WUFDSCxDQUFDO2lCQUFNLElBQUksR0FBRyxDQUFDLFdBQVcsSUFBSSxPQUFPLEdBQUcsQ0FBQyxXQUFXLEtBQUssUUFBUSxFQUFFLENBQUM7Z0JBQ2xFLE1BQU0sR0FBRyxRQUFRLENBQUM7WUFDcEIsQ0FBQztZQUVELE1BQU0sY0FBYyxHQUFHLE1BQU0sS0FBSyxNQUFNLElBQUksTUFBTSxLQUFLLG9CQUFvQixDQUFDO1lBQzVFLE1BQU0sT0FBTyxHQUFHLEdBQUcsQ0FBQyxJQUErRCxDQUFDO1lBRXBGLEtBQUssTUFBTSxNQUFNLElBQUksWUFBWSxFQUFFLENBQUM7Z0JBQ2xDLE1BQU0sUUFBUSxHQUFHLFNBQVMsQ0FBQyxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQ3ZDLElBQUksUUFBUSxFQUFFLENBQUM7b0JBQ2IsbURBQW1EO29CQUNuRCxJQUFJLENBQUMsUUFBUSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7d0JBQzlDLFFBQVEsQ0FBQyxVQUFVLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsQ0FBQztvQkFDdkMsQ0FBQztvQkFDRCxrQ0FBa0M7b0JBQ2xDLElBQUksUUFBUSxDQUFDLE1BQU0sS0FBSyxNQUFNLElBQUksTUFBTSxLQUFLLE1BQU0sRUFBRSxDQUFDO3dCQUNwRCxRQUFRLENBQUMsTUFBTSxHQUFHLE1BQU0sQ0FBQzt3QkFDekIsUUFBUSxDQUFDLGNBQWMsR0FBRyxjQUFjLENBQUM7b0JBQzNDLENBQUM7Z0JBQ0gsQ0FBQztxQkFBTSxDQUFDO29CQUNOLFNBQVMsQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFO3dCQUNwQixVQUFVLEVBQUUsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDO3dCQUN4QixNQUFNO3dCQUNOLE9BQU87d0JBQ1AsY0FBYztxQkFDZixDQUFDLENBQUM7Z0JBQ0wsQ0FBQztZQUNILENBQUM7UUFDSCxDQUFDO1FBRUQsaURBQWlEO1FBQ2pELE1BQU0sWUFBWSxHQUEyQyxFQUFFLENBQUM7UUFFaEUsS0FBSyxNQUFNLENBQUMsTUFBTSxFQUFFLElBQUksQ0FBQyxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQ3ZDLElBQUksTUFBTSxHQUEyQyxTQUFTLENBQUM7WUFDL0QsSUFBSSxVQUE4QixDQUFDO1lBQ25DLElBQUksUUFBNEIsQ0FBQztZQUNqQyxJQUFJLE1BQTBCLENBQUM7WUFDL0IsSUFBSSxLQUF5QixDQUFDO1lBRTlCLDJFQUEyRTtZQUMzRSxNQUFNLFdBQVcsR0FBRyxRQUFRLENBQUMsb0JBQW9CLENBQUMsR0FBRyxDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQzlELElBQUksV0FBVyxFQUFFLENBQUM7Z0JBQ2hCLE1BQU0sR0FBRyxXQUFXLENBQUMsTUFBTSxDQUFDO2dCQUM1QixVQUFVLEdBQUcsV0FBVyxDQUFDLFVBQVUsQ0FBQztnQkFDcEMsUUFBUSxHQUFHLFdBQVcsQ0FBQyxRQUFRLENBQUM7Z0JBQ2hDLEtBQUssR0FBRyxXQUFXLENBQUMsS0FBSyxDQUFDO2dCQUMxQixJQUFJLFdBQVcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztvQkFDdkIsTUFBTSxHQUFHLFdBQVcsQ0FBQyxNQUFNLENBQUM7Z0JBQzlCLENBQUM7WUFDSCxDQUFDO1lBRUQscURBQXFEO1lBQ3JELElBQUksTUFBTSxLQUFLLFNBQVMsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDdkQsSUFBSSxDQUFDO29CQUNILE1BQU0sVUFBVSxHQUFHLE1BQU0sVUFBVSxDQUFDLG9CQUFvQixDQUFDLElBQUksQ0FBQyxVQUFVLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztvQkFDN0UsSUFBSSxVQUFVLEVBQUUsQ0FBQzt3QkFDZixJQUFJLFVBQVUsQ0FBQyxVQUFVOzRCQUFFLFVBQVUsR0FBRyxVQUFVLENBQUMsVUFBVSxDQUFDO3dCQUM5RCxJQUFJLFVBQVUsQ0FBQyxNQUFNOzRCQUFFLE1BQU0sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO3dCQUNsRCxJQUFJLFVBQVUsQ0FBQyxRQUFROzRCQUFFLFFBQVEsR0FBRyxVQUFVLENBQUMsUUFBUSxDQUFDO3dCQUN4RCxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssT0FBTyxJQUFJLFVBQVUsQ0FBQyxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7NEJBQ3JFLE1BQU0sR0FBRyxVQUFVLENBQUMsTUFBTSxDQUFDO3dCQUM3QixDQUFDO29CQUNILENBQUM7Z0JBQ0gsQ0FBQztnQkFBQyxNQUFNLENBQUM7b0JBQ1Asd0RBQXdEO2dCQUMxRCxDQUFDO1lBQ0gsQ0FBQztZQUVELGdEQUFnRDtZQUNoRCxJQUFJLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDekIsTUFBTSxXQUFXLEdBQUcsTUFBTSxDQUFDLE9BQU8sQ0FBQyxRQUFRLEVBQUUsRUFBRSxDQUFDLENBQUM7Z0JBQ2pELElBQUksUUFBUSxHQUFHLE1BQU0sUUFBUSxDQUFDLGNBQWMsQ0FBQyxPQUFPLENBQUMsVUFBVSxXQUFXLEVBQUUsQ0FBQyxDQUFDO2dCQUM5RSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7b0JBQ2QsMENBQTBDO29CQUMxQyxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsTUFBTSxFQUFFLENBQUMsQ0FBQztnQkFDN0UsQ0FBQztnQkFDRCxJQUFJLFFBQVEsRUFBRSxVQUFVLEVBQUUsQ0FBQztvQkFDekIsVUFBVSxHQUFHLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxVQUFVLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDekQsSUFBSSxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7d0JBQ3JCLFFBQVEsR0FBRyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUM7b0JBQ3RELENBQUM7b0JBQ0QsTUFBTSxHQUFHLGtCQUFrQixDQUFDO2dCQUM5QixDQUFDO3FCQUFNLElBQUksUUFBUSxFQUFFLFNBQVMsRUFBRSxDQUFDO29CQUMvQixnREFBZ0Q7b0JBQ2hELElBQUksQ0FBQzt3QkFDSCxNQUFNLElBQUksR0FBRyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsQ0FBQzt3QkFDcEUsVUFBVSxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQzt3QkFDbEQsUUFBUSxHQUFHLElBQUksSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxXQUFXLEVBQUUsQ0FBQztvQkFDcEQsQ0FBQztvQkFBQyxNQUFNLENBQUMsQ0FBQyx3QkFBd0IsQ0FBQyxDQUFDO29CQUNwQyxNQUFNLEdBQUcsT0FBTyxDQUFDO29CQUNqQixNQUFNLEdBQUcsWUFBWSxDQUFDO2dCQUN4QixDQUFDO3FCQUFNLElBQUksUUFBUSxFQUFFLENBQUM7b0JBQ3BCLE1BQU0sR0FBRyxPQUFPLENBQUM7b0JBQ2pCLE1BQU0sR0FBRyxZQUFZLENBQUM7Z0JBQ3hCLENBQUM7WUFDSCxDQUFDO1lBRUQsa0NBQWtDO1lBQ2xDLElBQUksVUFBVSxJQUFJLENBQUMsTUFBTSxLQUFLLE9BQU8sSUFBSSxNQUFNLEtBQUssU0FBUyxDQUFDLEVBQUUsQ0FBQztnQkFDL0QsTUFBTSxNQUFNLEdBQUcsSUFBSSxJQUFJLENBQUMsVUFBVSxDQUFDLENBQUM7Z0JBQ3BDLE1BQU0sR0FBRyxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQ3ZCLE1BQU0sZUFBZSxHQUFHLENBQUMsTUFBTSxDQUFDLE9BQU8sRUFBRSxHQUFHLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxHQUFHLENBQUMsSUFBSSxHQUFHLEVBQUUsR0FBRyxFQUFFLEdBQUcsRUFBRSxDQUFDLENBQUM7Z0JBRW5GLElBQUksZUFBZSxHQUFHLENBQUMsRUFBRSxDQUFDO29CQUN4QixNQUFNLEdBQUcsU0FBUyxDQUFDO2dCQUNyQixDQUFDO3FCQUFNLElBQUksZUFBZSxHQUFHLEVBQUUsRUFBRSxDQUFDO29CQUNoQyxNQUFNLEdBQUcsVUFBVSxDQUFDO2dCQUN0QixDQUFDO3FCQUFNLENBQUM7b0JBQ04sTUFBTSxHQUFHLE9BQU8sQ0FBQztnQkFDbkIsQ0FBQztZQUNILENBQUM7WUFFRCxxREFBcUQ7WUFDckQsSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLFFBQVEsSUFBSSxNQUFNLEtBQUssU0FBUyxFQUFFLENBQUM7Z0JBQ3JELE1BQU0sR0FBRyxPQUFPLENBQUM7WUFDbkIsQ0FBQztZQUVELDBFQUEwRTtZQUMxRSxJQUFJLE1BQU0sS0FBSyxTQUFTLElBQUksQ0FBQyxJQUFJLENBQUMsTUFBTSxLQUFLLE1BQU0sSUFBSSxJQUFJLENBQUMsTUFBTSxLQUFLLG9CQUFvQixDQUFDLEVBQUUsQ0FBQztnQkFDN0YsTUFBTSxHQUFHLGNBQWMsQ0FBQztZQUMxQixDQUFDO1lBRUQsK0JBQStCO1lBQy9CLElBQUksV0FBZ0UsQ0FBQztZQUNyRSxJQUFJLFFBQVEsQ0FBQyxzQkFBc0IsRUFBRSxDQUFDO2dCQUNwQyxNQUFNLEVBQUUsR0FBRyxNQUFNLFFBQVEsQ0FBQyxzQkFBc0IsQ0FBQyxjQUFjLENBQUMsTUFBTSxDQUFDLENBQUM7Z0JBQ3hFLElBQUksRUFBRSxFQUFFLENBQUM7b0JBQ1AsV0FBVyxHQUFHLEVBQUUsQ0FBQztnQkFDbkIsQ0FBQztZQUNILENBQUM7WUFFRCxZQUFZLENBQUMsSUFBSSxDQUFDO2dCQUNoQixNQUFNO2dCQUNOLFVBQVUsRUFBRSxJQUFJLENBQUMsVUFBVTtnQkFDM0IsTUFBTTtnQkFDTixNQUFNLEVBQUUsSUFBSSxDQUFDLE1BQU07Z0JBQ25CLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztnQkFDckIsVUFBVTtnQkFDVixNQUFNO2dCQUNOLFFBQVE7Z0JBQ1IsS0FBSztnQkFDTCxjQUFjLEVBQUUsSUFBSSxDQUFDLGNBQWM7Z0JBQ25DLFdBQVc7YUFDWixDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsT0FBTyxZQUFZLENBQUM7SUFDdEIsQ0FBQztJQUVPLFlBQVksQ0FBQyxZQUFvRDtRQVF2RSxNQUFNLE9BQU8sR0FBRyxFQUFFLEtBQUssRUFBRSxDQUFDLEVBQUUsS0FBSyxFQUFFLENBQUMsRUFBRSxRQUFRLEVBQUUsQ0FBQyxFQUFFLE9BQU8sRUFBRSxDQUFDLEVBQUUsTUFBTSxFQUFFLENBQUMsRUFBRSxPQUFPLEVBQUUsQ0FBQyxFQUFFLENBQUM7UUFDdkYsT0FBTyxDQUFDLEtBQUssR0FBRyxZQUFZLENBQUMsTUFBTSxDQUFDO1FBQ3BDLEtBQUssTUFBTSxJQUFJLElBQUksWUFBWSxFQUFFLENBQUM7WUFDaEMsUUFBUSxJQUFJLENBQUMsTUFBTSxFQUFFLENBQUM7Z0JBQ3BCLEtBQUssT0FBTztvQkFBRSxPQUFPLENBQUMsS0FBSyxFQUFFLENBQUM7b0JBQUMsTUFBTTtnQkFDckMsS0FBSyxVQUFVO29CQUFFLE9BQU8sQ0FBQyxRQUFRLEVBQUUsQ0FBQztvQkFBQyxNQUFNO2dCQUMzQyxLQUFLLFNBQVM7b0JBQUUsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO29CQUFDLE1BQU07Z0JBQ3pDLEtBQUssUUFBUTtvQkFBRSxPQUFPLENBQUMsTUFBTSxFQUFFLENBQUM7b0JBQUMsTUFBTTtnQkFDdkMsS0FBSyxjQUFjLENBQUMsQ0FBQyxtQkFBbUI7Z0JBQ3hDLEtBQUssU0FBUztvQkFBRSxPQUFPLENBQUMsT0FBTyxFQUFFLENBQUM7b0JBQUMsTUFBTTtZQUMzQyxDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sT0FBTyxDQUFDO0lBQ2pCLENBQUM7SUFFRDs7T0FFRztJQUNLLEtBQUssQ0FBQyw2QkFBNkIsQ0FBQyxTQUFpQjtRQUMzRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztRQUMvQyxNQUFNLFVBQVUsR0FBRyxRQUFRLENBQUMsVUFBVSxDQUFDO1FBRXZDLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNoQixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsMkJBQTJCLEVBQUUsQ0FBQztRQUNsRSxDQUFDO1FBRUQsSUFBSSxDQUFDO1lBQ0gsTUFBTSxVQUFVLENBQUMsb0JBQW9CLENBQUMsU0FBUyxDQUFDLENBQUM7WUFDakQscURBQXFEO1lBQ3JELEtBQUssTUFBTSxDQUFDLE1BQU0sRUFBRSxLQUFLLENBQUMsSUFBSSxRQUFRLENBQUMsb0JBQW9CLEVBQUUsQ0FBQztnQkFDNUQsSUFBSSxLQUFLLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxTQUFTLENBQUMsRUFBRSxDQUFDO29CQUN6QyxRQUFRLENBQUMsb0JBQW9CLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUMvQyxDQUFDO1lBQ0gsQ0FBQztZQUNELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxtREFBbUQsU0FBUyxHQUFHLEVBQUUsQ0FBQztRQUNyRyxDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxHQUFHLENBQUMsT0FBTyxJQUFJLG1DQUFtQyxFQUFFLENBQUM7UUFDekYsQ0FBQztJQUNILENBQUM7SUFFRDs7T0FFRztJQUNLLEtBQUssQ0FBQyw0QkFBNEIsQ0FBQyxNQUFjO1FBQ3ZELE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDO1FBQy9DLE1BQU0sVUFBVSxHQUFHLFFBQVEsQ0FBQyxVQUFVLENBQUM7UUFFdkMsSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ2hCLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSwyQkFBMkIsRUFBRSxDQUFDO1FBQ2xFLENBQUM7UUFFRCxnREFBZ0Q7UUFDaEQsSUFBSSxRQUFRLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztZQUNwQyxNQUFNLFFBQVEsQ0FBQyxzQkFBc0IsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUVELDhDQUE4QztRQUM5QyxRQUFRLENBQUMsb0JBQW9CLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBRTdDLDBDQUEwQztRQUMxQyxJQUFJLFFBQVEsQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUN2QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxRQUFRLENBQUMsU0FBUyxDQUFDLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN6RCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsb0RBQW9ELE1BQU0sR0FBRyxFQUFFLENBQUM7WUFDbkcsQ0FBQztZQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7Z0JBQ2IsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLEdBQUcsQ0FBQyxPQUFPLElBQUkseUNBQXlDLE1BQU0sRUFBRSxFQUFFLENBQUM7WUFDdkcsQ0FBQztRQUNILENBQUM7UUFFRCwwREFBMEQ7UUFDMUQsTUFBTSxVQUFVLEdBQUcsUUFBUSxDQUFDLHVCQUF1QixDQUFDLE1BQU0sQ0FBQyxDQUFDO1FBQzVELElBQUksVUFBVSxDQUFDLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMxQixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxVQUFVLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7Z0JBQ3JELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxvREFBb0QsTUFBTSxnQkFBZ0IsVUFBVSxDQUFDLENBQUMsQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUNoSSxDQUFDO1lBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztnQkFDYixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsR0FBRyxDQUFDLE9BQU8sSUFBSSx5Q0FBeUMsTUFBTSxFQUFFLEVBQUUsQ0FBQztZQUN2RyxDQUFDO1FBQ0gsQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSwrQkFBK0IsTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUMvRSxDQUFDO0lBRUQ7O09BRUc7SUFDSyxLQUFLLENBQUMsaUJBQWlCLENBQUMsTUFBYztRQUM1QyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztRQUMvQyxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqRCxzQ0FBc0M7UUFDdEMsTUFBTSxLQUFLLEdBQUc7WUFDWixnQkFBZ0IsTUFBTSxFQUFFO1lBQ3hCLGdCQUFnQixXQUFXLEVBQUU7WUFDN0IsVUFBVSxXQUFXLEVBQUU7U0FDeEIsQ0FBQztRQUVGLEtBQUssTUFBTSxJQUFJLElBQUksS0FBSyxFQUFFLENBQUM7WUFDekIsSUFBSSxDQUFDO2dCQUNILE1BQU0sUUFBUSxDQUFDLGNBQWMsQ0FBQyxNQUFNLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDN0MsQ0FBQztZQUFDLE1BQU0sQ0FBQztnQkFDUCw4QkFBOEI7WUFDaEMsQ0FBQztRQUNILENBQUM7UUFFRCxrQ0FBa0M7UUFDbEMsUUFBUSxDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUU3QyxxQkFBcUI7UUFDckIsSUFBSSxRQUFRLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztZQUNwQyxNQUFNLFFBQVEsQ0FBQyxzQkFBc0IsQ0FBQyxZQUFZLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDN0QsQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsSUFBSSxFQUFFLE9BQU8sRUFBRSxpQ0FBaUMsTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNoRixDQUFDO0lBRUQ7O09BRUc7SUFDSyxLQUFLLENBQUMsaUJBQWlCLENBQUMsTUFBYztRQWE1QyxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQztRQUMvQyxNQUFNLFdBQVcsR0FBRyxNQUFNLENBQUMsT0FBTyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUVqRCwyREFBMkQ7UUFDM0QsSUFBSSxRQUFRLEdBQUcsTUFBTSxRQUFRLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxVQUFVLFdBQVcsRUFBRSxDQUFDLENBQUM7UUFDOUUsSUFBSSxRQUFRLElBQUksUUFBUSxDQUFDLFNBQVMsSUFBSSxRQUFRLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDMUQsT0FBTztnQkFDTCxPQUFPLEVBQUUsSUFBSTtnQkFDYixJQUFJLEVBQUU7b0JBQ0osRUFBRSxFQUFFLFFBQVEsQ0FBQyxFQUFFLElBQUksT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUU7b0JBQzlDLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVSxJQUFJLE1BQU07b0JBQ3pDLE9BQU8sRUFBRSxRQUFRLENBQUMsT0FBTyxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUU7b0JBQ3ZDLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVSxJQUFJLENBQUM7b0JBQ3BDLFVBQVUsRUFBRSxRQUFRLENBQUMsVUFBVTtvQkFDL0IsU0FBUyxFQUFFLFFBQVEsQ0FBQyxTQUFTO29CQUM3QixHQUFHLEVBQUUsUUFBUSxDQUFDLEdBQUcsSUFBSSxFQUFFO2lCQUN4QjthQUNGLENBQUM7UUFDSixDQUFDO1FBRUQsbURBQW1EO1FBQ25ELFFBQVEsR0FBRyxNQUFNLFFBQVEsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLGdCQUFnQixNQUFNLEVBQUUsQ0FBQyxDQUFDO1FBQzNFLElBQUksQ0FBQyxRQUFRLElBQUksQ0FBQyxRQUFRLENBQUMsU0FBUyxFQUFFLENBQUM7WUFDckMsd0JBQXdCO1lBQ3hCLFFBQVEsR0FBRyxNQUFNLFFBQVEsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLGdCQUFnQixXQUFXLEVBQUUsQ0FBQyxDQUFDO1FBQ2xGLENBQUM7UUFFRCxJQUFJLFFBQVEsSUFBSSxRQUFRLENBQUMsU0FBUyxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUMxRCxPQUFPO2dCQUNMLE9BQU8sRUFBRSxJQUFJO2dCQUNiLElBQUksRUFBRTtvQkFDSixFQUFFLEVBQUUsT0FBTyxDQUFDLE1BQU0sQ0FBQyxVQUFVLEVBQUU7b0JBQy9CLFVBQVUsRUFBRSxNQUFNO29CQUNsQixPQUFPLEVBQUUsUUFBUSxDQUFDLFNBQVMsSUFBSSxJQUFJLENBQUMsR0FBRyxFQUFFO29CQUN6QyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVUsSUFBSSxDQUFDO29CQUNwQyxVQUFVLEVBQUUsUUFBUSxDQUFDLFVBQVU7b0JBQy9CLFNBQVMsRUFBRSxRQUFRLENBQUMsU0FBUztvQkFDN0IsR0FBRyxFQUFFLEVBQUU7aUJBQ1I7YUFDRixDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxrQ0FBa0MsTUFBTSxHQUFHLEVBQUUsQ0FBQztJQUNsRixDQUFDO0lBRUQ7O09BRUc7SUFDSyxLQUFLLENBQUMsaUJBQWlCLENBQUMsSUFRL0I7UUFDQyx1QkFBdUI7UUFDdkIsSUFBSSxDQUFDLElBQUksQ0FBQyxTQUFTLElBQUksQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsQ0FBQyw2QkFBNkIsQ0FBQyxFQUFFLENBQUM7WUFDL0UsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFFLDJEQUEyRCxFQUFFLENBQUM7UUFDbEcsQ0FBQztRQUNELElBQUksQ0FBQyxJQUFJLENBQUMsVUFBVSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRLENBQUMsWUFBWSxDQUFDLEVBQUUsQ0FBQztZQUNoRSxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsb0RBQW9ELEVBQUUsQ0FBQztRQUMzRixDQUFDO1FBRUQsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7UUFDL0MsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFVBQVUsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDO1FBRTFELDhDQUE4QztRQUM5QyxNQUFNLFFBQVEsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLFVBQVUsV0FBVyxFQUFFLEVBQUU7WUFDN0QsRUFBRSxFQUFFLElBQUksQ0FBQyxFQUFFO1lBQ1gsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQzNCLE9BQU8sRUFBRSxJQUFJLENBQUMsT0FBTztZQUNyQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7WUFDM0IsVUFBVSxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQzNCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixHQUFHLEVBQUUsSUFBSSxDQUFDLEdBQUcsSUFBSSxFQUFFO1NBQ3BCLENBQUMsQ0FBQztRQUVILGlEQUFpRDtRQUNqRCxNQUFNLFFBQVEsQ0FBQyxjQUFjLENBQUMsT0FBTyxDQUFDLGdCQUFnQixJQUFJLENBQUMsVUFBVSxFQUFFLEVBQUU7WUFDdkUsTUFBTSxFQUFFLElBQUksQ0FBQyxVQUFVO1lBQ3ZCLFNBQVMsRUFBRSxJQUFJLENBQUMsU0FBUztZQUN6QixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7WUFDM0IsRUFBRSxFQUFFLFNBQVM7WUFDYixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVU7WUFDM0IsU0FBUyxFQUFFLElBQUksQ0FBQyxPQUFPO1NBQ3hCLENBQUMsQ0FBQztRQUVILDhCQUE4QjtRQUM5QixRQUFRLENBQUMsb0JBQW9CLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLEVBQUU7WUFDakQsTUFBTSxFQUFFLE9BQU87WUFDZixNQUFNLEVBQUUsUUFBUTtZQUNoQixVQUFVLEVBQUUsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsSUFBSSxDQUFDLFVBQVUsQ0FBQyxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxTQUFTO1lBQ2pGLFFBQVEsRUFBRSxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxJQUFJLENBQUMsT0FBTyxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLFNBQVM7WUFDekUsVUFBVSxFQUFFLEVBQUU7U0FDZixDQUFDLENBQUM7UUFFSCxPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxPQUFPLEVBQUUsNkJBQTZCLElBQUksQ0FBQyxVQUFVLEdBQUcsRUFBRSxDQUFDO0lBQ3JGLENBQUM7Q0FDRiJ9

package/dist_ts/opsserver/handlers/config.handler.d.ts

@@ -0,0 +1,7 @@
+import type { OpsServer } from '../classes.opsserver.js';
+export declare class ConfigHandler {
+    private opsServerRef;
+    constructor(opsServerRef: OpsServer);
+    private registerHandlers;
+    private getConfiguration;
+}

package/dist_ts/opsserver/handlers/config.handler.js

@@ -0,0 +1,192 @@
+import * as plugins from '../../plugins.js';
+import * as paths from '../../paths.js';
+import * as interfaces from '../../../dist_ts_interfaces/index.js';
+export class ConfigHandler {
+    opsServerRef;
+    constructor(opsServerRef) {
+        this.opsServerRef = opsServerRef;
+        this.registerHandlers();
+    }
+    registerHandlers() {
+        // Config endpoint registers directly on viewRouter (valid identity required via middleware)
+        const router = this.opsServerRef.viewRouter;
+        // Get Configuration Handler (read-only)
+        router.addTypedHandler(new plugins.typedrequest.TypedHandler('getConfiguration', async (dataArg, toolsArg) => {
+            const config = await this.getConfiguration();
+            return {
+                config,
+                section: dataArg.section,
+            };
+        }));
+    }
+    async getConfiguration() {
+        const dcRouter = this.opsServerRef.dcRouterRef;
+        const opts = dcRouter.options;
+        const resolvedPaths = dcRouter.resolvedPaths;
+        // --- System ---
+        const storageBackend = opts.storage?.readFunction
+            ? 'custom'
+            : opts.storage?.fsPath
+                ? 'filesystem'
+                : 'memory';
+        // Resolve proxy IPs: fall back to SmartProxy's runtime proxyIPs if not in opts
+        let proxyIps = opts.proxyIps || [];
+        if (proxyIps.length === 0 && dcRouter.smartProxy) {
+            const spSettings = dcRouter.smartProxy.settings;
+            if (spSettings?.proxyIPs?.length > 0) {
+                proxyIps = spSettings.proxyIPs;
+            }
+        }
+        const system = {
+            baseDir: resolvedPaths.dcrouterHomeDir,
+            dataDir: resolvedPaths.dataDir,
+            publicIp: opts.publicIp || dcRouter.detectedPublicIp || null,
+            proxyIps,
+            uptime: Math.floor(process.uptime()),
+            storageBackend,
+            storagePath: opts.storage?.fsPath || null,
+        };
+        // --- SmartProxy ---
+        let acmeInfo = null;
+        if (opts.smartProxyConfig?.acme) {
+            const acme = opts.smartProxyConfig.acme;
+            acmeInfo = {
+                enabled: acme.enabled !== false,
+                accountEmail: acme.accountEmail || '',
+                useProduction: acme.useProduction !== false,
+                autoRenew: acme.autoRenew !== false,
+                renewThresholdDays: acme.renewThresholdDays || 30,
+            };
+        }
+        let routeCount = 0;
+        if (dcRouter.routeConfigManager) {
+            try {
+                const merged = await dcRouter.routeConfigManager.getMergedRoutes();
+                routeCount = merged.routes.length;
+            }
+            catch {
+                routeCount = opts.smartProxyConfig?.routes?.length || 0;
+            }
+        }
+        else if (opts.smartProxyConfig?.routes) {
+            routeCount = opts.smartProxyConfig.routes.length;
+        }
+        const smartProxy = {
+            enabled: !!dcRouter.smartProxy,
+            routeCount,
+            acme: acmeInfo,
+        };
+        // --- Email ---
+        let emailDomains = [];
+        if (dcRouter.emailServer && dcRouter.emailServer.domainRegistry) {
+            emailDomains = dcRouter.emailServer.domainRegistry.getAllDomains();
+        }
+        else if (opts.emailConfig?.domains) {
+            emailDomains = opts.emailConfig.domains.map((d) => typeof d === 'string' ? d : d.domain);
+        }
+        let portMapping = null;
+        if (opts.emailPortConfig?.portMapping) {
+            portMapping = {};
+            for (const [ext, int] of Object.entries(opts.emailPortConfig.portMapping)) {
+                portMapping[String(ext)] = int;
+            }
+        }
+        const email = {
+            enabled: !!dcRouter.emailServer,
+            ports: opts.emailConfig?.ports || [],
+            portMapping,
+            hostname: opts.emailConfig?.hostname || null,
+            domains: emailDomains,
+            emailRouteCount: opts.emailConfig?.routes?.length || 0,
+            receivedEmailsPath: opts.emailPortConfig?.receivedEmailsPath || null,
+        };
+        // --- DNS ---
+        const dnsRecords = (opts.dnsRecords || []).map(r => ({
+            name: r.name,
+            type: r.type,
+            value: r.value,
+            ttl: r.ttl,
+        }));
+        const dns = {
+            enabled: !!dcRouter.dnsServer,
+            port: 53,
+            nsDomains: opts.dnsNsDomains || [],
+            scopes: opts.dnsScopes || [],
+            recordCount: dnsRecords.length,
+            records: dnsRecords,
+            dnsChallenge: !!opts.dnsChallenge?.cloudflareApiKey,
+        };
+        // --- TLS ---
+        let tlsSource = 'none';
+        if (opts.tls?.certPath && opts.tls?.keyPath) {
+            tlsSource = 'static';
+        }
+        else if (opts.smartProxyConfig?.acme?.enabled !== false && opts.smartProxyConfig?.acme) {
+            tlsSource = 'acme';
+        }
+        const tls = {
+            contactEmail: opts.tls?.contactEmail || opts.smartProxyConfig?.acme?.accountEmail || null,
+            domain: opts.tls?.domain || null,
+            source: tlsSource,
+            certPath: opts.tls?.certPath || null,
+            keyPath: opts.tls?.keyPath || null,
+        };
+        // --- Cache ---
+        const cacheConfig = opts.cacheConfig;
+        const cache = {
+            enabled: cacheConfig?.enabled !== false,
+            storagePath: cacheConfig?.storagePath || resolvedPaths.defaultTsmDbPath,
+            dbName: cacheConfig?.dbName || 'dcrouter',
+            defaultTTLDays: cacheConfig?.defaultTTLDays || 30,
+            cleanupIntervalHours: cacheConfig?.cleanupIntervalHours || 1,
+            ttlConfig: cacheConfig?.ttlConfig ? { ...cacheConfig.ttlConfig } : {},
+        };
+        // --- RADIUS ---
+        const radiusCfg = opts.radiusConfig;
+        const radius = {
+            enabled: !!dcRouter.radiusServer,
+            authPort: radiusCfg?.authPort || null,
+            acctPort: radiusCfg?.acctPort || null,
+            bindAddress: radiusCfg?.bindAddress || null,
+            clientCount: radiusCfg?.clients?.length || 0,
+            vlanDefaultVlan: radiusCfg?.vlanAssignment?.defaultVlan ?? null,
+            vlanAllowUnknownMacs: radiusCfg?.vlanAssignment?.allowUnknownMacs ?? null,
+            vlanMappingCount: radiusCfg?.vlanAssignment?.mappings?.length || 0,
+        };
+        // --- Remote Ingress ---
+        const riCfg = opts.remoteIngressConfig;
+        const connectedEdgeIps = dcRouter.tunnelManager?.getConnectedEdgeIps() || [];
+        // Determine TLS mode: custom certs > ACME from cert store > self-signed fallback
+        let tlsMode = 'self-signed';
+        if (riCfg?.tls?.certPath && riCfg?.tls?.keyPath) {
+            tlsMode = 'custom';
+        }
+        else if (riCfg?.hubDomain) {
+            try {
+                const stored = await dcRouter.storageManager.getJSON(`/proxy-certs/${riCfg.hubDomain}`);
+                if (stored?.publicKey && stored?.privateKey) {
+                    tlsMode = 'acme';
+                }
+            }
+            catch { /* no stored cert */ }
+        }
+        const remoteIngress = {
+            enabled: !!dcRouter.remoteIngressManager,
+            tunnelPort: riCfg?.tunnelPort || null,
+            hubDomain: riCfg?.hubDomain || null,
+            tlsMode,
+            connectedEdgeIps,
+        };
+        return {
+            system,
+            smartProxy,
+            email,
+            dns,
+            tls,
+            cache,
+            radius,
+            remoteIngress,
+        };
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY29uZmlnLmhhbmRsZXIuanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi8uLi90cy9vcHNzZXJ2ZXIvaGFuZGxlcnMvY29uZmlnLmhhbmRsZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxrQkFBa0IsQ0FBQztBQUM1QyxPQUFPLEtBQUssS0FBSyxNQUFNLGdCQUFnQixDQUFDO0FBRXhDLE9BQU8sS0FBSyxVQUFVLE1BQU0saUNBQWlDLENBQUM7QUFFOUQsTUFBTSxPQUFPLGFBQWE7SUFDSjtJQUFwQixZQUFvQixZQUF1QjtRQUF2QixpQkFBWSxHQUFaLFlBQVksQ0FBVztRQUN6QyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztJQUMxQixDQUFDO0lBRU8sZ0JBQWdCO1FBQ3RCLDRGQUE0RjtRQUM1RixNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsWUFBWSxDQUFDLFVBQVUsQ0FBQztRQUU1Qyx3Q0FBd0M7UUFDeEMsTUFBTSxDQUFDLGVBQWUsQ0FDcEIsSUFBSSxPQUFPLENBQUMsWUFBWSxDQUFDLFlBQVksQ0FDbkMsa0JBQWtCLEVBQ2xCLEtBQUssRUFBRSxPQUFPLEVBQUUsUUFBUSxFQUFFLEVBQUU7WUFDMUIsTUFBTSxNQUFNLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUM3QyxPQUFPO2dCQUNMLE1BQU07Z0JBQ04sT0FBTyxFQUFFLE9BQU8sQ0FBQyxPQUFPO2FBQ3pCLENBQUM7UUFDSixDQUFDLENBQ0YsQ0FDRixDQUFDO0lBQ0osQ0FBQztJQUVPLEtBQUssQ0FBQyxnQkFBZ0I7UUFDNUIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUM7UUFDL0MsTUFBTSxJQUFJLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQztRQUM5QixNQUFNLGFBQWEsR0FBRyxRQUFRLENBQUMsYUFBYSxDQUFDO1FBRTdDLGlCQUFpQjtRQUNqQixNQUFNLGNBQWMsR0FBdUMsSUFBSSxDQUFDLE9BQU8sRUFBRSxZQUFZO1lBQ25GLENBQUMsQ0FBQyxRQUFRO1lBQ1YsQ0FBQyxDQUFDLElBQUksQ0FBQyxPQUFPLEVBQUUsTUFBTTtnQkFDcEIsQ0FBQyxDQUFDLFlBQVk7Z0JBQ2QsQ0FBQyxDQUFDLFFBQVEsQ0FBQztRQUVmLCtFQUErRTtRQUMvRSxJQUFJLFFBQVEsR0FBRyxJQUFJLENBQUMsUUFBUSxJQUFJLEVBQUUsQ0FBQztRQUNuQyxJQUFJLFFBQVEsQ0FBQyxNQUFNLEtBQUssQ0FBQyxJQUFJLFFBQVEsQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNqRCxNQUFNLFVBQVUsR0FBSSxRQUFRLENBQUMsVUFBa0IsQ0FBQyxRQUFRLENBQUM7WUFDekQsSUFBSSxVQUFVLEVBQUUsUUFBUSxFQUFFLE1BQU0sR0FBRyxDQUFDLEVBQUUsQ0FBQztnQkFDckMsUUFBUSxHQUFHLFVBQVUsQ0FBQyxRQUFRLENBQUM7WUFDakMsQ0FBQztRQUNILENBQUM7UUFFRCxNQUFNLE1BQU0sR0FBOEM7WUFDeEQsT0FBTyxFQUFFLGFBQWEsQ0FBQyxlQUFlO1lBQ3RDLE9BQU8sRUFBRSxhQUFhLENBQUMsT0FBTztZQUM5QixRQUFRLEVBQUUsSUFBSSxDQUFDLFFBQVEsSUFBSSxRQUFRLENBQUMsZ0JBQWdCLElBQUksSUFBSTtZQUM1RCxRQUFRO1lBQ1IsTUFBTSxFQUFFLElBQUksQ0FBQyxLQUFLLENBQUMsT0FBTyxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3BDLGNBQWM7WUFDZCxXQUFXLEVBQUUsSUFBSSxDQUFDLE9BQU8sRUFBRSxNQUFNLElBQUksSUFBSTtTQUMxQyxDQUFDO1FBRUYscUJBQXFCO1FBQ3JCLElBQUksUUFBUSxHQUEwRCxJQUFJLENBQUM7UUFDM0UsSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsSUFBSSxFQUFFLENBQUM7WUFDaEMsTUFBTSxJQUFJLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDLElBQUksQ0FBQztZQUN4QyxRQUFRLEdBQUc7Z0JBQ1QsT0FBTyxFQUFFLElBQUksQ0FBQyxPQUFPLEtBQUssS0FBSztnQkFDL0IsWUFBWSxFQUFFLElBQUksQ0FBQyxZQUFZLElBQUksRUFBRTtnQkFDckMsYUFBYSxFQUFFLElBQUksQ0FBQyxhQUFhLEtBQUssS0FBSztnQkFDM0MsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTLEtBQUssS0FBSztnQkFDbkMsa0JBQWtCLEVBQUUsSUFBSSxDQUFDLGtCQUFrQixJQUFJLEVBQUU7YUFDbEQsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLFVBQVUsR0FBRyxDQUFDLENBQUM7UUFDbkIsSUFBSSxRQUFRLENBQUMsa0JBQWtCLEVBQUUsQ0FBQztZQUNoQyxJQUFJLENBQUM7Z0JBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQUMsa0JBQWtCLENBQUMsZUFBZSxFQUFFLENBQUM7Z0JBQ25FLFVBQVUsR0FBRyxNQUFNLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQztZQUNwQyxDQUFDO1lBQUMsTUFBTSxDQUFDO2dCQUNQLFVBQVUsR0FBRyxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsTUFBTSxFQUFFLE1BQU0sSUFBSSxDQUFDLENBQUM7WUFDMUQsQ0FBQztRQUNILENBQUM7YUFBTSxJQUFJLElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxNQUFNLEVBQUUsQ0FBQztZQUN6QyxVQUFVLEdBQUcsSUFBSSxDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUM7UUFDbkQsQ0FBQztRQUVELE1BQU0sVUFBVSxHQUFrRDtZQUNoRSxPQUFPLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxVQUFVO1lBQzlCLFVBQVU7WUFDVixJQUFJLEVBQUUsUUFBUTtTQUNmLENBQUM7UUFFRixnQkFBZ0I7UUFDaEIsSUFBSSxZQUFZLEdBQWEsRUFBRSxDQUFDO1FBQ2hDLElBQUksUUFBUSxDQUFDLFdBQVcsSUFBSyxRQUFRLENBQUMsV0FBbUIsQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUN6RSxZQUFZLEdBQUksUUFBUSxDQUFDLFdBQW1CLENBQUMsY0FBYyxDQUFDLGFBQWEsRUFBRSxDQUFDO1FBQzlFLENBQUM7YUFBTSxJQUFJLElBQUksQ0FBQyxXQUFXLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDckMsWUFBWSxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDLENBQU0sRUFBRSxFQUFFLENBQ3JELE9BQU8sQ0FBQyxLQUFLLFFBQVEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsTUFBTSxDQUNyQyxDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksV0FBVyxHQUFrQyxJQUFJLENBQUM7UUFDdEQsSUFBSSxJQUFJLENBQUMsZUFBZSxFQUFFLFdBQVcsRUFBRSxDQUFDO1lBQ3RDLFdBQVcsR0FBRyxFQUFFLENBQUM7WUFDakIsS0FBSyxNQUFNLENBQUMsR0FBRyxFQUFFLEdBQUcsQ0FBQyxJQUFJLE1BQU0sQ0FBQyxPQUFPLENBQUMsSUFBSSxDQUFDLGVBQWUsQ0FBQyxXQUFXLENBQUMsRUFBRSxDQUFDO2dCQUMxRSxXQUFXLENBQUMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxDQUFDLEdBQUcsR0FBYSxDQUFDO1lBQzNDLENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQTZDO1lBQ3RELE9BQU8sRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVc7WUFDL0IsS0FBSyxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsS0FBSyxJQUFJLEVBQUU7WUFDcEMsV0FBVztZQUNYLFFBQVEsRUFBRSxJQUFJLENBQUMsV0FBVyxFQUFFLFFBQVEsSUFBSSxJQUFJO1lBQzVDLE9BQU8sRUFBRSxZQUFZO1lBQ3JCLGVBQWUsRUFBRSxJQUFJLENBQUMsV0FBVyxFQUFFLE1BQU0sRUFBRSxNQUFNLElBQUksQ0FBQztZQUN0RCxrQkFBa0IsRUFBRSxJQUFJLENBQUMsZUFBZSxFQUFFLGtCQUFrQixJQUFJLElBQUk7U0FDckUsQ0FBQztRQUVGLGNBQWM7UUFDZCxNQUFNLFVBQVUsR0FBRyxDQUFDLElBQUksQ0FBQyxVQUFVLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNuRCxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUk7WUFDWixJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUk7WUFDWixLQUFLLEVBQUUsQ0FBQyxDQUFDLEtBQUs7WUFDZCxHQUFHLEVBQUUsQ0FBQyxDQUFDLEdBQUc7U0FDWCxDQUFDLENBQUMsQ0FBQztRQUVKLE1BQU0sR0FBRyxHQUEyQztZQUNsRCxPQUFPLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxTQUFTO1lBQzdCLElBQUksRUFBRSxFQUFFO1lBQ1IsU0FBUyxFQUFFLElBQUksQ0FBQyxZQUFZLElBQUksRUFBRTtZQUNsQyxNQUFNLEVBQUUsSUFBSSxDQUFDLFNBQVMsSUFBSSxFQUFFO1lBQzVCLFdBQVcsRUFBRSxVQUFVLENBQUMsTUFBTTtZQUM5QixPQUFPLEVBQUUsVUFBVTtZQUNuQixZQUFZLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsZ0JBQWdCO1NBQ3BELENBQUM7UUFFRixjQUFjO1FBQ2QsSUFBSSxTQUFTLEdBQStCLE1BQU0sQ0FBQztRQUNuRCxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsUUFBUSxJQUFJLElBQUksQ0FBQyxHQUFHLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDNUMsU0FBUyxHQUFHLFFBQVEsQ0FBQztRQUN2QixDQUFDO2FBQU0sSUFBSSxJQUFJLENBQUMsZ0JBQWdCLEVBQUUsSUFBSSxFQUFFLE9BQU8sS0FBSyxLQUFLLElBQUksSUFBSSxDQUFDLGdCQUFnQixFQUFFLElBQUksRUFBRSxDQUFDO1lBQ3pGLFNBQVMsR0FBRyxNQUFNLENBQUM7UUFDckIsQ0FBQztRQUVELE1BQU0sR0FBRyxHQUEyQztZQUNsRCxZQUFZLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxZQUFZLElBQUksSUFBSSxDQUFDLGdCQUFnQixFQUFFLElBQUksRUFBRSxZQUFZLElBQUksSUFBSTtZQUN6RixNQUFNLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxNQUFNLElBQUksSUFBSTtZQUNoQyxNQUFNLEVBQUUsU0FBUztZQUNqQixRQUFRLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxRQUFRLElBQUksSUFBSTtZQUNwQyxPQUFPLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRSxPQUFPLElBQUksSUFBSTtTQUNuQyxDQUFDO1FBRUYsZ0JBQWdCO1FBQ2hCLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUM7UUFDckMsTUFBTSxLQUFLLEdBQTZDO1lBQ3RELE9BQU8sRUFBRSxXQUFXLEVBQUUsT0FBTyxLQUFLLEtBQUs7WUFDdkMsV0FBVyxFQUFFLFdBQVcsRUFBRSxXQUFXLElBQUksYUFBYSxDQUFDLGdCQUFnQjtZQUN2RSxNQUFNLEVBQUUsV0FBVyxFQUFFLE1BQU0sSUFBSSxVQUFVO1lBQ3pDLGNBQWMsRUFBRSxXQUFXLEVBQUUsY0FBYyxJQUFJLEVBQUU7WUFDakQsb0JBQW9CLEVBQUUsV0FBVyxFQUFFLG9CQUFvQixJQUFJLENBQUM7WUFDNUQsU0FBUyxFQUFFLFdBQVcsRUFBRSxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxXQUFXLENBQUMsU0FBUyxFQUE0QixDQUFDLENBQUMsQ0FBQyxFQUFFO1NBQ2hHLENBQUM7UUFFRixpQkFBaUI7UUFDakIsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQztRQUNwQyxNQUFNLE1BQU0sR0FBOEM7WUFDeEQsT0FBTyxFQUFFLENBQUMsQ0FBQyxRQUFRLENBQUMsWUFBWTtZQUNoQyxRQUFRLEVBQUUsU0FBUyxFQUFFLFFBQVEsSUFBSSxJQUFJO1lBQ3JDLFFBQVEsRUFBRSxTQUFTLEVBQUUsUUFBUSxJQUFJLElBQUk7WUFDckMsV0FBVyxFQUFFLFNBQVMsRUFBRSxXQUFXLElBQUksSUFBSTtZQUMzQyxXQUFXLEVBQUUsU0FBUyxFQUFFLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQztZQUM1QyxlQUFlLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxXQUFXLElBQUksSUFBSTtZQUMvRCxvQkFBb0IsRUFBRSxTQUFTLEVBQUUsY0FBYyxFQUFFLGdCQUFnQixJQUFJLElBQUk7WUFDekUsZ0JBQWdCLEVBQUUsU0FBUyxFQUFFLGNBQWMsRUFBRSxRQUFRLEVBQUUsTUFBTSxJQUFJLENBQUM7U0FDbkUsQ0FBQztRQUVGLHlCQUF5QjtRQUN6QixNQUFNLEtBQUssR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUM7UUFDdkMsTUFBTSxnQkFBZ0IsR0FBRyxRQUFRLENBQUMsYUFBYSxFQUFFLG1CQUFtQixFQUFFLElBQUksRUFBRSxDQUFDO1FBRTdFLGlGQUFpRjtRQUNqRixJQUFJLE9BQU8sR0FBc0MsYUFBYSxDQUFDO1FBQy9ELElBQUksS0FBSyxFQUFFLEdBQUcsRUFBRSxRQUFRLElBQUksS0FBSyxFQUFFLEdBQUcsRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUNoRCxPQUFPLEdBQUcsUUFBUSxDQUFDO1FBQ3JCLENBQUM7YUFBTSxJQUFJLEtBQUssRUFBRSxTQUFTLEVBQUUsQ0FBQztZQUM1QixJQUFJLENBQUM7Z0JBQ0gsTUFBTSxNQUFNLEdBQUcsTUFBTSxRQUFRLENBQUMsY0FBYyxDQUFDLE9BQU8sQ0FBQyxnQkFBZ0IsS0FBSyxDQUFDLFNBQVMsRUFBRSxDQUFDLENBQUM7Z0JBQ3hGLElBQUksTUFBTSxFQUFFLFNBQVMsSUFBSSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7b0JBQzVDLE9BQU8sR0FBRyxNQUFNLENBQUM7Z0JBQ25CLENBQUM7WUFDSCxDQUFDO1lBQUMsTUFBTSxDQUFDLENBQUMsb0JBQW9CLENBQUMsQ0FBQztRQUNsQyxDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQXFEO1lBQ3RFLE9BQU8sRUFBRSxDQUFDLENBQUMsUUFBUSxDQUFDLG9CQUFvQjtZQUN4QyxVQUFVLEVBQUUsS0FBSyxFQUFFLFVBQVUsSUFBSSxJQUFJO1lBQ3JDLFNBQVMsRUFBRSxLQUFLLEVBQUUsU0FBUyxJQUFJLElBQUk7WUFDbkMsT0FBTztZQUNQLGdCQUFnQjtTQUNqQixDQUFDO1FBRUYsT0FBTztZQUNMLE1BQU07WUFDTixVQUFVO1lBQ1YsS0FBSztZQUNMLEdBQUc7WUFDSCxHQUFHO1lBQ0gsS0FBSztZQUNMLE1BQU07WUFDTixhQUFhO1NBQ2QsQ0FBQztJQUNKLENBQUM7Q0FDRiJ9