@serve.zone/dcrouter 17.10.1 → 18.0.0

package/dist_ts/dns/manager.dns-authority.d.ts

@@ -0,0 +1,143 @@
+import type { IDnsAuthorityDrift, IDnsAuthoritySettings, IDnsDelegationProbe, TDnsAuthorityState } from '../../dist_ts_interfaces/data/dns-authority.js';
+/**
+ * Result of applying an authority change to the running process.
+ * Reconciliation is all-or-nothing: a partial application is rolled back.
+ */
+export interface IDnsAuthorityMutationResult {
+    success: boolean;
+    message?: string;
+    probe?: IDnsDelegationProbe;
+    settings?: IDnsAuthoritySettings;
+}
+/** Re-derives runtime state after the effective authority set changed. */
+export type TDnsAuthorityReconciler = (reasonArg: string) => Promise<void>;
+/**
+ * DnsAuthorityManager — owns which zones dcrouter may answer for
+ * authoritatively, and proves that claim rather than accepting it.
+ *
+ * Why this exists: `dnsScopes` was the last un-migrated bootstrap option in an
+ * otherwise DB-driven router. It was read once at startup and had no mutation
+ * path, so claiming a newly delegated zone required a restart — measured at
+ * 30–60 s of total public outage. But simply making the declared list editable
+ * through the ops API would have been worse than the disease: the domain
+ * ownership predicate accepts zone coverage as *proof* precisely because a
+ * caller cannot write it. A `setDnsScopes` mutation would let an operator append
+ * any domain and manufacture that proof — the identical self-assertion vector
+ * that `createDcrouterDomain` used to have.
+ *
+ * So a zone earns authority by delegation instead: its public NS records must
+ * name our `dnsNsDomains`. An ops-API caller cannot fake that without actually
+ * controlling the domain, so the proof stays unforgeable while becoming
+ * mutable at runtime. It is also the comparison that was missing — claimed
+ * authority versus real delegation, checked by the mechanism itself rather than
+ * by an audit bolted on afterwards.
+ *
+ * **There is exactly one source of authority: this database document.** An
+ * earlier revision kept bootstrap `dnsScopes` as an always-in-effect floor and
+ * unioned it with the verified set. That is gone. A floor is a second
+ * representation of the same fact, it can only be changed by a redeploy, and it
+ * cannot be revoked through the API — all three of which are the properties
+ * that produced the outage this path exists to prevent.
+ *
+ * Removing the floor makes the *unreadable database* case load-bearing, so it is
+ * handled explicitly rather than by accident. Three situations, three answers:
+ *
+ *  - **document missing** — a readable database that has never been seeded. The
+ *    authority set is known, and it is empty: claim nothing. Logged at `error`
+ *    with the remediation, and the startup drift audit enumerates every zone
+ *    delegated to us that we are refusing to serve, which is the worklist.
+ *  - **document present, no zones** — identical handling, different message:
+ *    somebody revoked everything, which is a legitimate state we must not
+ *    silently repopulate.
+ *  - **document unreadable** — the authority set is *unknown*. `start()` throws
+ *    rather than reporting an empty set, because rendering an unknown as "claim
+ *    nothing" is exactly how a transient database fault would take every zone
+ *    off the air. `DnsServerRuntime.setup()` then refuses to start on
+ *    `getState() === 'unavailable'`. That second check is not redundant:
+ *    `DnsServer.dependsOn('DnsManager')` only *orders* startup, and taskbuffer
+ *    starts later levels even when an earlier optional service failed, so the
+ *    consumer has to read the state itself. Both services stay failed and
+ *    dcrouter runs degraded until it is restarted with a readable database —
+ *    DNS down and visibly failed, rather than up and asserting nothing.
+ *
+ * Fail closed on authority, never silently on service: with an empty set the
+ * DNS server still starts, still serves DoH, and still picks zones up the moment
+ * one is verified — without a restart.
+ */
+export declare class DnsAuthorityManager {
+    private getExpectedNameservers;
+    private verifiedZones;
+    private updatedAt;
+    private updatedBy;
+    private state;
+    private reconciler?;
+    constructor(getExpectedNameservers: () => string[]);
+    start(): Promise<void>;
+    stop(): Promise<void>;
+    /**
+     * Wire the callback that re-derives runtime state (zone handlers, route
+     * certificate warnings, private-route overlay) after the effective set changes.
+     */
+    setReconciler(reconciler?: TDnsAuthorityReconciler): void;
+    /**
+     * The authority set: delegation-verified zones, sorted so every consumer that
+     * needs a stable "first zone" (the DNSSEC signing zone, for one) gets the same
+     * answer across restarts regardless of database insertion order.
+     *
+     * This is what the ownership predicate consumes, and it is the only input to
+     * it. There is no bootstrap contribution.
+     */
+    getEffectiveZoneNames(): string[];
+    /** Whether the stored authority set was readable when it was last loaded. */
+    getState(): TDnsAuthorityState;
+    getSettings(): IDnsAuthoritySettings;
+    /**
+     * Ask the public DNS whether `zone` is delegated to our nameservers.
+     *
+     * Deliberately uses `strategy: 'doh'` — a single DNS-over-HTTPS attempt
+     * against a public resolver, with no system-resolver fallback. smartdns'
+     * `getNameServers()` uses `dns.resolveNs`, i.e. the *system* resolver, which on
+     * a dcrouter host may be dcrouter itself: it would happily answer with the very
+     * NS records we generated, making the probe self-confirming. An independent
+     * vantage point is the whole point of the proof.
+     *
+     * The three verdicts are kept distinct on purpose. A timeout is not evidence
+     * that a zone is not ours; collapsing 'undeterminable' into 'not-delegated'
+     * would let a transient resolver fault revoke authority.
+     */
+    probeDelegation(zoneArg: string): Promise<IDnsDelegationProbe>;
+    /**
+     * Claim authority over a zone, but only against a positive delegation proof.
+     * An undeterminable probe refuses the mutation — never assume either way.
+     */
+    verifyZone(zoneArg: string, verifiedBy: string): Promise<IDnsAuthorityMutationResult>;
+    /**
+     * Drop a verified zone. Every zone is revocable — there is no undroppable
+     * deployment-declared floor any more, so withdrawing authority never needs a
+     * redeploy and never leaves the router asserting a claim it cannot retract.
+     */
+    revokeZone(zoneArg: string, updatedBy: string): Promise<IDnsAuthorityMutationResult>;
+    /**
+     * Persist a new zone set and reconcile the running process against it.
+     *
+     * Fail closed: if reconciliation throws, the previous set is restored in the
+     * database and re-reconciled, so the router is never left half-converted.
+     * Reconciliation is idempotent, which is what makes the rollback safe.
+     */
+    private applyZones;
+    private persist;
+    /**
+     * Compare claimed authority against what is actually true, in every direction.
+     *
+     * This is the check whose absence let one zone sit declared in `dnsScopes`
+     * while four live zones were delegated to our nameservers and unclaimed.
+     *
+     * Advisory by design. It never mutates the authority set: a resolver blip at
+     * startup must not revoke authority for every zone and convert a transient
+     * fault into the outage this whole path exists to avoid. Undeterminable probes
+     * are skipped rather than reported as drift.
+     */
+    auditDelegationDrift(): Promise<IDnsAuthorityDrift[]>;
+    /** Run the audit and log every finding at `error`. Never throws. */
+    logDelegationDrift(): Promise<void>;
+}

package/dist_ts/dns/manager.dns-authority.js

@@ -0,0 +1,481 @@
+import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
+import { DnsAuthorityDoc, DomainDoc } from '../db/documents/index.js';
+const normalizeZone = (zoneArg) => zoneArg.trim().toLowerCase().replace(/\.$/, '');
+/** Strip the trailing dot smartdns/DoH returns on NS values. */
+const normalizeNameserver = (nameserverArg) => nameserverArg.trim().toLowerCase().replace(/\.$/, '');
+const isUsableZoneName = (zoneArg) => {
+    if (!zoneArg || zoneArg.length > 253)
+        return false;
+    if (zoneArg.includes('*') || zoneArg.includes(' ') || zoneArg.includes(','))
+        return false;
+    const labels = zoneArg.split('.');
+    if (labels.length < 2)
+        return false;
+    return labels.every((labelArg) => Boolean(labelArg)
+        && labelArg.length <= 63
+        && /^[a-z0-9](?:[a-z0-9-]*[a-z0-9])?$/.test(labelArg));
+};
+/**
+ * DnsAuthorityManager — owns which zones dcrouter may answer for
+ * authoritatively, and proves that claim rather than accepting it.
+ *
+ * Why this exists: `dnsScopes` was the last un-migrated bootstrap option in an
+ * otherwise DB-driven router. It was read once at startup and had no mutation
+ * path, so claiming a newly delegated zone required a restart — measured at
+ * 30–60 s of total public outage. But simply making the declared list editable
+ * through the ops API would have been worse than the disease: the domain
+ * ownership predicate accepts zone coverage as *proof* precisely because a
+ * caller cannot write it. A `setDnsScopes` mutation would let an operator append
+ * any domain and manufacture that proof — the identical self-assertion vector
+ * that `createDcrouterDomain` used to have.
+ *
+ * So a zone earns authority by delegation instead: its public NS records must
+ * name our `dnsNsDomains`. An ops-API caller cannot fake that without actually
+ * controlling the domain, so the proof stays unforgeable while becoming
+ * mutable at runtime. It is also the comparison that was missing — claimed
+ * authority versus real delegation, checked by the mechanism itself rather than
+ * by an audit bolted on afterwards.
+ *
+ * **There is exactly one source of authority: this database document.** An
+ * earlier revision kept bootstrap `dnsScopes` as an always-in-effect floor and
+ * unioned it with the verified set. That is gone. A floor is a second
+ * representation of the same fact, it can only be changed by a redeploy, and it
+ * cannot be revoked through the API — all three of which are the properties
+ * that produced the outage this path exists to prevent.
+ *
+ * Removing the floor makes the *unreadable database* case load-bearing, so it is
+ * handled explicitly rather than by accident. Three situations, three answers:
+ *
+ *  - **document missing** — a readable database that has never been seeded. The
+ *    authority set is known, and it is empty: claim nothing. Logged at `error`
+ *    with the remediation, and the startup drift audit enumerates every zone
+ *    delegated to us that we are refusing to serve, which is the worklist.
+ *  - **document present, no zones** — identical handling, different message:
+ *    somebody revoked everything, which is a legitimate state we must not
+ *    silently repopulate.
+ *  - **document unreadable** — the authority set is *unknown*. `start()` throws
+ *    rather than reporting an empty set, because rendering an unknown as "claim
+ *    nothing" is exactly how a transient database fault would take every zone
+ *    off the air. `DnsServerRuntime.setup()` then refuses to start on
+ *    `getState() === 'unavailable'`. That second check is not redundant:
+ *    `DnsServer.dependsOn('DnsManager')` only *orders* startup, and taskbuffer
+ *    starts later levels even when an earlier optional service failed, so the
+ *    consumer has to read the state itself. Both services stay failed and
+ *    dcrouter runs degraded until it is restarted with a readable database —
+ *    DNS down and visibly failed, rather than up and asserting nothing.
+ *
+ * Fail closed on authority, never silently on service: with an empty set the
+ * DNS server still starts, still serves DoH, and still picks zones up the moment
+ * one is verified — without a restart.
+ */
+export class DnsAuthorityManager {
+    getExpectedNameservers;
+    verifiedZones = [];
+    updatedAt = 0;
+    updatedBy = '';
+    state = 'unavailable';
+    reconciler;
+    constructor(getExpectedNameservers) {
+        this.getExpectedNameservers = getExpectedNameservers;
+    }
+    // ==========================================================================
+    // Lifecycle
+    // ==========================================================================
+    async start() {
+        let doc;
+        try {
+            doc = await DnsAuthorityDoc.load();
+        }
+        catch (error) {
+            // An unknown authority set is not an empty one. Refuse to start rather
+            // than let every consumer read "no zones" as "revoke everything".
+            this.state = 'unavailable';
+            this.verifiedZones = [];
+            throw new Error(`DnsAuthorityManager: the stored DNS authority set is unreadable (${error.message}). `
+                + 'dcrouter serves DNS authority from the database alone, so an unreadable document leaves authority '
+                + 'unknown — refusing to start rather than claiming nothing for every zone.');
+        }
+        this.state = 'loaded';
+        this.verifiedZones = doc?.verifiedZones ? [...doc.verifiedZones] : [];
+        this.updatedAt = doc?.updatedAt ?? 0;
+        this.updatedBy = doc?.updatedBy ?? '';
+        if (this.verifiedZones.length > 0) {
+            logger.log('info', `DnsAuthorityManager: ${this.verifiedZones.length} delegation-verified zone(s) loaded `
+                + `(${this.verifiedZones.map((entry) => normalizeZone(entry.zone)).join(', ')})`, { zone: 'dns' });
+            return;
+        }
+        // Known-empty. Loud, because every zone is unserved until something is
+        // verified, and because this is the state a first deploy lands in.
+        logger.log('error', doc
+            ? 'DnsAuthorityManager: the DNS authority document exists but lists no verified zones. '
+                + 'dcrouter is authoritative for nothing and will REFUSE every query until a zone is verified.'
+            : 'DnsAuthorityManager: no DNS authority document exists yet. dcrouter is authoritative for nothing '
+                + 'and will REFUSE every query until a zone is verified. Seed the document, or claim each delegated '
+                + 'zone with dns-authority:write (probe first, then verify).', { zone: 'dns', authorityState: 'empty' });
+    }
+    async stop() {
+        this.verifiedZones = [];
+        this.state = 'unavailable';
+        this.reconciler = undefined;
+    }
+    /**
+     * Wire the callback that re-derives runtime state (zone handlers, route
+     * certificate warnings, private-route overlay) after the effective set changes.
+     */
+    setReconciler(reconciler) {
+        this.reconciler = reconciler;
+    }
+    // ==========================================================================
+    // Reads
+    // ==========================================================================
+    /**
+     * The authority set: delegation-verified zones, sorted so every consumer that
+     * needs a stable "first zone" (the DNSSEC signing zone, for one) gets the same
+     * answer across restarts regardless of database insertion order.
+     *
+     * This is what the ownership predicate consumes, and it is the only input to
+     * it. There is no bootstrap contribution.
+     */
+    getEffectiveZoneNames() {
+        const zones = new Set();
+        for (const verified of this.verifiedZones) {
+            const normalized = normalizeZone(verified.zone);
+            if (normalized)
+                zones.add(normalized);
+        }
+        return [...zones].sort();
+    }
+    /** Whether the stored authority set was readable when it was last loaded. */
+    getState() {
+        return this.state;
+    }
+    getSettings() {
+        return {
+            zones: this.verifiedZones
+                .map((entry) => ({ ...entry, zone: normalizeZone(entry.zone), origin: 'verified' }))
+                .sort((a, b) => a.zone.localeCompare(b.zone)),
+            state: this.state,
+            expectedNameservers: this.getExpectedNameservers().map(normalizeNameserver).filter(Boolean),
+            updatedAt: this.updatedAt,
+            updatedBy: this.updatedBy,
+        };
+    }
+    // ==========================================================================
+    // Delegation probe
+    // ==========================================================================
+    /**
+     * Ask the public DNS whether `zone` is delegated to our nameservers.
+     *
+     * Deliberately uses `strategy: 'doh'` — a single DNS-over-HTTPS attempt
+     * against a public resolver, with no system-resolver fallback. smartdns'
+     * `getNameServers()` uses `dns.resolveNs`, i.e. the *system* resolver, which on
+     * a dcrouter host may be dcrouter itself: it would happily answer with the very
+     * NS records we generated, making the probe self-confirming. An independent
+     * vantage point is the whole point of the proof.
+     *
+     * The three verdicts are kept distinct on purpose. A timeout is not evidence
+     * that a zone is not ours; collapsing 'undeterminable' into 'not-delegated'
+     * would let a transient resolver fault revoke authority.
+     */
+    async probeDelegation(zoneArg) {
+        const zone = normalizeZone(zoneArg);
+        const expectedNameservers = this.getExpectedNameservers()
+            .map(normalizeNameserver)
+            .filter(Boolean);
+        if (!isUsableZoneName(zone)) {
+            return {
+                zone,
+                verdict: 'not-delegated',
+                observedNameservers: [],
+                expectedNameservers,
+                detail: `'${zoneArg}' is not a usable zone name`,
+            };
+        }
+        if (expectedNameservers.length === 0) {
+            return {
+                zone,
+                verdict: 'undeterminable',
+                observedNameservers: [],
+                expectedNameservers,
+                detail: 'dnsNsDomains is not configured, so there is no nameserver identity to prove delegation against',
+            };
+        }
+        const smartdnsClient = new plugins.smartdns.dnsClientMod.Smartdns({
+            strategy: 'doh',
+            allowDohFallback: false,
+            timeoutMs: 10_000,
+        });
+        let result;
+        try {
+            result = await smartdnsClient.queryRecords(zone, 'NS');
+        }
+        catch (error) {
+            return {
+                zone,
+                verdict: 'undeterminable',
+                observedNameservers: [],
+                expectedNameservers,
+                detail: `delegation lookup threw: ${error.message}`,
+            };
+        }
+        if (result.status === 'error') {
+            return {
+                zone,
+                verdict: 'undeterminable',
+                observedNameservers: [],
+                expectedNameservers,
+                detail: `delegation lookup failed (${result.error.kind}/${result.error.code}): ${result.error.message}`,
+            };
+        }
+        if (result.status === 'missing') {
+            return {
+                zone,
+                verdict: 'not-delegated',
+                observedNameservers: [],
+                expectedNameservers,
+                detail: result.missingReason === 'nxdomain'
+                    ? `${zone} does not exist in public DNS`
+                    : `${zone} has no NS records in public DNS`,
+            };
+        }
+        const observedNameservers = [...new Set(result.records
+                .map((record) => normalizeNameserver(String(record.value ?? '')))
+                .filter((nameserver) => Boolean(nameserver)))];
+        const matches = observedNameservers.filter((observed) => expectedNameservers.includes(observed));
+        if (matches.length === 0) {
+            return {
+                zone,
+                verdict: 'not-delegated',
+                observedNameservers,
+                expectedNameservers,
+                detail: `${zone} is delegated to ${observedNameservers.join(', ') || 'nothing'}, which does not include any of our nameservers (${expectedNameservers.join(', ')})`,
+            };
+        }
+        return {
+            zone,
+            verdict: 'delegated',
+            observedNameservers,
+            expectedNameservers,
+            detail: `${zone} is delegated to ${matches.join(', ')}`,
+        };
+    }
+    // ==========================================================================
+    // Mutations
+    // ==========================================================================
+    /**
+     * Claim authority over a zone, but only against a positive delegation proof.
+     * An undeterminable probe refuses the mutation — never assume either way.
+     */
+    async verifyZone(zoneArg, verifiedBy) {
+        const zone = normalizeZone(zoneArg);
+        if (!isUsableZoneName(zone)) {
+            return { success: false, message: `'${zoneArg}' is not a usable zone name` };
+        }
+        const probe = await this.probeDelegation(zone);
+        if (probe.verdict !== 'delegated') {
+            return {
+                success: false,
+                probe,
+                message: probe.verdict === 'undeterminable'
+                    ? `Cannot verify ${zone}: ${probe.detail}. Authority is not claimed on an undeterminable probe.`
+                    : `Cannot verify ${zone}: ${probe.detail}`,
+            };
+        }
+        const entry = {
+            zone,
+            origin: 'verified',
+            verifiedAt: Date.now(),
+            observedNameservers: probe.observedNameservers,
+            verifiedBy,
+        };
+        const nextZones = [
+            ...this.verifiedZones.filter((candidate) => normalizeZone(candidate.zone) !== zone),
+            entry,
+        ];
+        const applied = await this.applyZones(nextZones, verifiedBy, `authority claimed for ${zone}`);
+        if (!applied.success) {
+            return { ...applied, probe };
+        }
+        logger.log('info', `DnsAuthorityManager: ${zone} verified as ours (delegated to ${probe.observedNameservers.join(', ')}) and applied without a restart`, { zone: 'dns', verifiedBy });
+        return { success: true, probe, settings: this.getSettings() };
+    }
+    /**
+     * Drop a verified zone. Every zone is revocable — there is no undroppable
+     * deployment-declared floor any more, so withdrawing authority never needs a
+     * redeploy and never leaves the router asserting a claim it cannot retract.
+     */
+    async revokeZone(zoneArg, updatedBy) {
+        const zone = normalizeZone(zoneArg);
+        if (!this.verifiedZones.some((candidate) => normalizeZone(candidate.zone) === zone)) {
+            return { success: false, message: `${zone} is not a verified zone` };
+        }
+        const nextZones = this.verifiedZones.filter((candidate) => normalizeZone(candidate.zone) !== zone);
+        const applied = await this.applyZones(nextZones, updatedBy, `authority revoked for ${zone}`);
+        if (!applied.success) {
+            return applied;
+        }
+        logger.log('info', `DnsAuthorityManager: authority over ${zone} revoked and torn down in-process`, {
+            zone: 'dns',
+            updatedBy,
+        });
+        return { success: true, settings: this.getSettings() };
+    }
+    /**
+     * Persist a new zone set and reconcile the running process against it.
+     *
+     * Fail closed: if reconciliation throws, the previous set is restored in the
+     * database and re-reconciled, so the router is never left half-converted.
+     * Reconciliation is idempotent, which is what makes the rollback safe.
+     */
+    async applyZones(nextZones, updatedBy, reason) {
+        const previousZones = [...this.verifiedZones];
+        const previousUpdatedAt = this.updatedAt;
+        const previousUpdatedBy = this.updatedBy;
+        this.verifiedZones = nextZones;
+        this.updatedAt = Date.now();
+        this.updatedBy = updatedBy;
+        try {
+            await this.persist();
+        }
+        catch (error) {
+            this.verifiedZones = previousZones;
+            this.updatedAt = previousUpdatedAt;
+            this.updatedBy = previousUpdatedBy;
+            return { success: false, message: `Failed to persist DNS authority: ${error.message}` };
+        }
+        try {
+            await this.reconciler?.(reason);
+        }
+        catch (error) {
+            const applyError = error.message;
+            this.verifiedZones = previousZones;
+            this.updatedAt = previousUpdatedAt;
+            this.updatedBy = previousUpdatedBy;
+            let rollbackNote = '';
+            try {
+                await this.persist();
+                await this.reconciler?.(`rollback of ${reason}`);
+            }
+            catch (rollbackError) {
+                rollbackNote = ` Rollback also failed: ${rollbackError.message}. `
+                    + 'Runtime DNS state may be inconsistent — restart dcrouter to rebuild it deterministically.';
+                logger.log('error', `DnsAuthorityManager: rollback failed after ${reason}.${rollbackNote}`, {
+                    zone: 'dns',
+                });
+            }
+            return {
+                success: false,
+                message: `Failed to apply DNS authority change (${reason}): ${applyError}. `
+                    + `The change was rolled back and nothing was left half-applied.${rollbackNote}`,
+            };
+        }
+        return { success: true, settings: this.getSettings() };
+    }
+    async persist() {
+        let doc = await DnsAuthorityDoc.load();
+        if (!doc) {
+            doc = new DnsAuthorityDoc();
+            doc.settingsId = 'dns-authority-settings';
+        }
+        doc.verifiedZones = this.verifiedZones;
+        doc.updatedAt = this.updatedAt;
+        doc.updatedBy = this.updatedBy;
+        await doc.save();
+    }
+    // ==========================================================================
+    // Drift audit
+    // ==========================================================================
+    /**
+     * Compare claimed authority against what is actually true, in every direction.
+     *
+     * This is the check whose absence let one zone sit declared in `dnsScopes`
+     * while four live zones were delegated to our nameservers and unclaimed.
+     *
+     * Advisory by design. It never mutates the authority set: a resolver blip at
+     * startup must not revoke authority for every zone and convert a transient
+     * fault into the outage this whole path exists to avoid. Undeterminable probes
+     * are skipped rather than reported as drift.
+     */
+    async auditDelegationDrift() {
+        const drift = [];
+        const effectiveZones = new Set(this.getEffectiveZoneNames());
+        const domains = await DomainDoc.findAll();
+        const hostedZones = new Set(domains
+            .filter((domainArg) => domainArg.source === 'dcrouter')
+            .map((domainArg) => normalizeZone(domainArg.name))
+            .filter(Boolean));
+        // Direction 1: a dcrouter-hosted zone delegated to us but not claimed.
+        for (const zone of [...hostedZones].filter((zone) => !effectiveZones.has(zone))) {
+            const probe = await this.probeDelegation(zone);
+            if (probe.verdict !== 'delegated')
+                continue;
+            drift.push({
+                zone,
+                kind: 'delegated-but-unclaimed',
+                observedNameservers: probe.observedNameservers,
+                expectedNameservers: probe.expectedNameservers,
+                detail: `${zone} is delegated to ${probe.observedNameservers.join(', ')} but is not in the authority set, `
+                    + 'so dcrouter refuses to serve it authoritatively and will not request certificates for it',
+            });
+        }
+        // Direction 2: a verified zone whose delegation moved away from us.
+        for (const verified of this.verifiedZones) {
+            const zone = normalizeZone(verified.zone);
+            const probe = await this.probeDelegation(zone);
+            if (probe.verdict !== 'not-delegated')
+                continue;
+            drift.push({
+                zone,
+                kind: 'claimed-but-not-delegated',
+                observedNameservers: probe.observedNameservers,
+                expectedNameservers: probe.expectedNameservers,
+                detail: `${zone} was verified at ${verified.verifiedAt ? new Date(verified.verifiedAt).toISOString() : 'an unknown time'} `
+                    + `but its delegation now names ${probe.observedNameservers.join(', ') || 'nothing'}; `
+                    + 'dcrouter is still claiming authority over a zone that is no longer delegated to it',
+            });
+        }
+        // Direction 3: a claimed zone with nothing behind it. Records and generated
+        // apex NS both hang off a dcrouter-hosted DomainDoc, so authority without
+        // one is a zone we answer for and have nothing to say about — a lame
+        // delegation of our own making. Cheap to detect and impossible to notice
+        // otherwise, because the zone REFUSES nothing and answers nothing.
+        for (const zone of effectiveZones) {
+            if (hostedZones.has(zone))
+                continue;
+            drift.push({
+                zone,
+                kind: 'verified-but-unhosted',
+                observedNameservers: [],
+                expectedNameservers: this.getExpectedNameservers().map(normalizeNameserver).filter(Boolean),
+                detail: `${zone} is in the authority set but has no dcrouter-hosted domain, so no records and no `
+                    + 'generated apex NS are served for it; create the domain in the DNS manager or revoke the authority claim',
+            });
+        }
+        return drift;
+    }
+    /** Run the audit and log every finding at `error`. Never throws. */
+    async logDelegationDrift() {
+        let drift;
+        try {
+            drift = await this.auditDelegationDrift();
+        }
+        catch (error) {
+            logger.log('warn', `DnsAuthorityManager: delegation drift audit could not complete: ${error.message}`, { zone: 'dns' });
+            return;
+        }
+        for (const entry of drift) {
+            logger.log('error', `DNS authority drift (${entry.kind}): ${entry.detail}`, {
+                zone: 'dns',
+                driftKind: entry.kind,
+                driftZone: entry.zone,
+            });
+        }
+        if (drift.length === 0) {
+            logger.log('info', 'DnsAuthorityManager: declared authority matches observed delegation', {
+                zone: 'dns',
+            });
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoibWFuYWdlci5kbnMtYXV0aG9yaXR5LmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvZG5zL21hbmFnZXIuZG5zLWF1dGhvcml0eS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxPQUFPLEtBQUssT0FBTyxNQUFNLGVBQWUsQ0FBQztBQUN6QyxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sY0FBYyxDQUFDO0FBQ3RDLE9BQU8sRUFBRSxlQUFlLEVBQUUsU0FBUyxFQUFFLE1BQU0sMEJBQTBCLENBQUM7QUF1QnRFLE1BQU0sYUFBYSxHQUFHLENBQUMsT0FBZSxFQUFVLEVBQUUsQ0FDaEQsT0FBTyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFFbEQsZ0VBQWdFO0FBQ2hFLE1BQU0sbUJBQW1CLEdBQUcsQ0FBQyxhQUFxQixFQUFVLEVBQUUsQ0FDNUQsYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDLE9BQU8sQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUM7QUFFeEQsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLE9BQWUsRUFBVyxFQUFFO0lBQ3BELElBQUksQ0FBQyxPQUFPLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxHQUFHO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDbkQsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLElBQUksT0FBTyxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUMxRixNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ2xDLElBQUksTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQUUsT0FBTyxLQUFLLENBQUM7SUFDcEMsT0FBTyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxPQUFPLENBQUMsUUFBUSxDQUFDO1dBQzlDLFFBQVEsQ0FBQyxNQUFNLElBQUksRUFBRTtXQUNyQixtQ0FBbUMsQ0FBQyxJQUFJLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztBQUMzRCxDQUFDLENBQUM7QUFFRjs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7Ozs7OztHQW9ERztBQUNILE1BQU0sT0FBTyxtQkFBbUI7SUFRcEI7SUFQRixhQUFhLEdBQXdCLEVBQUUsQ0FBQztJQUN4QyxTQUFTLEdBQUcsQ0FBQyxDQUFDO0lBQ2QsU0FBUyxHQUFHLEVBQUUsQ0FBQztJQUNmLEtBQUssR0FBdUIsYUFBYSxDQUFDO0lBQzFDLFVBQVUsQ0FBMkI7SUFFN0MsWUFDVSxzQkFBc0M7UUFBdEMsMkJBQXNCLEdBQXRCLHNCQUFzQixDQUFnQjtJQUM3QyxDQUFDO0lBRUosNkVBQTZFO0lBQzdFLFlBQVk7SUFDWiw2RUFBNkU7SUFFdEUsS0FBSyxDQUFDLEtBQUs7UUFDaEIsSUFBSSxHQUEyQixDQUFDO1FBQ2hDLElBQUksQ0FBQztZQUNILEdBQUcsR0FBRyxNQUFNLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUNyQyxDQUFDO1FBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztZQUN4Qix1RUFBdUU7WUFDdkUsa0VBQWtFO1lBQ2xFLElBQUksQ0FBQyxLQUFLLEdBQUcsYUFBYSxDQUFDO1lBQzNCLElBQUksQ0FBQyxhQUFhLEdBQUcsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQ2Isb0VBQXFFLEtBQWUsQ0FBQyxPQUFPLEtBQUs7a0JBQzdGLG9HQUFvRztrQkFDcEcsMEVBQTBFLENBQy9FLENBQUM7UUFDSixDQUFDO1FBRUQsSUFBSSxDQUFDLEtBQUssR0FBRyxRQUFRLENBQUM7UUFDdEIsSUFBSSxDQUFDLGFBQWEsR0FBRyxHQUFHLEVBQUUsYUFBYSxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsR0FBRyxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7UUFDdEUsSUFBSSxDQUFDLFNBQVMsR0FBRyxHQUFHLEVBQUUsU0FBUyxJQUFJLENBQUMsQ0FBQztRQUNyQyxJQUFJLENBQUMsU0FBUyxHQUFHLEdBQUcsRUFBRSxTQUFTLElBQUksRUFBRSxDQUFDO1FBRXRDLElBQUksSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDbEMsTUFBTSxDQUFDLEdBQUcsQ0FDUixNQUFNLEVBQ04sd0JBQXdCLElBQUksQ0FBQyxhQUFhLENBQUMsTUFBTSxzQ0FBc0M7a0JBQ25GLElBQUksSUFBSSxDQUFDLGFBQWEsQ0FBQyxHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFDbEYsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLENBQ2hCLENBQUM7WUFDRixPQUFPO1FBQ1QsQ0FBQztRQUVELHVFQUF1RTtRQUN2RSxtRUFBbUU7UUFDbkUsTUFBTSxDQUFDLEdBQUcsQ0FDUixPQUFPLEVBQ1AsR0FBRztZQUNELENBQUMsQ0FBQyxzRkFBc0Y7a0JBQ3BGLDZGQUE2RjtZQUNqRyxDQUFDLENBQUMsbUdBQW1HO2tCQUNqRyxtR0FBbUc7a0JBQ25HLDJEQUEyRCxFQUNqRSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsY0FBYyxFQUFFLE9BQU8sRUFBRSxDQUN6QyxDQUFDO0lBQ0osQ0FBQztJQUVNLEtBQUssQ0FBQyxJQUFJO1FBQ2YsSUFBSSxDQUFDLGFBQWEsR0FBRyxFQUFFLENBQUM7UUFDeEIsSUFBSSxDQUFDLEtBQUssR0FBRyxhQUFhLENBQUM7UUFDM0IsSUFBSSxDQUFDLFVBQVUsR0FBRyxTQUFTLENBQUM7SUFDOUIsQ0FBQztJQUVEOzs7T0FHRztJQUNJLGFBQWEsQ0FBQyxVQUFvQztRQUN2RCxJQUFJLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztJQUMvQixDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLFFBQVE7SUFDUiw2RUFBNkU7SUFFN0U7Ozs7Ozs7T0FPRztJQUNJLHFCQUFxQjtRQUMxQixNQUFNLEtBQUssR0FBRyxJQUFJLEdBQUcsRUFBVSxDQUFDO1FBQ2hDLEtBQUssTUFBTSxRQUFRLElBQUksSUFBSSxDQUFDLGFBQWEsRUFBRSxDQUFDO1lBQzFDLE1BQU0sVUFBVSxHQUFHLGFBQWEsQ0FBQyxRQUFRLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDaEQsSUFBSSxVQUFVO2dCQUFFLEtBQUssQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDeEMsQ0FBQztRQUNELE9BQU8sQ0FBQyxHQUFHLEtBQUssQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO0lBQzNCLENBQUM7SUFFRCw2RUFBNkU7SUFDdEUsUUFBUTtRQUNiLE9BQU8sSUFBSSxDQUFDLEtBQUssQ0FBQztJQUNwQixDQUFDO0lBRU0sV0FBVztRQUNoQixPQUFPO1lBQ0wsS0FBSyxFQUFFLElBQUksQ0FBQyxhQUFhO2lCQUN0QixHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsRUFBRSxHQUFHLEtBQUssRUFBRSxJQUFJLEVBQUUsYUFBYSxDQUFDLEtBQUssQ0FBQyxJQUFJLENBQUMsRUFBRSxNQUFNLEVBQUUsVUFBbUIsRUFBRSxDQUFDLENBQUM7aUJBQzVGLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUMvQyxLQUFLLEVBQUUsSUFBSSxDQUFDLEtBQUs7WUFDakIsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLHNCQUFzQixFQUFFLENBQUMsR0FBRyxDQUFDLG1CQUFtQixDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztZQUMzRixTQUFTLEVBQUUsSUFBSSxDQUFDLFNBQVM7WUFDekIsU0FBUyxFQUFFLElBQUksQ0FBQyxTQUFTO1NBQzFCLENBQUM7SUFDSixDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLG1CQUFtQjtJQUNuQiw2RUFBNkU7SUFFN0U7Ozs7Ozs7Ozs7Ozs7T0FhRztJQUNJLEtBQUssQ0FBQyxlQUFlLENBQUMsT0FBZTtRQUMxQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsT0FBTyxDQUFDLENBQUM7UUFDcEMsTUFBTSxtQkFBbUIsR0FBRyxJQUFJLENBQUMsc0JBQXNCLEVBQUU7YUFDdEQsR0FBRyxDQUFDLG1CQUFtQixDQUFDO2FBQ3hCLE1BQU0sQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUVuQixJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM1QixPQUFPO2dCQUNMLElBQUk7Z0JBQ0osT0FBTyxFQUFFLGVBQWU7Z0JBQ3hCLG1CQUFtQixFQUFFLEVBQUU7Z0JBQ3ZCLG1CQUFtQjtnQkFDbkIsTUFBTSxFQUFFLElBQUksT0FBTyw2QkFBNkI7YUFDakQsQ0FBQztRQUNKLENBQUM7UUFDRCxJQUFJLG1CQUFtQixDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUNyQyxPQUFPO2dCQUNMLElBQUk7Z0JBQ0osT0FBTyxFQUFFLGdCQUFnQjtnQkFDekIsbUJBQW1CLEVBQUUsRUFBRTtnQkFDdkIsbUJBQW1CO2dCQUNuQixNQUFNLEVBQUUsZ0dBQWdHO2FBQ3pHLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsSUFBSSxPQUFPLENBQUMsUUFBUSxDQUFDLFlBQVksQ0FBQyxRQUFRLENBQUM7WUFDaEUsUUFBUSxFQUFFLEtBQUs7WUFDZixnQkFBZ0IsRUFBRSxLQUFLO1lBQ3ZCLFNBQVMsRUFBRSxNQUFNO1NBQ2xCLENBQUMsQ0FBQztRQUVILElBQUksTUFBK0QsQ0FBQztRQUNwRSxJQUFJLENBQUM7WUFDSCxNQUFNLEdBQUcsTUFBTSxjQUFjLENBQUMsWUFBWSxDQUFDLElBQUksRUFBRSxJQUFJLENBQUMsQ0FBQztRQUN6RCxDQUFDO1FBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPO2dCQUNMLElBQUk7Z0JBQ0osT0FBTyxFQUFFLGdCQUFnQjtnQkFDekIsbUJBQW1CLEVBQUUsRUFBRTtnQkFDdkIsbUJBQW1CO2dCQUNuQixNQUFNLEVBQUUsNEJBQTZCLEtBQWUsQ0FBQyxPQUFPLEVBQUU7YUFDL0QsQ0FBQztRQUNKLENBQUM7UUFFRCxJQUFJLE1BQU0sQ0FBQyxNQUFNLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDOUIsT0FBTztnQkFDTCxJQUFJO2dCQUNKLE9BQU8sRUFBRSxnQkFBZ0I7Z0JBQ3pCLG1CQUFtQixFQUFFLEVBQUU7Z0JBQ3ZCLG1CQUFtQjtnQkFDbkIsTUFBTSxFQUFFLDZCQUE2QixNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksSUFBSSxNQUFNLENBQUMsS0FBSyxDQUFDLElBQUksTUFBTSxNQUFNLENBQUMsS0FBSyxDQUFDLE9BQU8sRUFBRTthQUN4RyxDQUFDO1FBQ0osQ0FBQztRQUVELElBQUksTUFBTSxDQUFDLE1BQU0sS0FBSyxTQUFTLEVBQUUsQ0FBQztZQUNoQyxPQUFPO2dCQUNMLElBQUk7Z0JBQ0osT0FBTyxFQUFFLGVBQWU7Z0JBQ3hCLG1CQUFtQixFQUFFLEVBQUU7Z0JBQ3ZCLG1CQUFtQjtnQkFDbkIsTUFBTSxFQUFFLE1BQU0sQ0FBQyxhQUFhLEtBQUssVUFBVTtvQkFDekMsQ0FBQyxDQUFDLEdBQUcsSUFBSSwrQkFBK0I7b0JBQ3hDLENBQUMsQ0FBQyxHQUFHLElBQUksa0NBQWtDO2FBQzlDLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxtQkFBbUIsR0FBYSxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQy9DLE1BQU0sQ0FBQyxPQUFPO2lCQUNYLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBVSxFQUFFLENBQUMsbUJBQW1CLENBQUMsTUFBTSxDQUFDLE1BQU0sQ0FBQyxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsQ0FBQztpQkFDeEUsTUFBTSxDQUFDLENBQUMsVUFBVSxFQUF3QixFQUFFLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDLENBQ3JFLENBQUMsQ0FBQztRQUNILE1BQU0sT0FBTyxHQUFHLG1CQUFtQixDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsbUJBQW1CLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFDakcsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pCLE9BQU87Z0JBQ0wsSUFBSTtnQkFDSixPQUFPLEVBQUUsZUFBZTtnQkFDeEIsbUJBQW1CO2dCQUNuQixtQkFBbUI7Z0JBQ25CLE1BQU0sRUFBRSxHQUFHLElBQUksb0JBQW9CLG1CQUFtQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxTQUFTLG9EQUFvRCxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7YUFDcEssQ0FBQztRQUNKLENBQUM7UUFDRCxPQUFPO1lBQ0wsSUFBSTtZQUNKLE9BQU8sRUFBRSxXQUFXO1lBQ3BCLG1CQUFtQjtZQUNuQixtQkFBbUI7WUFDbkIsTUFBTSxFQUFFLEdBQUcsSUFBSSxvQkFBb0IsT0FBTyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsRUFBRTtTQUN4RCxDQUFDO0lBQ0osQ0FBQztJQUVELDZFQUE2RTtJQUM3RSxZQUFZO0lBQ1osNkVBQTZFO0lBRTdFOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxVQUFVLENBQUMsT0FBZSxFQUFFLFVBQWtCO1FBQ3pELE1BQU0sSUFBSSxHQUFHLGFBQWEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNwQyxJQUFJLENBQUMsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQztZQUM1QixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsSUFBSSxPQUFPLDZCQUE2QixFQUFFLENBQUM7UUFDL0UsQ0FBQztRQUVELE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztRQUMvQyxJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssV0FBVyxFQUFFLENBQUM7WUFDbEMsT0FBTztnQkFDTCxPQUFPLEVBQUUsS0FBSztnQkFDZCxLQUFLO2dCQUNMLE9BQU8sRUFBRSxLQUFLLENBQUMsT0FBTyxLQUFLLGdCQUFnQjtvQkFDekMsQ0FBQyxDQUFDLGlCQUFpQixJQUFJLEtBQUssS0FBSyxDQUFDLE1BQU0sd0RBQXdEO29CQUNoRyxDQUFDLENBQUMsaUJBQWlCLElBQUksS0FBSyxLQUFLLENBQUMsTUFBTSxFQUFFO2FBQzdDLENBQUM7UUFDSixDQUFDO1FBRUQsTUFBTSxLQUFLLEdBQXNCO1lBQy9CLElBQUk7WUFDSixNQUFNLEVBQUUsVUFBVTtZQUNsQixVQUFVLEVBQUUsSUFBSSxDQUFDLEdBQUcsRUFBRTtZQUN0QixtQkFBbUIsRUFBRSxLQUFLLENBQUMsbUJBQW1CO1lBQzlDLFVBQVU7U0FDWCxDQUFDO1FBQ0YsTUFBTSxTQUFTLEdBQUc7WUFDaEIsR0FBRyxJQUFJLENBQUMsYUFBYSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUM7WUFDbkYsS0FBSztTQUNOLENBQUM7UUFDRixNQUFNLE9BQU8sR0FBRyxNQUFNLElBQUksQ0FBQyxVQUFVLENBQUMsU0FBUyxFQUFFLFVBQVUsRUFBRSx5QkFBeUIsSUFBSSxFQUFFLENBQUMsQ0FBQztRQUM5RixJQUFJLENBQUMsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3JCLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxLQUFLLEVBQUUsQ0FBQztRQUMvQixDQUFDO1FBQ0QsTUFBTSxDQUFDLEdBQUcsQ0FDUixNQUFNLEVBQ04sd0JBQXdCLElBQUksbUNBQW1DLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLGlDQUFpQyxFQUNwSSxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsVUFBVSxFQUFFLENBQzVCLENBQUM7UUFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO0lBQ2hFLENBQUM7SUFFRDs7OztPQUlHO0lBQ0ksS0FBSyxDQUFDLFVBQVUsQ0FBQyxPQUFlLEVBQUUsU0FBaUI7UUFDeEQsTUFBTSxJQUFJLEdBQUcsYUFBYSxDQUFDLE9BQU8sQ0FBQyxDQUFDO1FBQ3BDLElBQUksQ0FBQyxJQUFJLENBQUMsYUFBYSxDQUFDLElBQUksQ0FBQyxDQUFDLFNBQVMsRUFBRSxFQUFFLENBQUMsYUFBYSxDQUFDLFNBQVMsQ0FBQyxJQUFJLENBQUMsS0FBSyxJQUFJLENBQUMsRUFBRSxDQUFDO1lBQ3BGLE9BQU8sRUFBRSxPQUFPLEVBQUUsS0FBSyxFQUFFLE9BQU8sRUFBRSxHQUFHLElBQUkseUJBQXlCLEVBQUUsQ0FBQztRQUN2RSxDQUFDO1FBQ0QsTUFBTSxTQUFTLEdBQUcsSUFBSSxDQUFDLGFBQWEsQ0FBQyxNQUFNLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLEtBQUssSUFBSSxDQUFDLENBQUM7UUFDbkcsTUFBTSxPQUFPLEdBQUcsTUFBTSxJQUFJLENBQUMsVUFBVSxDQUFDLFNBQVMsRUFBRSxTQUFTLEVBQUUseUJBQXlCLElBQUksRUFBRSxDQUFDLENBQUM7UUFDN0YsSUFBSSxDQUFDLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNyQixPQUFPLE9BQU8sQ0FBQztRQUNqQixDQUFDO1FBQ0QsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsdUNBQXVDLElBQUksbUNBQW1DLEVBQUU7WUFDakcsSUFBSSxFQUFFLEtBQUs7WUFDWCxTQUFTO1NBQ1YsQ0FBQyxDQUFDO1FBQ0gsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO0lBQ3pELENBQUM7SUFFRDs7Ozs7O09BTUc7SUFDSyxLQUFLLENBQUMsVUFBVSxDQUN0QixTQUE4QixFQUM5QixTQUFpQixFQUNqQixNQUFjO1FBRWQsTUFBTSxhQUFhLEdBQUcsQ0FBQyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsQ0FBQztRQUM5QyxNQUFNLGlCQUFpQixHQUFHLElBQUksQ0FBQyxTQUFTLENBQUM7UUFDekMsTUFBTSxpQkFBaUIsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBRXpDLElBQUksQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDO1FBQy9CLElBQUksQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1FBQzVCLElBQUksQ0FBQyxTQUFTLEdBQUcsU0FBUyxDQUFDO1FBRTNCLElBQUksQ0FBQztZQUNILE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQ3ZCLENBQUM7UUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1lBQ3hCLElBQUksQ0FBQyxhQUFhLEdBQUcsYUFBYSxDQUFDO1lBQ25DLElBQUksQ0FBQyxTQUFTLEdBQUcsaUJBQWlCLENBQUM7WUFDbkMsSUFBSSxDQUFDLFNBQVMsR0FBRyxpQkFBaUIsQ0FBQztZQUNuQyxPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsb0NBQXFDLEtBQWUsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDO1FBQ3JHLENBQUM7UUFFRCxJQUFJLENBQUM7WUFDSCxNQUFNLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUNsQyxDQUFDO1FBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztZQUN4QixNQUFNLFVBQVUsR0FBSSxLQUFlLENBQUMsT0FBTyxDQUFDO1lBQzVDLElBQUksQ0FBQyxhQUFhLEdBQUcsYUFBYSxDQUFDO1lBQ25DLElBQUksQ0FBQyxTQUFTLEdBQUcsaUJBQWlCLENBQUM7WUFDbkMsSUFBSSxDQUFDLFNBQVMsR0FBRyxpQkFBaUIsQ0FBQztZQUNuQyxJQUFJLFlBQVksR0FBRyxFQUFFLENBQUM7WUFDdEIsSUFBSSxDQUFDO2dCQUNILE1BQU0sSUFBSSxDQUFDLE9BQU8sRUFBRSxDQUFDO2dCQUNyQixNQUFNLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQyxlQUFlLE1BQU0sRUFBRSxDQUFDLENBQUM7WUFDbkQsQ0FBQztZQUFDLE9BQU8sYUFBc0IsRUFBRSxDQUFDO2dCQUNoQyxZQUFZLEdBQUcsMEJBQTJCLGFBQXVCLENBQUMsT0FBTyxJQUFJO3NCQUN6RSwyRkFBMkYsQ0FBQztnQkFDaEcsTUFBTSxDQUFDLEdBQUcsQ0FBQyxPQUFPLEVBQUUsOENBQThDLE1BQU0sSUFBSSxZQUFZLEVBQUUsRUFBRTtvQkFDMUYsSUFBSSxFQUFFLEtBQUs7aUJBQ1osQ0FBQyxDQUFDO1lBQ0wsQ0FBQztZQUNELE9BQU87Z0JBQ0wsT0FBTyxFQUFFLEtBQUs7Z0JBQ2QsT0FBTyxFQUFFLHlDQUF5QyxNQUFNLE1BQU0sVUFBVSxJQUFJO3NCQUN4RSxnRUFBZ0UsWUFBWSxFQUFFO2FBQ25GLENBQUM7UUFDSixDQUFDO1FBRUQsT0FBTyxFQUFFLE9BQU8sRUFBRSxJQUFJLEVBQUUsUUFBUSxFQUFFLElBQUksQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDO0lBQ3pELENBQUM7SUFFTyxLQUFLLENBQUMsT0FBTztRQUNuQixJQUFJLEdBQUcsR0FBRyxNQUFNLGVBQWUsQ0FBQyxJQUFJLEVBQUUsQ0FBQztRQUN2QyxJQUFJLENBQUMsR0FBRyxFQUFFLENBQUM7WUFDVCxHQUFHLEdBQUcsSUFBSSxlQUFlLEVBQUUsQ0FBQztZQUM1QixHQUFHLENBQUMsVUFBVSxHQUFHLHdCQUF3QixDQUFDO1FBQzVDLENBQUM7UUFDRCxHQUFHLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUM7UUFDdkMsR0FBRyxDQUFDLFNBQVMsR0FBRyxJQUFJLENBQUMsU0FBUyxDQUFDO1FBQy9CLEdBQUcsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLFNBQVMsQ0FBQztRQUMvQixNQUFNLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztJQUNuQixDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLGNBQWM7SUFDZCw2RUFBNkU7SUFFN0U7Ozs7Ozs7Ozs7T0FVRztJQUNJLEtBQUssQ0FBQyxvQkFBb0I7UUFDL0IsTUFBTSxLQUFLLEdBQXlCLEVBQUUsQ0FBQztRQUN2QyxNQUFNLGNBQWMsR0FBRyxJQUFJLEdBQUcsQ0FBQyxJQUFJLENBQUMscUJBQXFCLEVBQUUsQ0FBQyxDQUFDO1FBRTdELE1BQU0sT0FBTyxHQUFHLE1BQU0sU0FBUyxDQUFDLE9BQU8sRUFBRSxDQUFDO1FBQzFDLE1BQU0sV0FBVyxHQUFHLElBQUksR0FBRyxDQUN6QixPQUFPO2FBQ0osTUFBTSxDQUFDLENBQUMsU0FBUyxFQUFFLEVBQUUsQ0FBQyxTQUFTLENBQUMsTUFBTSxLQUFLLFVBQVUsQ0FBQzthQUN0RCxHQUFHLENBQUMsQ0FBQyxTQUFTLEVBQUUsRUFBRSxDQUFDLGFBQWEsQ0FBQyxTQUFTLENBQUMsSUFBSSxDQUFDLENBQUM7YUFDakQsTUFBTSxDQUFDLE9BQU8sQ0FBQyxDQUNuQixDQUFDO1FBRUYsdUVBQXVFO1FBQ3ZFLEtBQUssTUFBTSxJQUFJLElBQUksQ0FBQyxHQUFHLFdBQVcsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxDQUFDLElBQUksRUFBRSxFQUFFLENBQUMsQ0FBQyxjQUFjLENBQUMsR0FBRyxDQUFDLElBQUksQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNoRixNQUFNLEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxlQUFlLENBQUMsSUFBSSxDQUFDLENBQUM7WUFDL0MsSUFBSSxLQUFLLENBQUMsT0FBTyxLQUFLLFdBQVc7Z0JBQUUsU0FBUztZQUM1QyxLQUFLLENBQUMsSUFBSSxDQUFDO2dCQUNULElBQUk7Z0JBQ0osSUFBSSxFQUFFLHlCQUF5QjtnQkFDL0IsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLG1CQUFtQjtnQkFDOUMsbUJBQW1CLEVBQUUsS0FBSyxDQUFDLG1CQUFtQjtnQkFDOUMsTUFBTSxFQUFFLEdBQUcsSUFBSSxvQkFBb0IsS0FBSyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsb0NBQW9DO3NCQUN2RywwRkFBMEY7YUFDL0YsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELG9FQUFvRTtRQUNwRSxLQUFLLE1BQU0sUUFBUSxJQUFJLElBQUksQ0FBQyxhQUFhLEVBQUUsQ0FBQztZQUMxQyxNQUFNLElBQUksR0FBRyxhQUFhLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzFDLE1BQU0sS0FBSyxHQUFHLE1BQU0sSUFBSSxDQUFDLGVBQWUsQ0FBQyxJQUFJLENBQUMsQ0FBQztZQUMvQyxJQUFJLEtBQUssQ0FBQyxPQUFPLEtBQUssZUFBZTtnQkFBRSxTQUFTO1lBQ2hELEtBQUssQ0FBQyxJQUFJLENBQUM7Z0JBQ1QsSUFBSTtnQkFDSixJQUFJLEVBQUUsMkJBQTJCO2dCQUNqQyxtQkFBbUIsRUFBRSxLQUFLLENBQUMsbUJBQW1CO2dCQUM5QyxtQkFBbUIsRUFBRSxLQUFLLENBQUMsbUJBQW1CO2dCQUM5QyxNQUFNLEVBQUUsR0FBRyxJQUFJLG9CQUFvQixRQUFRLENBQUMsVUFBVSxDQUFDLENBQUMsQ0FBQyxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsVUFBVSxDQUFDLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLGlCQUFpQixHQUFHO3NCQUN2SCxnQ0FBZ0MsS0FBSyxDQUFDLG1CQUFtQixDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsSUFBSSxTQUFTLElBQUk7c0JBQ3JGLG9GQUFvRjthQUN6RixDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsNEVBQTRFO1FBQzVFLDBFQUEwRTtRQUMxRSxxRUFBcUU7UUFDckUseUVBQXlFO1FBQ3pFLG1FQUFtRTtRQUNuRSxLQUFLLE1BQU0sSUFBSSxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ2xDLElBQUksV0FBVyxDQUFDLEdBQUcsQ0FBQyxJQUFJLENBQUM7Z0JBQUUsU0FBUztZQUNwQyxLQUFLLENBQUMsSUFBSSxDQUFDO2dCQUNULElBQUk7Z0JBQ0osSUFBSSxFQUFFLHVCQUF1QjtnQkFDN0IsbUJBQW1CLEVBQUUsRUFBRTtnQkFDdkIsbUJBQW1CLEVBQUUsSUFBSSxDQUFDLHNCQUFzQixFQUFFLENBQUMsR0FBRyxDQUFDLG1CQUFtQixDQUFDLENBQUMsTUFBTSxDQUFDLE9BQU8sQ0FBQztnQkFDM0YsTUFBTSxFQUFFLEdBQUcsSUFBSSxtRkFBbUY7c0JBQzlGLHlHQUF5RzthQUM5RyxDQUFDLENBQUM7UUFDTCxDQUFDO1FBRUQsT0FBTyxLQUFLLENBQUM7SUFDZixDQUFDO0lBRUQsb0VBQW9FO0lBQzdELEtBQUssQ0FBQyxrQkFBa0I7UUFDN0IsSUFBSSxLQUEyQixDQUFDO1FBQ2hDLElBQUksQ0FBQztZQUNILEtBQUssR0FBRyxNQUFNLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1FBQzVDLENBQUM7UUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sQ0FBQyxHQUFHLENBQ1IsTUFBTSxFQUNOLG1FQUFvRSxLQUFlLENBQUMsT0FBTyxFQUFFLEVBQzdGLEVBQUUsSUFBSSxFQUFFLEtBQUssRUFBRSxDQUNoQixDQUFDO1lBQ0YsT0FBTztRQUNULENBQUM7UUFDRCxLQUFLLE1BQU0sS0FBSyxJQUFJLEtBQUssRUFBRSxDQUFDO1lBQzFCLE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLHdCQUF3QixLQUFLLENBQUMsSUFBSSxNQUFNLEtBQUssQ0FBQyxNQUFNLEVBQUUsRUFBRTtnQkFDMUUsSUFBSSxFQUFFLEtBQUs7Z0JBQ1gsU0FBUyxFQUFFLEtBQUssQ0FBQyxJQUFJO2dCQUNyQixTQUFTLEVBQUUsS0FBSyxDQUFDLElBQUk7YUFDdEIsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUNELElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDLEVBQUUsQ0FBQztZQUN2QixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxxRUFBcUUsRUFBRTtnQkFDeEYsSUFBSSxFQUFFLEtBQUs7YUFDWixDQUFDLENBQUM7UUFDTCxDQUFDO0lBQ0gsQ0FBQztDQUNGIn0=