@serve.zone/dcrouter 18.0.1 → 18.1.0

package/dist_ts/email/classes.smtp-account.manager.js

@@ -0,0 +1,507 @@
+import { assertValidAuthAccounts } from '@push.rocks/smartmta';
+import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
+import { SmtpAccountDoc } from '../db/index.js';
+import { isWorkAppManagedMailRouteName, isWorkAppManagedSmtpUsername, } from './classes.workapp-mail-manager.js';
+import { deriveSmtpScramVerifier, generateSmtpAccountPassword } from './smtp-scram.js';
+/** Route names generated (and owned wholesale) by SmtpAccountManager. */
+export function isSmtpAccountRouteName(routeName) {
+    return routeName.startsWith('smtp-account-');
+}
+const SMTP_ACCOUNT_USERNAME_PATTERN = /^[a-z0-9][a-z0-9._-]{2,63}$/;
+/** Literal domain label chain — no wildcards, at least one dot. */
+const SMTP_ACCOUNT_DOMAIN_PATTERN = /^[a-z0-9]([a-z0-9-]*[a-z0-9])?(\.[a-z0-9]([a-z0-9-]*[a-z0-9])?)+$/;
+/** Address pattern: optional '*' glob in the local part only, literal domain. */
+const SMTP_ACCOUNT_ADDRESS_LOCAL_PATTERN = /^[a-z0-9*][a-z0-9.*_+-]*$/;
+/**
+ * SmtpAccountManager — operator-managed authenticated SMTP submission
+ * accounts, backed by SmtpAccountDoc rows holding hashed SCRAM verifiers only.
+ *
+ * Single composition owner of the email runtime `auth` block and route list:
+ * every runtime application of auth/routes goes through composeEmailConfig /
+ * applyToRuntime here. WorkAppMailManager identities feed in as an explicit
+ * contribution; nothing else writes `auth` wholesale.
+ *
+ * Accounts are served from an in-memory map loaded at start() — the SMTP auth
+ * path (smartmta's Rust bridge, 5s callback timeout) never touches the DB.
+ */
+export class SmtpAccountManager {
+    dcRouterRef;
+    accounts = new Map();
+    started = false;
+    mutationChain = Promise.resolve();
+    /** Explicit upstream capability marker; absence is deliberately fail-closed. */
+    get authAccountsCapability() {
+        return plugins.smartmta.smartMtaCapabilities?.smtpAuthAccountsAndScopes === true;
+    }
+    constructor(dcRouterRef) {
+        this.dcRouterRef = dcRouterRef;
+    }
+    async start() {
+        const docs = await SmtpAccountDoc.findAll();
+        this.accounts = new Map(docs.map((doc) => [doc.id, doc]));
+        this.started = true;
+        if (this.accounts.size > 0) {
+            logger.log('info', `SmtpAccountManager loaded ${this.accounts.size} SMTP account(s)`);
+        }
+    }
+    async stop() {
+        this.accounts.clear();
+        this.started = false;
+    }
+    isStarted() {
+        return this.started;
+    }
+    getAccountCount() {
+        return this.accounts.size;
+    }
+    // ==========================================================================
+    // Composition — the single owner of auth + route-list assembly
+    // ==========================================================================
+    /**
+     * Compose the runtime email config: operator-configured routes/users plus
+     * the workapp identity contribution plus DB-backed SMTP accounts and their
+     * generated relay routes. Idempotent — previously generated entries are
+     * stripped by their reserved name prefixes before re-adding.
+     */
+    async composeEmailConfig(emailConfig, workappContribution) {
+        const contribution = workappContribution
+            ?? await this.dcRouterRef.workAppMailManager.getStoredIdentityContribution(emailConfig);
+        if (!this.authAccountsCapability) {
+            // Fail closed: without the smartmta capability the accounts field would
+            // be silently ignored (or rejected), so never pretend they are active —
+            // any pre-existing accounts entry is dropped from the composed auth too.
+            if (this.accounts.size > 0) {
+                logger.log('error', `SmartMTA is missing the smtpAuthAccountsAndScopes capability — ${this.accounts.size} stored SMTP account(s) are NOT active`);
+            }
+            const authWithoutAccounts = { ...(emailConfig.auth || {}) };
+            delete authWithoutAccounts.accounts;
+            return {
+                ...emailConfig,
+                routes: [
+                    ...(emailConfig.routes || [])
+                        .filter((route) => !isWorkAppManagedMailRouteName(route.name) && !isSmtpAccountRouteName(route.name)),
+                    ...contribution.routes,
+                ],
+                auth: {
+                    ...authWithoutAccounts,
+                    users: [
+                        ...(emailConfig.auth?.users || []).filter((user) => !isWorkAppManagedSmtpUsername(user.username)),
+                        ...contribution.users,
+                    ],
+                },
+            };
+        }
+        const accountDocs = [...this.accounts.values()]
+            .sort((a, b) => a.username.localeCompare(b.username));
+        const smtpAccounts = [];
+        const accountRoutes = [];
+        for (const doc of accountDocs) {
+            const account = this.buildAuthAccount(doc);
+            try {
+                // smartmta's own validator — construction and updateOptions throw on
+                // invalid accounts, so a bad DB row must never reach the push.
+                // Validated per account so one row cannot take the whole auth block
+                // down.
+                assertValidAuthAccounts([account]);
+            }
+            catch (error) {
+                const message = error.message;
+                logger.log('error', `SMTP account ${doc.username} excluded from runtime auth (invalid stored configuration): ${message}`);
+                this.recordAccountConflictEvent(doc.username, message);
+                continue;
+            }
+            smtpAccounts.push(account);
+            if (doc.enabled) {
+                accountRoutes.push(...this.buildAccountRoutes(doc));
+            }
+        }
+        const configuredRoutes = (emailConfig.routes || [])
+            .filter((route) => !isWorkAppManagedMailRouteName(route.name) && !isSmtpAccountRouteName(route.name));
+        const configuredUsers = (emailConfig.auth?.users || [])
+            .filter((user) => !isWorkAppManagedSmtpUsername(user.username));
+        return {
+            ...emailConfig,
+            routes: [...configuredRoutes, ...contribution.routes, ...accountRoutes],
+            auth: {
+                ...(emailConfig.auth || {}),
+                users: [...configuredUsers, ...contribution.users],
+                accounts: smtpAccounts,
+            },
+        };
+    }
+    /**
+     * Recompose from the live runtime options and push the result: replace the
+     * whole `auth` block (smartmta toggles listener AUTH live) and re-apply the
+     * route list.
+     */
+    async applyToRuntime(workappContribution) {
+        const emailConfig = this.dcRouterRef.options.emailConfig;
+        if (!emailConfig)
+            return;
+        const nextConfig = await this.composeEmailConfig(emailConfig, workappContribution);
+        this.dcRouterRef.options.emailConfig = nextConfig;
+        if (this.dcRouterRef.emailServer) {
+            this.dcRouterRef.emailServer.updateOptions({ auth: nextConfig.auth });
+            await this.dcRouterRef.updateEmailRoutes(nextConfig.routes);
+        }
+    }
+    buildAuthAccount(doc) {
+        const senders = [
+            ...(doc.senderScope?.addresses || []),
+            ...(doc.senderScope?.domains || []).map((domain) => `*@${domain}`),
+        ];
+        const recipientsRestricted = doc.recipientScope?.mode === 'restricted';
+        const recipientPatterns = [
+            ...(doc.recipientScope?.addresses || []),
+            ...(doc.recipientScope?.domains || []).map((domain) => `*@${domain}`),
+        ];
+        let scope;
+        if (senders.length > 0 || recipientsRestricted) {
+            scope = {
+                // Unrestricted senders with restricted recipients still needs a scope
+                // block; '*' matches every sender including the null sender.
+                senders: senders.length > 0 ? senders : ['*'],
+                ...(recipientsRestricted
+                    ? { recipients: { mode: 'patterns', patterns: recipientPatterns } }
+                    : {}),
+            };
+        }
+        return {
+            username: doc.username,
+            enabled: doc.enabled,
+            credential: { verifier: doc.credentialVerifier },
+            ...(scope ? { scope } : {}),
+        };
+    }
+    /**
+     * One generated relay route per (account × sender-scope domain), name
+     * `smtp-account-<id>-<domainHash>`, priority 850 — below workapp
+     * per-address routes (900), above operator-configured DB routes.
+     *
+     * Accounts without a sender scope generate no routes: their relay
+     * permission stays exactly whatever operator-configured routes grant
+     * (this is what keeps the legacy-user migration from widening relay).
+     *
+     * DKIM policy rides on `process.dkim` only — smartmta ≥9.1 resolves the
+     * active selector per sender domain from its domain registry, so no
+     * selector is snapshotted into routes and rotation stays owned by
+     * EmailDomainManager/mail-dns-sync.
+     */
+    buildAccountRoutes(doc) {
+        const senderDomains = this.collectSenderDomainPatterns(doc.senderScope);
+        const routes = [];
+        for (const [domain, patterns] of senderDomains) {
+            routes.push({
+                name: `smtp-account-${doc.id}-${this.hashDomain(domain)}`,
+                priority: 850,
+                match: {
+                    authenticated: true,
+                    authenticatedUser: doc.username,
+                    senders: patterns,
+                },
+                action: {
+                    type: 'process',
+                    allowRelay: true,
+                    process: {
+                        dkim: Boolean(doc.mailPolicy?.dkimSign),
+                        queue: doc.mailPolicy?.queue ?? 'normal',
+                    },
+                },
+            });
+        }
+        return routes;
+    }
+    /** Map of sender-scope domain -> the scope patterns belonging to it. */
+    collectSenderDomainPatterns(senderScope) {
+        const byDomain = new Map();
+        for (const domain of senderScope?.domains || []) {
+            const key = domain.toLowerCase();
+            byDomain.set(key, [...(byDomain.get(key) || []), `*@${key}`]);
+        }
+        for (const address of senderScope?.addresses || []) {
+            const domainPart = address.split('@')[1]?.toLowerCase();
+            if (!domainPart)
+                continue;
+            byDomain.set(domainPart, [...(byDomain.get(domainPart) || []), address.toLowerCase()]);
+        }
+        return byDomain;
+    }
+    hashDomain(domain) {
+        return plugins.crypto.createHash('sha256').update(domain.toLowerCase()).digest('hex').slice(0, 8);
+    }
+    recordAccountConflictEvent(username, message) {
+        const opsEventManager = this.dcRouterRef.opsEventManager;
+        if (!opsEventManager)
+            return;
+        opsEventManager.recordEvent({
+            severity: 'error',
+            category: 'smtp-accounts',
+            title: 'SMTP account excluded from runtime authentication',
+            detail: `Stored SMTP account '${username}' failed validation and was excluded from the composed auth block: ${message}`,
+            context: { recordName: username },
+        }).catch((error) => {
+            logger.log('warn', `Failed to record SMTP account conflict event for ${username}: ${error.message}`);
+        });
+    }
+    // ==========================================================================
+    // CRUD
+    // ==========================================================================
+    async listAccounts() {
+        const docs = [...this.accounts.values()]
+            .sort((a, b) => a.username.localeCompare(b.username));
+        const accounts = [];
+        for (const doc of docs) {
+            accounts.push(await this.decorateWithDomainReadiness(doc));
+        }
+        return accounts;
+    }
+    async createAccount(options) {
+        return await this.runMutationExclusive(async () => {
+            if (!this.authAccountsCapability) {
+                throw new Error('SmartMTA runtime does not support SMTP auth accounts (smtpAuthAccountsAndScopes capability missing)');
+            }
+            const username = this.normalizeUsername(options.username);
+            const senderScope = this.normalizeSenderScope(options.senderScope);
+            const recipientScope = this.normalizeRecipientScope(options.recipientScope);
+            const mailPolicy = this.normalizeMailPolicy(options.mailPolicy);
+            await this.assertDkimPolicyAllowed(mailPolicy, senderScope, username);
+            if ([...this.accounts.values()].some((doc) => doc.username === username)
+                || await SmtpAccountDoc.findByUsername(username)) {
+                throw new Error(`SMTP account username is already taken: ${username}`);
+            }
+            const password = generateSmtpAccountPassword();
+            const now = Date.now();
+            const doc = new SmtpAccountDoc();
+            doc.id = `smtpacct_${now.toString(36)}_${plugins.crypto.randomBytes(6).toString('hex')}`;
+            doc.username = username;
+            doc.description = (options.description || '').trim();
+            doc.enabled = true;
+            doc.credentialVerifier = deriveSmtpScramVerifier(password);
+            doc.senderScope = senderScope;
+            doc.recipientScope = recipientScope;
+            doc.mailPolicy = mailPolicy;
+            doc.createdAt = now;
+            doc.updatedAt = now;
+            doc.createdBy = options.createdBy;
+            await doc.save();
+            this.accounts.set(doc.id, doc);
+            await this.applyToRuntime();
+            const warnings = await this.collectSenderDomainWarnings(senderScope);
+            logger.log('info', `SMTP account '${username}' created by ${options.createdBy} (id: ${doc.id})`);
+            return { account: await this.decorateWithDomainReadiness(doc), password, warnings };
+        });
+    }
+    async updateAccount(id, updates, updatedBy) {
+        return await this.runMutationExclusive(async () => {
+            const doc = this.requireAccount(id);
+            const senderScope = updates.senderScope !== undefined
+                ? this.normalizeSenderScope(updates.senderScope)
+                : doc.senderScope;
+            const recipientScope = updates.recipientScope !== undefined
+                ? this.normalizeRecipientScope(updates.recipientScope)
+                : doc.recipientScope;
+            const mailPolicy = updates.mailPolicy !== undefined
+                ? this.normalizeMailPolicy(updates.mailPolicy)
+                : doc.mailPolicy;
+            await this.assertDkimPolicyAllowed(mailPolicy, senderScope, doc.username);
+            if (updates.description !== undefined) {
+                doc.description = updates.description.trim();
+            }
+            doc.senderScope = senderScope;
+            doc.recipientScope = recipientScope;
+            doc.mailPolicy = mailPolicy;
+            doc.updatedAt = Date.now();
+            await doc.save();
+            this.accounts.set(doc.id, doc);
+            await this.applyToRuntime();
+            const warnings = await this.collectSenderDomainWarnings(senderScope);
+            logger.log('info', `SMTP account '${doc.username}' updated by ${updatedBy}`);
+            return { account: await this.decorateWithDomainReadiness(doc), warnings };
+        });
+    }
+    async toggleAccount(id, enabled, updatedBy) {
+        return await this.runMutationExclusive(async () => {
+            const doc = this.requireAccount(id);
+            doc.enabled = enabled;
+            doc.updatedAt = Date.now();
+            await doc.save();
+            this.accounts.set(doc.id, doc);
+            await this.applyToRuntime();
+            logger.log('info', `SMTP account '${doc.username}' ${enabled ? 'enabled' : 'disabled'} by ${updatedBy}`);
+            return { account: await this.decorateWithDomainReadiness(doc), warnings: [] };
+        });
+    }
+    async rotatePassword(id, rotatedBy) {
+        return await this.runMutationExclusive(async () => {
+            const doc = this.requireAccount(id);
+            const password = generateSmtpAccountPassword();
+            doc.credentialVerifier = deriveSmtpScramVerifier(password);
+            doc.lastRotatedAt = Date.now();
+            doc.updatedAt = doc.lastRotatedAt;
+            await doc.save();
+            this.accounts.set(doc.id, doc);
+            await this.applyToRuntime();
+            logger.log('info', `SMTP account '${doc.username}' password rotated by ${rotatedBy}`);
+            return { account: await this.decorateWithDomainReadiness(doc), password, warnings: [] };
+        });
+    }
+    async deleteAccount(id, deletedBy) {
+        return await this.runMutationExclusive(async () => {
+            const doc = this.requireAccount(id);
+            await doc.delete();
+            this.accounts.delete(id);
+            await this.applyToRuntime();
+            logger.log('info', `SMTP account '${doc.username}' deleted by ${deletedBy}`);
+        });
+    }
+    // ==========================================================================
+    // Validation / normalization
+    // ==========================================================================
+    requireAccount(id) {
+        const doc = this.accounts.get(id);
+        if (!doc) {
+            throw new Error(`SMTP account not found: ${id}`);
+        }
+        return doc;
+    }
+    normalizeUsername(usernameArg) {
+        const username = (usernameArg || '').trim().toLowerCase();
+        if (!SMTP_ACCOUNT_USERNAME_PATTERN.test(username)) {
+            throw new Error('SMTP account username must be 3-64 characters of a-z, 0-9, dot, underscore, or dash, starting alphanumeric');
+        }
+        if (isWorkAppManagedSmtpUsername(username)) {
+            throw new Error(`SMTP account usernames may not use the reserved 'workapp-' prefix: ${username}`);
+        }
+        return username;
+    }
+    normalizeDomain(domainArg, context) {
+        const domain = (domainArg || '').trim().toLowerCase();
+        if (!SMTP_ACCOUNT_DOMAIN_PATTERN.test(domain)) {
+            throw new Error(`Invalid ${context} domain (wildcards are not allowed in domains): ${domainArg}`);
+        }
+        return domain;
+    }
+    normalizeAddressPattern(addressArg, context) {
+        const address = (addressArg || '').trim().toLowerCase();
+        const parts = address.split('@');
+        if (parts.length !== 2
+            || !SMTP_ACCOUNT_ADDRESS_LOCAL_PATTERN.test(parts[0])
+            || !SMTP_ACCOUNT_DOMAIN_PATTERN.test(parts[1])) {
+            throw new Error(`Invalid ${context} address pattern ('local@domain', '*' allowed in the local part only): ${addressArg}`);
+        }
+        return address;
+    }
+    normalizeSenderScope(scopeArg) {
+        return {
+            addresses: this.dedupe((scopeArg?.addresses || []).map((address) => this.normalizeAddressPattern(address, 'sender scope'))),
+            domains: this.dedupe((scopeArg?.domains || []).map((domain) => this.normalizeDomain(domain, 'sender scope'))),
+        };
+    }
+    normalizeRecipientScope(scopeArg) {
+        const mode = scopeArg?.mode === 'restricted' ? 'restricted' : 'any';
+        const addresses = this.dedupe((scopeArg?.addresses || []).map((address) => this.normalizeAddressPattern(address, 'recipient scope')));
+        const domains = this.dedupe((scopeArg?.domains || []).map((domain) => this.normalizeDomain(domain, 'recipient scope')));
+        if (mode === 'restricted' && addresses.length === 0 && domains.length === 0) {
+            throw new Error('A restricted recipient scope requires at least one address or domain (an empty list would silently deny all mail)');
+        }
+        return { mode, addresses, domains };
+    }
+    normalizeMailPolicy(policyArg) {
+        const queue = policyArg?.queue;
+        if (queue !== undefined && !['normal', 'priority', 'bulk'].includes(queue)) {
+            throw new Error(`Invalid mail policy queue: ${queue}`);
+        }
+        return {
+            dkimSign: Boolean(policyArg?.dkimSign),
+            ...(queue ? { queue } : {}),
+        };
+    }
+    /**
+     * DKIM signing fails at configuration time, never at delivery time: it is
+     * only allowed when every sender-scope domain is a managed email domain
+     * that is outbound-ready with active DKIM material.
+     */
+    async assertDkimPolicyAllowed(mailPolicy, senderScope, username) {
+        if (!mailPolicy.dkimSign)
+            return;
+        const senderDomains = [...this.collectSenderDomainPatterns(senderScope).keys()];
+        if (senderDomains.length === 0) {
+            throw new Error(`DKIM signing for SMTP account '${username}' requires an explicit sender scope naming the domain(s) to sign for`);
+        }
+        const emailDomainManager = this.dcRouterRef.emailDomainManager;
+        if (!emailDomainManager) {
+            throw new Error('DKIM signing requires the email domain manager, which is not available');
+        }
+        for (const domain of senderDomains) {
+            if (!await emailDomainManager.getByDomain(domain)) {
+                throw new Error(`DKIM signing requires managed email domains; '${domain}' is not managed by dcrouter`);
+            }
+            const readiness = await emailDomainManager.getOutboundReadiness(domain);
+            if (!readiness.ready || !readiness.selector) {
+                throw new Error(`DKIM signing requires outbound-ready DKIM material for '${domain}': ${readiness.reason || 'no active DKIM selector'}`);
+            }
+        }
+    }
+    /** Warn-and-allow: sender domains outside managed email domains are permitted but flagged. */
+    async collectSenderDomainWarnings(senderScope) {
+        const warnings = [];
+        const emailDomainManager = this.dcRouterRef.emailDomainManager;
+        if (!emailDomainManager)
+            return warnings;
+        for (const domain of this.collectSenderDomainPatterns(senderScope).keys()) {
+            try {
+                if (!await emailDomainManager.getByDomain(domain)) {
+                    warnings.push(`Sender domain '${domain}' is not a managed email domain — outbound DNS alignment (SPF/DKIM/DMARC) is not managed by dcrouter`);
+                }
+            }
+            catch (error) {
+                warnings.push(`Could not verify sender domain '${domain}': ${error.message}`);
+            }
+        }
+        return warnings;
+    }
+    async decorateWithDomainReadiness(doc) {
+        const info = doc.toApiObject();
+        const emailDomainManager = this.dcRouterRef.emailDomainManager;
+        const senderDomains = [...this.collectSenderDomainPatterns(doc.senderScope).keys()];
+        if (!emailDomainManager || senderDomains.length === 0)
+            return info;
+        const domainReadiness = [];
+        for (const domain of senderDomains) {
+            try {
+                if (!await emailDomainManager.getByDomain(domain)) {
+                    domainReadiness.push({
+                        domain,
+                        ready: !doc.mailPolicy?.dkimSign,
+                        reason: 'not a managed email domain',
+                    });
+                    continue;
+                }
+                const readiness = await emailDomainManager.getOutboundReadiness(domain);
+                domainReadiness.push({
+                    domain,
+                    ready: readiness.ready,
+                    ...(readiness.reason ? { reason: readiness.reason } : {}),
+                });
+            }
+            catch (error) {
+                domainReadiness.push({
+                    domain,
+                    ready: false,
+                    reason: `readiness check failed: ${error.message}`,
+                });
+            }
+        }
+        return { ...info, domainReadiness };
+    }
+    dedupe(values) {
+        return [...new Set(values)];
+    }
+    async runMutationExclusive(action) {
+        const run = this.mutationChain.then(action, action);
+        this.mutationChain = run.catch(() => undefined);
+        return await run;
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5zbXRwLWFjY291bnQubWFuYWdlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL2VtYWlsL2NsYXNzZXMuc210cC1hY2NvdW50Lm1hbmFnZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBS0EsT0FBTyxFQUFFLHVCQUF1QixFQUFFLE1BQU0sc0JBQXNCLENBQUM7QUFDL0QsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN0QyxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFTaEQsT0FBTyxFQUNMLDZCQUE2QixFQUM3Qiw0QkFBNEIsR0FFN0IsTUFBTSxtQ0FBbUMsQ0FBQztBQUMzQyxPQUFPLEVBQUUsdUJBQXVCLEVBQUUsMkJBQTJCLEVBQUUsTUFBTSxpQkFBaUIsQ0FBQztBQUV2Rix5RUFBeUU7QUFDekUsTUFBTSxVQUFVLHNCQUFzQixDQUFDLFNBQWlCO0lBQ3RELE9BQU8sU0FBUyxDQUFDLFVBQVUsQ0FBQyxlQUFlLENBQUMsQ0FBQztBQUMvQyxDQUFDO0FBRUQsTUFBTSw2QkFBNkIsR0FBRyw2QkFBNkIsQ0FBQztBQUNwRSxtRUFBbUU7QUFDbkUsTUFBTSwyQkFBMkIsR0FBRyxtRUFBbUUsQ0FBQztBQUN4RyxpRkFBaUY7QUFDakYsTUFBTSxrQ0FBa0MsR0FBRywyQkFBMkIsQ0FBQztBQTRCdkU7Ozs7Ozs7Ozs7O0dBV0c7QUFDSCxNQUFNLE9BQU8sa0JBQWtCO0lBVVQ7SUFUWixRQUFRLEdBQUcsSUFBSSxHQUFHLEVBQTBCLENBQUM7SUFDN0MsT0FBTyxHQUFHLEtBQUssQ0FBQztJQUNoQixhQUFhLEdBQXFCLE9BQU8sQ0FBQyxPQUFPLEVBQUUsQ0FBQztJQUU1RCxnRkFBZ0Y7SUFDaEYsSUFBWSxzQkFBc0I7UUFDaEMsT0FBUSxPQUFPLENBQUMsUUFBZ0IsQ0FBQyxvQkFBb0IsRUFBRSx5QkFBeUIsS0FBSyxJQUFJLENBQUM7SUFDNUYsQ0FBQztJQUVELFlBQW9CLFdBQXFCO1FBQXJCLGdCQUFXLEdBQVgsV0FBVyxDQUFVO0lBQUcsQ0FBQztJQUV0QyxLQUFLLENBQUMsS0FBSztRQUNoQixNQUFNLElBQUksR0FBRyxNQUFNLGNBQWMsQ0FBQyxPQUFPLEVBQUUsQ0FBQztRQUM1QyxJQUFJLENBQUMsUUFBUSxHQUFHLElBQUksR0FBRyxDQUFDLElBQUksQ0FBQyxHQUFHLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUM7UUFDMUQsSUFBSSxDQUFDLE9BQU8sR0FBRyxJQUFJLENBQUM7UUFDcEIsSUFBSSxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksR0FBRyxDQUFDLEVBQUUsQ0FBQztZQUMzQixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSw2QkFBNkIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLGtCQUFrQixDQUFDLENBQUM7UUFDeEYsQ0FBQztJQUNILENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSTtRQUNmLElBQUksQ0FBQyxRQUFRLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDdEIsSUFBSSxDQUFDLE9BQU8sR0FBRyxLQUFLLENBQUM7SUFDdkIsQ0FBQztJQUVNLFNBQVM7UUFDZCxPQUFPLElBQUksQ0FBQyxPQUFPLENBQUM7SUFDdEIsQ0FBQztJQUVNLGVBQWU7UUFDcEIsT0FBTyxJQUFJLENBQUMsUUFBUSxDQUFDLElBQUksQ0FBQztJQUM1QixDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLCtEQUErRDtJQUMvRCw2RUFBNkU7SUFFN0U7Ozs7O09BS0c7SUFDSSxLQUFLLENBQUMsa0JBQWtCLENBQzdCLFdBQW9CLEVBQ3BCLG1CQUFxRDtRQUVyRCxNQUFNLFlBQVksR0FBRyxtQkFBbUI7ZUFDbkMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDLDZCQUE2QixDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBRTFGLElBQUksQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztZQUNqQyx3RUFBd0U7WUFDeEUsd0VBQXdFO1lBQ3hFLHlFQUF5RTtZQUN6RSxJQUFJLElBQUksQ0FBQyxRQUFRLENBQUMsSUFBSSxHQUFHLENBQUMsRUFBRSxDQUFDO2dCQUMzQixNQUFNLENBQUMsR0FBRyxDQUFDLE9BQU8sRUFBRSxrRUFBa0UsSUFBSSxDQUFDLFFBQVEsQ0FBQyxJQUFJLHdDQUF3QyxDQUFDLENBQUM7WUFDcEosQ0FBQztZQUNELE1BQU0sbUJBQW1CLEdBQUcsRUFBRSxHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUMsRUFBcUQsQ0FBQztZQUMvRyxPQUFPLG1CQUFtQixDQUFDLFFBQVEsQ0FBQztZQUNwQyxPQUFPO2dCQUNMLEdBQUcsV0FBVztnQkFDZCxNQUFNLEVBQUU7b0JBQ04sR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDO3lCQUMxQixNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLENBQUMsNkJBQTZCLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxJQUFJLENBQUMsc0JBQXNCLENBQUMsS0FBSyxDQUFDLElBQUksQ0FBQyxDQUFDO29CQUN2RyxHQUFHLFlBQVksQ0FBQyxNQUFNO2lCQUN2QjtnQkFDRCxJQUFJLEVBQUU7b0JBQ0osR0FBRyxtQkFBbUI7b0JBQ3RCLEtBQUssRUFBRTt3QkFDTCxHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDLENBQUMsTUFBTSxDQUFDLENBQUMsSUFBSSxFQUFFLEVBQUUsQ0FBQyxDQUFDLDRCQUE0QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsQ0FBQzt3QkFDakcsR0FBRyxZQUFZLENBQUMsS0FBSztxQkFDdEI7aUJBQ0Y7YUFDRixDQUFDO1FBQ0osQ0FBQztRQUVELE1BQU0sV0FBVyxHQUFHLENBQUMsR0FBRyxJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sRUFBRSxDQUFDO2FBQzVDLElBQUksQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDLEVBQUUsRUFBRSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsYUFBYSxDQUFDLENBQUMsQ0FBQyxRQUFRLENBQUMsQ0FBQyxDQUFDO1FBQ3hELE1BQU0sWUFBWSxHQUF1QixFQUFFLENBQUM7UUFDNUMsTUFBTSxhQUFhLEdBQWtCLEVBQUUsQ0FBQztRQUN4QyxLQUFLLE1BQU0sR0FBRyxJQUFJLFdBQVcsRUFBRSxDQUFDO1lBQzlCLE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxHQUFHLENBQUMsQ0FBQztZQUMzQyxJQUFJLENBQUM7Z0JBQ0gscUVBQXFFO2dCQUNyRSwrREFBK0Q7Z0JBQy9ELG9FQUFvRTtnQkFDcEUsUUFBUTtnQkFDUix1QkFBdUIsQ0FBQyxDQUFDLE9BQU8sQ0FBQyxDQUFDLENBQUM7WUFDckMsQ0FBQztZQUFDLE9BQU8sS0FBYyxFQUFFLENBQUM7Z0JBQ3hCLE1BQU0sT0FBTyxHQUFJLEtBQWUsQ0FBQyxPQUFPLENBQUM7Z0JBQ3pDLE1BQU0sQ0FBQyxHQUFHLENBQUMsT0FBTyxFQUFFLGdCQUFnQixHQUFHLENBQUMsUUFBUSwrREFBK0QsT0FBTyxFQUFFLENBQUMsQ0FBQztnQkFDMUgsSUFBSSxDQUFDLDBCQUEwQixDQUFDLEdBQUcsQ0FBQyxRQUFRLEVBQUUsT0FBTyxDQUFDLENBQUM7Z0JBQ3ZELFNBQVM7WUFDWCxDQUFDO1lBQ0QsWUFBWSxDQUFDLElBQUksQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUMzQixJQUFJLEdBQUcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDaEIsYUFBYSxDQUFDLElBQUksQ0FBQyxHQUFHLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1lBQ3RELENBQUM7UUFDSCxDQUFDO1FBRUQsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFdBQVcsQ0FBQyxNQUFNLElBQUksRUFBRSxDQUFDO2FBQ2hELE1BQU0sQ0FBQyxDQUFDLEtBQUssRUFBRSxFQUFFLENBQUMsQ0FBQyw2QkFBNkIsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxzQkFBc0IsQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLENBQUMsQ0FBQztRQUN4RyxNQUFNLGVBQWUsR0FBRyxDQUFDLFdBQVcsQ0FBQyxJQUFJLEVBQUUsS0FBSyxJQUFJLEVBQUUsQ0FBQzthQUNwRCxNQUFNLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLENBQUMsNEJBQTRCLENBQUMsSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLENBQUM7UUFFbEUsT0FBTztZQUNMLEdBQUcsV0FBVztZQUNkLE1BQU0sRUFBRSxDQUFDLEdBQUcsZ0JBQWdCLEVBQUUsR0FBRyxZQUFZLENBQUMsTUFBTSxFQUFFLEdBQUcsYUFBYSxDQUFDO1lBQ3ZFLElBQUksRUFBRTtnQkFDSixHQUFHLENBQUMsV0FBVyxDQUFDLElBQUksSUFBSSxFQUFFLENBQUM7Z0JBQzNCLEtBQUssRUFBRSxDQUFDLEdBQUcsZUFBZSxFQUFFLEdBQUcsWUFBWSxDQUFDLEtBQUssQ0FBQztnQkFDbEQsUUFBUSxFQUFFLFlBQVk7YUFDdkI7U0FDRixDQUFDO0lBQ0osQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsY0FBYyxDQUFDLG1CQUFxRDtRQUMvRSxNQUFNLFdBQVcsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxXQUFxRCxDQUFDO1FBQ25HLElBQUksQ0FBQyxXQUFXO1lBQUUsT0FBTztRQUV6QixNQUFNLFVBQVUsR0FBRyxNQUFNLElBQUksQ0FBQyxrQkFBa0IsQ0FBQyxXQUFXLEVBQUUsbUJBQW1CLENBQUMsQ0FBQztRQUNuRixJQUFJLENBQUMsV0FBVyxDQUFDLE9BQU8sQ0FBQyxXQUFXLEdBQUcsVUFBVSxDQUFDO1FBQ2xELElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxXQUFXLEVBQUUsQ0FBQztZQUNqQyxJQUFJLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsRUFBRSxJQUFJLEVBQUUsVUFBVSxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7WUFDdEUsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGlCQUFpQixDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsQ0FBQztRQUM5RCxDQUFDO0lBQ0gsQ0FBQztJQUVPLGdCQUFnQixDQUFDLEdBQW1CO1FBQzFDLE1BQU0sT0FBTyxHQUFHO1lBQ2QsR0FBRyxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsU0FBUyxJQUFJLEVBQUUsQ0FBQztZQUNyQyxHQUFHLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxPQUFPLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxLQUFLLE1BQU0sRUFBRSxDQUFDO1NBQ25FLENBQUM7UUFDRixNQUFNLG9CQUFvQixHQUFHLEdBQUcsQ0FBQyxjQUFjLEVBQUUsSUFBSSxLQUFLLFlBQVksQ0FBQztRQUN2RSxNQUFNLGlCQUFpQixHQUFHO1lBQ3hCLEdBQUcsQ0FBQyxHQUFHLENBQUMsY0FBYyxFQUFFLFNBQVMsSUFBSSxFQUFFLENBQUM7WUFDeEMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxjQUFjLEVBQUUsT0FBTyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE1BQU0sRUFBRSxFQUFFLENBQUMsS0FBSyxNQUFNLEVBQUUsQ0FBQztTQUN0RSxDQUFDO1FBRUYsSUFBSSxLQUFnQyxDQUFDO1FBQ3JDLElBQUksT0FBTyxDQUFDLE1BQU0sR0FBRyxDQUFDLElBQUksb0JBQW9CLEVBQUUsQ0FBQztZQUMvQyxLQUFLLEdBQUc7Z0JBQ04sc0VBQXNFO2dCQUN0RSw2REFBNkQ7Z0JBQzdELE9BQU8sRUFBRSxPQUFPLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsT0FBTyxDQUFDLENBQUMsQ0FBQyxDQUFDLEdBQUcsQ0FBQztnQkFDN0MsR0FBRyxDQUFDLG9CQUFvQjtvQkFDdEIsQ0FBQyxDQUFDLEVBQUUsVUFBVSxFQUFFLEVBQUUsSUFBSSxFQUFFLFVBQW1CLEVBQUUsUUFBUSxFQUFFLGlCQUFpQixFQUFFLEVBQUU7b0JBQzVFLENBQUMsQ0FBQyxFQUFFLENBQUM7YUFDUixDQUFDO1FBQ0osQ0FBQztRQUVELE9BQU87WUFDTCxRQUFRLEVBQUUsR0FBRyxDQUFDLFFBQVE7WUFDdEIsT0FBTyxFQUFFLEdBQUcsQ0FBQyxPQUFPO1lBQ3BCLFVBQVUsRUFBRSxFQUFFLFFBQVEsRUFBRSxHQUFHLENBQUMsa0JBQWtCLEVBQUU7WUFDaEQsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVCLENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7Ozs7Ozs7Ozs7T0FhRztJQUNLLGtCQUFrQixDQUFDLEdBQW1CO1FBQzVDLE1BQU0sYUFBYSxHQUFHLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxHQUFHLENBQUMsV0FBVyxDQUFDLENBQUM7UUFDeEUsTUFBTSxNQUFNLEdBQWtCLEVBQUUsQ0FBQztRQUNqQyxLQUFLLE1BQU0sQ0FBQyxNQUFNLEVBQUUsUUFBUSxDQUFDLElBQUksYUFBYSxFQUFFLENBQUM7WUFDL0MsTUFBTSxDQUFDLElBQUksQ0FBQztnQkFDVixJQUFJLEVBQUUsZ0JBQWdCLEdBQUcsQ0FBQyxFQUFFLElBQUksSUFBSSxDQUFDLFVBQVUsQ0FBQyxNQUFNLENBQUMsRUFBRTtnQkFDekQsUUFBUSxFQUFFLEdBQUc7Z0JBQ2IsS0FBSyxFQUFFO29CQUNMLGFBQWEsRUFBRSxJQUFJO29CQUNuQixpQkFBaUIsRUFBRSxHQUFHLENBQUMsUUFBUTtvQkFDL0IsT0FBTyxFQUFFLFFBQVE7aUJBQ2xCO2dCQUNELE1BQU0sRUFBRTtvQkFDTixJQUFJLEVBQUUsU0FBUztvQkFDZixVQUFVLEVBQUUsSUFBSTtvQkFDaEIsT0FBTyxFQUFFO3dCQUNQLElBQUksRUFBRSxPQUFPLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxRQUFRLENBQUM7d0JBQ3ZDLEtBQUssRUFBRSxHQUFHLENBQUMsVUFBVSxFQUFFLEtBQUssSUFBSSxRQUFRO3FCQUN6QztpQkFDRjthQUNGLENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxPQUFPLE1BQU0sQ0FBQztJQUNoQixDQUFDO0lBRUQsd0VBQXdFO0lBQ2hFLDJCQUEyQixDQUFDLFdBQWdEO1FBQ2xGLE1BQU0sUUFBUSxHQUFHLElBQUksR0FBRyxFQUFvQixDQUFDO1FBQzdDLEtBQUssTUFBTSxNQUFNLElBQUksV0FBVyxFQUFFLE9BQU8sSUFBSSxFQUFFLEVBQUUsQ0FBQztZQUNoRCxNQUFNLEdBQUcsR0FBRyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUM7WUFDakMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLEVBQUUsQ0FBQyxHQUFHLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUMsRUFBRSxLQUFLLEdBQUcsRUFBRSxDQUFDLENBQUMsQ0FBQztRQUNoRSxDQUFDO1FBQ0QsS0FBSyxNQUFNLE9BQU8sSUFBSSxXQUFXLEVBQUUsU0FBUyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQ25ELE1BQU0sVUFBVSxHQUFHLE9BQU8sQ0FBQyxLQUFLLENBQUMsR0FBRyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUUsV0FBVyxFQUFFLENBQUM7WUFDeEQsSUFBSSxDQUFDLFVBQVU7Z0JBQUUsU0FBUztZQUMxQixRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsRUFBRSxDQUFDLEdBQUcsQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLFVBQVUsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxFQUFFLE9BQU8sQ0FBQyxXQUFXLEVBQUUsQ0FBQyxDQUFDLENBQUM7UUFDekYsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFTyxVQUFVLENBQUMsTUFBYztRQUMvQixPQUFPLE9BQU8sQ0FBQyxNQUFNLENBQUMsVUFBVSxDQUFDLFFBQVEsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxNQUFNLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsRUFBRSxDQUFDLENBQUMsQ0FBQztJQUNwRyxDQUFDO0lBRU8sMEJBQTBCLENBQUMsUUFBZ0IsRUFBRSxPQUFlO1FBQ2xFLE1BQU0sZUFBZSxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUFDO1FBQ3pELElBQUksQ0FBQyxlQUFlO1lBQUUsT0FBTztRQUM3QixlQUFlLENBQUMsV0FBVyxDQUFDO1lBQzFCLFFBQVEsRUFBRSxPQUFPO1lBQ2pCLFFBQVEsRUFBRSxlQUFlO1lBQ3pCLEtBQUssRUFBRSxtREFBbUQ7WUFDMUQsTUFBTSxFQUFFLHdCQUF3QixRQUFRLHNFQUFzRSxPQUFPLEVBQUU7WUFDdkgsT0FBTyxFQUFFLEVBQUUsVUFBVSxFQUFFLFFBQVEsRUFBRTtTQUNsQyxDQUFDLENBQUMsS0FBSyxDQUFDLENBQUMsS0FBYyxFQUFFLEVBQUU7WUFDMUIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsb0RBQW9ELFFBQVEsS0FBTSxLQUFlLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztRQUNsSCxDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFRCw2RUFBNkU7SUFDN0UsT0FBTztJQUNQLDZFQUE2RTtJQUV0RSxLQUFLLENBQUMsWUFBWTtRQUN2QixNQUFNLElBQUksR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQzthQUNyQyxJQUFJLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQyxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLGFBQWEsQ0FBQyxDQUFDLENBQUMsUUFBUSxDQUFDLENBQUMsQ0FBQztRQUN4RCxNQUFNLFFBQVEsR0FBdUIsRUFBRSxDQUFDO1FBQ3hDLEtBQUssTUFBTSxHQUFHLElBQUksSUFBSSxFQUFFLENBQUM7WUFDdkIsUUFBUSxDQUFDLElBQUksQ0FBQyxNQUFNLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxHQUFHLENBQUMsQ0FBQyxDQUFDO1FBQzdELENBQUM7UUFDRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRU0sS0FBSyxDQUFDLGFBQWEsQ0FBQyxPQUFrQztRQUMzRCxPQUFPLE1BQU0sSUFBSSxDQUFDLG9CQUFvQixDQUFDLEtBQUssSUFBSSxFQUFFO1lBQ2hELElBQUksQ0FBQyxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztnQkFDakMsTUFBTSxJQUFJLEtBQUssQ0FBQyxxR0FBcUcsQ0FBQyxDQUFDO1lBQ3pILENBQUM7WUFDRCxNQUFNLFFBQVEsR0FBRyxJQUFJLENBQUMsaUJBQWlCLENBQUMsT0FBTyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBQzFELE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDLENBQUM7WUFDbkUsTUFBTSxjQUFjLEdBQUcsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sQ0FBQyxjQUFjLENBQUMsQ0FBQztZQUM1RSxNQUFNLFVBQVUsR0FBRyxJQUFJLENBQUMsbUJBQW1CLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxDQUFDO1lBQ2hFLE1BQU0sSUFBSSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsUUFBUSxDQUFDLENBQUM7WUFFdEUsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLElBQUksQ0FBQyxDQUFDLEdBQUcsRUFBRSxFQUFFLENBQUMsR0FBRyxDQUFDLFFBQVEsS0FBSyxRQUFRLENBQUM7bUJBQ25FLE1BQU0sY0FBYyxDQUFDLGNBQWMsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO2dCQUNuRCxNQUFNLElBQUksS0FBSyxDQUFDLDJDQUEyQyxRQUFRLEVBQUUsQ0FBQyxDQUFDO1lBQ3pFLENBQUM7WUFFRCxNQUFNLFFBQVEsR0FBRywyQkFBMkIsRUFBRSxDQUFDO1lBQy9DLE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUN2QixNQUFNLEdBQUcsR0FBRyxJQUFJLGNBQWMsRUFBRSxDQUFDO1lBQ2pDLEdBQUcsQ0FBQyxFQUFFLEdBQUcsWUFBWSxHQUFHLENBQUMsUUFBUSxDQUFDLEVBQUUsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQ3pGLEdBQUcsQ0FBQyxRQUFRLEdBQUcsUUFBUSxDQUFDO1lBQ3hCLEdBQUcsQ0FBQyxXQUFXLEdBQUcsQ0FBQyxPQUFPLENBQUMsV0FBVyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ3JELEdBQUcsQ0FBQyxPQUFPLEdBQUcsSUFBSSxDQUFDO1lBQ25CLEdBQUcsQ0FBQyxrQkFBa0IsR0FBRyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUMzRCxHQUFHLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztZQUM5QixHQUFHLENBQUMsY0FBYyxHQUFHLGNBQWMsQ0FBQztZQUNwQyxHQUFHLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztZQUM1QixHQUFHLENBQUMsU0FBUyxHQUFHLEdBQUcsQ0FBQztZQUNwQixHQUFHLENBQUMsU0FBUyxHQUFHLEdBQUcsQ0FBQztZQUNwQixHQUFHLENBQUMsU0FBUyxHQUFHLE9BQU8sQ0FBQyxTQUFTLENBQUM7WUFDbEMsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDakIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQztZQUUvQixNQUFNLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUM1QixNQUFNLFFBQVEsR0FBRyxNQUFNLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUNyRSxNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsUUFBUSxnQkFBZ0IsT0FBTyxDQUFDLFNBQVMsU0FBUyxHQUFHLENBQUMsRUFBRSxHQUFHLENBQUMsQ0FBQztZQUNqRyxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDLDJCQUEyQixDQUFDLEdBQUcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxRQUFRLEVBQUUsQ0FBQztRQUN0RixDQUFDLENBQUMsQ0FBQztJQUNMLENBQUM7SUFFTSxLQUFLLENBQUMsYUFBYSxDQUN4QixFQUFVLEVBQ1YsT0FBa0MsRUFDbEMsU0FBaUI7UUFFakIsT0FBTyxNQUFNLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLElBQUksRUFBRTtZQUNoRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3BDLE1BQU0sV0FBVyxHQUFHLE9BQU8sQ0FBQyxXQUFXLEtBQUssU0FBUztnQkFDbkQsQ0FBQyxDQUFDLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO2dCQUNoRCxDQUFDLENBQUMsR0FBRyxDQUFDLFdBQVcsQ0FBQztZQUNwQixNQUFNLGNBQWMsR0FBRyxPQUFPLENBQUMsY0FBYyxLQUFLLFNBQVM7Z0JBQ3pELENBQUMsQ0FBQyxJQUFJLENBQUMsdUJBQXVCLENBQUMsT0FBTyxDQUFDLGNBQWMsQ0FBQztnQkFDdEQsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxjQUFjLENBQUM7WUFDdkIsTUFBTSxVQUFVLEdBQUcsT0FBTyxDQUFDLFVBQVUsS0FBSyxTQUFTO2dCQUNqRCxDQUFDLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUM7Z0JBQzlDLENBQUMsQ0FBQyxHQUFHLENBQUMsVUFBVSxDQUFDO1lBQ25CLE1BQU0sSUFBSSxDQUFDLHVCQUF1QixDQUFDLFVBQVUsRUFBRSxXQUFXLEVBQUUsR0FBRyxDQUFDLFFBQVEsQ0FBQyxDQUFDO1lBRTFFLElBQUksT0FBTyxDQUFDLFdBQVcsS0FBSyxTQUFTLEVBQUUsQ0FBQztnQkFDdEMsR0FBRyxDQUFDLFdBQVcsR0FBRyxPQUFPLENBQUMsV0FBVyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQy9DLENBQUM7WUFDRCxHQUFHLENBQUMsV0FBVyxHQUFHLFdBQVcsQ0FBQztZQUM5QixHQUFHLENBQUMsY0FBYyxHQUFHLGNBQWMsQ0FBQztZQUNwQyxHQUFHLENBQUMsVUFBVSxHQUFHLFVBQVUsQ0FBQztZQUM1QixHQUFHLENBQUMsU0FBUyxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMzQixNQUFNLEdBQUcsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNqQixJQUFJLENBQUMsUUFBUSxDQUFDLEdBQUcsQ0FBQyxHQUFHLENBQUMsRUFBRSxFQUFFLEdBQUcsQ0FBQyxDQUFDO1lBRS9CLE1BQU0sSUFBSSxDQUFDLGNBQWMsRUFBRSxDQUFDO1lBQzVCLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLDJCQUEyQixDQUFDLFdBQVcsQ0FBQyxDQUFDO1lBQ3JFLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLGlCQUFpQixHQUFHLENBQUMsUUFBUSxnQkFBZ0IsU0FBUyxFQUFFLENBQUMsQ0FBQztZQUM3RSxPQUFPLEVBQUUsT0FBTyxFQUFFLE1BQU0sSUFBSSxDQUFDLDJCQUEyQixDQUFDLEdBQUcsQ0FBQyxFQUFFLFFBQVEsRUFBRSxDQUFDO1FBQzVFLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxhQUFhLENBQUMsRUFBVSxFQUFFLE9BQWdCLEVBQUUsU0FBaUI7UUFDeEUsT0FBTyxNQUFNLElBQUksQ0FBQyxvQkFBb0IsQ0FBQyxLQUFLLElBQUksRUFBRTtZQUNoRCxNQUFNLEdBQUcsR0FBRyxJQUFJLENBQUMsY0FBYyxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3BDLEdBQUcsQ0FBQyxPQUFPLEdBQUcsT0FBTyxDQUFDO1lBQ3RCLEdBQUcsQ0FBQyxTQUFTLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQzNCLE1BQU0sR0FBRyxDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2pCLElBQUksQ0FBQyxRQUFRLENBQUMsR0FBRyxDQUFDLEdBQUcsQ0FBQyxFQUFFLEVBQUUsR0FBRyxDQUFDLENBQUM7WUFFL0IsTUFBTSxJQUFJLENBQUMsY0FBYyxFQUFFLENBQUM7WUFDNUIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsaUJBQWlCLEdBQUcsQ0FBQyxRQUFRLEtBQUssT0FBTyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDLFVBQVUsT0FBTyxTQUFTLEVBQUUsQ0FBQyxDQUFDO1lBQ3pHLE9BQU8sRUFBRSxPQUFPLEVBQUUsTUFBTSxJQUFJLENBQUMsMkJBQTJCLENBQUMsR0FBRyxDQUFDLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxDQUFDO1FBQ2hGLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxjQUFjLENBQUMsRUFBVSxFQUFFLFNBQWlCO1FBQ3ZELE9BQU8sTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDaEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwQyxNQUFNLFFBQVEsR0FBRywyQkFBMkIsRUFBRSxDQUFDO1lBQy9DLEdBQUcsQ0FBQyxrQkFBa0IsR0FBRyx1QkFBdUIsQ0FBQyxRQUFRLENBQUMsQ0FBQztZQUMzRCxHQUFHLENBQUMsYUFBYSxHQUFHLElBQUksQ0FBQyxHQUFHLEVBQUUsQ0FBQztZQUMvQixHQUFHLENBQUMsU0FBUyxHQUFHLEdBQUcsQ0FBQyxhQUFhLENBQUM7WUFDbEMsTUFBTSxHQUFHLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDakIsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsR0FBRyxDQUFDLEVBQUUsRUFBRSxHQUFHLENBQUMsQ0FBQztZQUUvQixNQUFNLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUM1QixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsR0FBRyxDQUFDLFFBQVEseUJBQXlCLFNBQVMsRUFBRSxDQUFDLENBQUM7WUFDdEYsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxHQUFHLENBQUMsRUFBRSxRQUFRLEVBQUUsUUFBUSxFQUFFLEVBQUUsRUFBRSxDQUFDO1FBQzFGLENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxhQUFhLENBQUMsRUFBVSxFQUFFLFNBQWlCO1FBQ3RELE9BQU8sTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDaEQsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUNwQyxNQUFNLEdBQUcsQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNuQixJQUFJLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxFQUFFLENBQUMsQ0FBQztZQUV6QixNQUFNLElBQUksQ0FBQyxjQUFjLEVBQUUsQ0FBQztZQUM1QixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSxpQkFBaUIsR0FBRyxDQUFDLFFBQVEsZ0JBQWdCLFNBQVMsRUFBRSxDQUFDLENBQUM7UUFDL0UsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRUQsNkVBQTZFO0lBQzdFLDZCQUE2QjtJQUM3Qiw2RUFBNkU7SUFFckUsY0FBYyxDQUFDLEVBQVU7UUFDL0IsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLFFBQVEsQ0FBQyxHQUFHLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbEMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDO1lBQ1QsTUFBTSxJQUFJLEtBQUssQ0FBQywyQkFBMkIsRUFBRSxFQUFFLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQ0QsT0FBTyxHQUFHLENBQUM7SUFDYixDQUFDO0lBRU8saUJBQWlCLENBQUMsV0FBbUI7UUFDM0MsTUFBTSxRQUFRLEdBQUcsQ0FBQyxXQUFXLElBQUksRUFBRSxDQUFDLENBQUMsSUFBSSxFQUFFLENBQUMsV0FBVyxFQUFFLENBQUM7UUFDMUQsSUFBSSxDQUFDLDZCQUE2QixDQUFDLElBQUksQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQ2xELE1BQU0sSUFBSSxLQUFLLENBQUMsNEdBQTRHLENBQUMsQ0FBQztRQUNoSSxDQUFDO1FBQ0QsSUFBSSw0QkFBNEIsQ0FBQyxRQUFRLENBQUMsRUFBRSxDQUFDO1lBQzNDLE1BQU0sSUFBSSxLQUFLLENBQUMsc0VBQXNFLFFBQVEsRUFBRSxDQUFDLENBQUM7UUFDcEcsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFTyxlQUFlLENBQUMsU0FBaUIsRUFBRSxPQUFlO1FBQ3hELE1BQU0sTUFBTSxHQUFHLENBQUMsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQ3RELElBQUksQ0FBQywyQkFBMkIsQ0FBQyxJQUFJLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztZQUM5QyxNQUFNLElBQUksS0FBSyxDQUFDLFdBQVcsT0FBTyxtREFBbUQsU0FBUyxFQUFFLENBQUMsQ0FBQztRQUNwRyxDQUFDO1FBQ0QsT0FBTyxNQUFNLENBQUM7SUFDaEIsQ0FBQztJQUVPLHVCQUF1QixDQUFDLFVBQWtCLEVBQUUsT0FBZTtRQUNqRSxNQUFNLE9BQU8sR0FBRyxDQUFDLFVBQVUsSUFBSSxFQUFFLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQztRQUN4RCxNQUFNLEtBQUssR0FBRyxPQUFPLENBQUMsS0FBSyxDQUFDLEdBQUcsQ0FBQyxDQUFDO1FBQ2pDLElBQUksS0FBSyxDQUFDLE1BQU0sS0FBSyxDQUFDO2VBQ2pCLENBQUMsa0NBQWtDLENBQUMsSUFBSSxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsQ0FBQztlQUNsRCxDQUFDLDJCQUEyQixDQUFDLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ2pELE1BQU0sSUFBSSxLQUFLLENBQUMsV0FBVyxPQUFPLDBFQUEwRSxVQUFVLEVBQUUsQ0FBQyxDQUFDO1FBQzVILENBQUM7UUFDRCxPQUFPLE9BQU8sQ0FBQztJQUNqQixDQUFDO0lBRU8sb0JBQW9CLENBQUMsUUFBNkM7UUFDeEUsT0FBTztZQUNMLFNBQVMsRUFBRSxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFFLFNBQVMsSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxPQUFPLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxPQUFPLEVBQUUsY0FBYyxDQUFDLENBQUMsQ0FBQztZQUMzSCxPQUFPLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxDQUFDLFFBQVEsRUFBRSxPQUFPLElBQUksRUFBRSxDQUFDLENBQUMsR0FBRyxDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxJQUFJLENBQUMsZUFBZSxDQUFDLE1BQU0sRUFBRSxjQUFjLENBQUMsQ0FBQyxDQUFDO1NBQzlHLENBQUM7SUFDSixDQUFDO0lBRU8sdUJBQXVCLENBQUMsUUFBZ0Q7UUFDOUUsTUFBTSxJQUFJLEdBQUcsUUFBUSxFQUFFLElBQUksS0FBSyxZQUFZLENBQUMsQ0FBQyxDQUFDLFlBQVksQ0FBQyxDQUFDLENBQUMsS0FBSyxDQUFDO1FBQ3BFLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUMsQ0FBQyxRQUFRLEVBQUUsU0FBUyxJQUFJLEVBQUUsQ0FBQyxDQUFDLEdBQUcsQ0FBQyxDQUFDLE9BQU8sRUFBRSxFQUFFLENBQUMsSUFBSSxDQUFDLHVCQUF1QixDQUFDLE9BQU8sRUFBRSxpQkFBaUIsQ0FBQyxDQUFDLENBQUMsQ0FBQztRQUN0SSxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFFLE9BQU8sSUFBSSxFQUFFLENBQUMsQ0FBQyxHQUFHLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLElBQUksQ0FBQyxlQUFlLENBQUMsTUFBTSxFQUFFLGlCQUFpQixDQUFDLENBQUMsQ0FBQyxDQUFDO1FBQ3hILElBQUksSUFBSSxLQUFLLFlBQVksSUFBSSxTQUFTLENBQUMsTUFBTSxLQUFLLENBQUMsSUFBSSxPQUFPLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzVFLE1BQU0sSUFBSSxLQUFLLENBQUMsbUhBQW1ILENBQUMsQ0FBQztRQUN2SSxDQUFDO1FBQ0QsT0FBTyxFQUFFLElBQUksRUFBRSxTQUFTLEVBQUUsT0FBTyxFQUFFLENBQUM7SUFDdEMsQ0FBQztJQUVPLG1CQUFtQixDQUFDLFNBQTZDO1FBQ3ZFLE1BQU0sS0FBSyxHQUFHLFNBQVMsRUFBRSxLQUFLLENBQUM7UUFDL0IsSUFBSSxLQUFLLEtBQUssU0FBUyxJQUFJLENBQUMsQ0FBQyxRQUFRLEVBQUUsVUFBVSxFQUFFLE1BQU0sQ0FBQyxDQUFDLFFBQVEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQzNFLE1BQU0sSUFBSSxLQUFLLENBQUMsOEJBQThCLEtBQUssRUFBRSxDQUFDLENBQUM7UUFDekQsQ0FBQztRQUNELE9BQU87WUFDTCxRQUFRLEVBQUUsT0FBTyxDQUFDLFNBQVMsRUFBRSxRQUFRLENBQUM7WUFDdEMsR0FBRyxDQUFDLEtBQUssQ0FBQyxDQUFDLENBQUMsRUFBRSxLQUFLLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1NBQzVCLENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7T0FJRztJQUNLLEtBQUssQ0FBQyx1QkFBdUIsQ0FDbkMsVUFBa0MsRUFDbEMsV0FBb0MsRUFDcEMsUUFBZ0I7UUFFaEIsSUFBSSxDQUFDLFVBQVUsQ0FBQyxRQUFRO1lBQUUsT0FBTztRQUNqQyxNQUFNLGFBQWEsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLDJCQUEyQixDQUFDLFdBQVcsQ0FBQyxDQUFDLElBQUksRUFBRSxDQUFDLENBQUM7UUFDaEYsSUFBSSxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUMsRUFBRSxDQUFDO1lBQy9CLE1BQU0sSUFBSSxLQUFLLENBQUMsa0NBQWtDLFFBQVEsc0VBQXNFLENBQUMsQ0FBQztRQUNwSSxDQUFDO1FBQ0QsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDO1FBQy9ELElBQUksQ0FBQyxrQkFBa0IsRUFBRSxDQUFDO1lBQ3hCLE1BQU0sSUFBSSxLQUFLLENBQUMsd0VBQXdFLENBQUMsQ0FBQztRQUM1RixDQUFDO1FBQ0QsS0FBSyxNQUFNLE1BQU0sSUFBSSxhQUFhLEVBQUUsQ0FBQztZQUNuQyxJQUFJLENBQUMsTUFBTSxrQkFBa0IsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztnQkFDbEQsTUFBTSxJQUFJLEtBQUssQ0FBQyxpREFBaUQsTUFBTSw4QkFBOEIsQ0FBQyxDQUFDO1lBQ3pHLENBQUM7WUFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLGtCQUFrQixDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDO1lBQ3hFLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLENBQUMsU0FBUyxDQUFDLFFBQVEsRUFBRSxDQUFDO2dCQUM1QyxNQUFNLElBQUksS0FBSyxDQUFDLDJEQUEyRCxNQUFNLE1BQU0sU0FBUyxDQUFDLE1BQU0sSUFBSSx5QkFBeUIsRUFBRSxDQUFDLENBQUM7WUFDMUksQ0FBQztRQUNILENBQUM7SUFDSCxDQUFDO0lBRUQsOEZBQThGO0lBQ3RGLEtBQUssQ0FBQywyQkFBMkIsQ0FBQyxXQUFvQztRQUM1RSxNQUFNLFFBQVEsR0FBYSxFQUFFLENBQUM7UUFDOUIsTUFBTSxrQkFBa0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDO1FBQy9ELElBQUksQ0FBQyxrQkFBa0I7WUFBRSxPQUFPLFFBQVEsQ0FBQztRQUN6QyxLQUFLLE1BQU0sTUFBTSxJQUFJLElBQUksQ0FBQywyQkFBMkIsQ0FBQyxXQUFXLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO1lBQzFFLElBQUksQ0FBQztnQkFDSCxJQUFJLENBQUMsTUFBTSxrQkFBa0IsQ0FBQyxXQUFXLENBQUMsTUFBTSxDQUFDLEVBQUUsQ0FBQztvQkFDbEQsUUFBUSxDQUFDLElBQUksQ0FBQyxrQkFBa0IsTUFBTSxzR0FBc0csQ0FBQyxDQUFDO2dCQUNoSixDQUFDO1lBQ0gsQ0FBQztZQUFDLE9BQU8sS0FBYyxFQUFFLENBQUM7Z0JBQ3hCLFFBQVEsQ0FBQyxJQUFJLENBQUMsbUNBQW1DLE1BQU0sTUFBTyxLQUFlLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUMzRixDQUFDO1FBQ0gsQ0FBQztRQUNELE9BQU8sUUFBUSxDQUFDO0lBQ2xCLENBQUM7SUFFTyxLQUFLLENBQUMsMkJBQTJCLENBQUMsR0FBbUI7UUFDM0QsTUFBTSxJQUFJLEdBQUcsR0FBRyxDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQy9CLE1BQU0sa0JBQWtCLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxrQkFBa0IsQ0FBQztRQUMvRCxNQUFNLGFBQWEsR0FBRyxDQUFDLEdBQUcsSUFBSSxDQUFDLDJCQUEyQixDQUFDLEdBQUcsQ0FBQyxXQUFXLENBQUMsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1FBQ3BGLElBQUksQ0FBQyxrQkFBa0IsSUFBSSxhQUFhLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLElBQUksQ0FBQztRQUVuRSxNQUFNLGVBQWUsR0FBa0MsRUFBRSxDQUFDO1FBQzFELEtBQUssTUFBTSxNQUFNLElBQUksYUFBYSxFQUFFLENBQUM7WUFDbkMsSUFBSSxDQUFDO2dCQUNILElBQUksQ0FBQyxNQUFNLGtCQUFrQixDQUFDLFdBQVcsQ0FBQyxNQUFNLENBQUMsRUFBRSxDQUFDO29CQUNsRCxlQUFlLENBQUMsSUFBSSxDQUFDO3dCQUNuQixNQUFNO3dCQUNOLEtBQUssRUFBRSxDQUFDLEdBQUcsQ0FBQyxVQUFVLEVBQUUsUUFBUTt3QkFDaEMsTUFBTSxFQUFFLDRCQUE0QjtxQkFDckMsQ0FBQyxDQUFDO29CQUNILFNBQVM7Z0JBQ1gsQ0FBQztnQkFDRCxNQUFNLFNBQVMsR0FBRyxNQUFNLGtCQUFrQixDQUFDLG9CQUFvQixDQUFDLE1BQU0sQ0FBQyxDQUFDO2dCQUN4RSxlQUFlLENBQUMsSUFBSSxDQUFDO29CQUNuQixNQUFNO29CQUNOLEtBQUssRUFBRSxTQUFTLENBQUMsS0FBSztvQkFDdEIsR0FBRyxDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQyxDQUFDLEVBQUUsTUFBTSxFQUFFLFNBQVMsQ0FBQyxNQUFNLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2lCQUMxRCxDQUFDLENBQUM7WUFDTCxDQUFDO1lBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztnQkFDeEIsZUFBZSxDQUFDLElBQUksQ0FBQztvQkFDbkIsTUFBTTtvQkFDTixLQUFLLEVBQUUsS0FBSztvQkFDWixNQUFNLEVBQUUsMkJBQTRCLEtBQWUsQ0FBQyxPQUFPLEVBQUU7aUJBQzlELENBQUMsQ0FBQztZQUNMLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTyxFQUFFLEdBQUcsSUFBSSxFQUFFLGVBQWUsRUFBRSxDQUFDO0lBQ3RDLENBQUM7SUFFTyxNQUFNLENBQUMsTUFBZ0I7UUFDN0IsT0FBTyxDQUFDLEdBQUcsSUFBSSxHQUFHLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQztJQUM5QixDQUFDO0lBRU8sS0FBSyxDQUFDLG9CQUFvQixDQUFJLE1BQXdCO1FBQzVELE1BQU0sR0FBRyxHQUFHLElBQUksQ0FBQyxhQUFhLENBQUMsSUFBSSxDQUFDLE1BQU0sRUFBRSxNQUFNLENBQUMsQ0FBQztRQUNwRCxJQUFJLENBQUMsYUFBYSxHQUFHLEdBQUcsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDaEQsT0FBTyxNQUFNLEdBQUcsQ0FBQztJQUNuQixDQUFDO0NBQ0YifQ==

package/dist_ts/email/classes.workapp-mail-manager.d.ts

@@ -1,4 +1,4 @@
-import type { IExtendedSmtpSession, IMessageAcceptanceContext, IMessageAcceptanceDecision, IUnifiedEmailServerOptions } from '@push.rocks/smartmta';
+import type { IEmailRoute, IExtendedSmtpSession, IMessageAcceptanceContext, IMessageAcceptanceDecision, IUnifiedEmailServerOptions } from '@push.rocks/smartmta';
 import type { Buffer } from 'node:buffer';
 import * as plugins from '../plugins.js';
 import { CachedEmail } from '../db/index.js';
@@ -47,6 +47,22 @@ interface IStoredWorkAppMailIdentity {
     smtpPassword: string;
     smtpLastRotatedAt?: number;
 }
+/**
+ * WorkApp-generated routes and SMTP users contributed to the composed email
+ * runtime config. Consumed by SmtpAccountManager, the single owner of the
+ * final `auth` block and route-list composition.
+ */
+export interface IWorkAppMailRuntimeContribution {
+    routes: IEmailRoute[];
+    users: Array<{
+        username: string;
+        password: string;
+    }>;
+}
+/** Route names generated (and owned wholesale) by WorkAppMailManager. */
+export declare function isWorkAppManagedMailRouteName(routeName: string): boolean;
+/** SMTP usernames generated (and owned wholesale) by WorkAppMailManager. */
+export declare function isWorkAppManagedSmtpUsername(username: string): boolean;
 export declare class WorkAppMailManager {
     private dcRouterRef;
     private readonly storageKey;
@@ -79,12 +95,16 @@ export declare class WorkAppMailManager {
     deliverCachedEmailToTypedEndpoint(cachedEmailArg: CachedEmail, rawMessageArg: Buffer | plugins.buffer.Buffer, sessionArg: IExtendedSmtpSession): Promise<boolean>;
     deleteMailAddressBinding(id: string, createdBy: string): Promise<TMailAddressBindingDeleteResponse>;
     private deleteMailAddressBindingInner;
-    applyStoredIdentitiesToEmailConfig<TConfig extends IUnifiedEmailServerOptions>(emailConfig: TConfig): Promise<TConfig>;
+    /**
+     * Compute the workapp-generated routes and SMTP users for the given
+     * candidate email config. Pure contribution — the final composition of
+     * routes and the `auth` block is owned exclusively by SmtpAccountManager.
+     */
+    getStoredIdentityContribution(emailConfig: IUnifiedEmailServerOptions, identities?: IStoredWorkAppMailIdentity[] | undefined): Promise<IWorkAppMailRuntimeContribution>;
     applyStoredIdentitiesToRuntime(identities?: IStoredWorkAppMailIdentity[] | undefined): Promise<void>;
     private readStoredIdentities;
     private writeStoredIdentities;
     private getRequiredStorageManager;
-    private mergeIdentitiesIntoEmailConfig;
     private buildInboundRoute;
     private buildOutboundRoute;
     private ensureEmailDomainConfigured;
@@ -143,7 +163,6 @@ export declare class WorkAppMailManager {
     private buildOutboundRouteName;
     private hashExternalKey;
     private generateSmtpPassword;
-    private isManagedMailRouteName;
     private isManagedSmtpUsername;
     private buildSmtpCredentials;
     private toMailCredentialPublic;