@serve.zone/dcrouter 18.6.2 → 18.7.1

package/dist_ts/remoteingress/classes.hub-lifecycle.js

@@ -150,6 +150,7 @@ export class RemoteIngressHubLifecycle {
                 this.dcRouterRef.tunnelManager = undefined;
             }
         }
+        this.dcRouterRef.mailDnsSync.requestEdgeEligibilityCheck('RemoteIngress hub stopped');
     }
     async restartTunnelHubLocked() {
         const generation = ++this.generation;
@@ -239,4 +240,4 @@ export class RemoteIngressHubLifecycle {
         return tlsConfig;
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5odWItbGlmZWN5Y2xlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvcmVtb3RlaW5ncmVzcy9jbGFzc2VzLmh1Yi1saWZlY3ljbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN0QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDOUMsT0FBTyxFQUFFLG9CQUFvQixFQUFxQyxNQUFNLG9DQUFvQyxDQUFDO0FBQzdHLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUk1RDs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUtoQjtJQUpaLGNBQWMsR0FBa0IsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2xELFFBQVEsR0FBRyxLQUFLLENBQUM7SUFDakIsVUFBVSxHQUFHLENBQUMsQ0FBQztJQUV2QixZQUFvQixXQUFxQjtRQUFyQixnQkFBVyxHQUFYLFdBQVcsQ0FBVTtJQUFHLENBQUM7SUFFdEMsS0FBSyxDQUFDLEtBQUs7UUFDaEIsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1FBQ25FLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1lBQzFCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxXQUFXLEdBQUcsb0JBQW9CLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDMUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSwrQ0FBK0MsQ0FBQyxDQUFDO1lBQ3BFLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsa0NBQWtDLENBQUMsQ0FBQztRQUN2RCxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztRQUN0QixNQUFNLFVBQVUsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7UUFFckMsTUFBTSxjQUFjLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLHFCQUFxQixFQUFFLDRCQUE0QixFQUFFLENBQUM7UUFDcEcsSUFBSSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE9BQU87UUFDVCxDQUFDO1FBQ0Qsb0JBQW9CLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFdkQsZ0ZBQWdGO1FBQ2hGLGdGQUFnRjtRQUNoRiw2Q0FBNkM7UUFDN0Msb0JBQW9CLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsK0JBQStCLEVBQVcsQ0FBQyxDQUFDO1FBRTVGLHdEQUF3RDtRQUN4RCxzRkFBc0Y7UUFDdEYsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLENBQUM7WUFDeEMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzFELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFVBQVUsRUFBRSxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7WUFDaEUsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDOUMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFVBQVUsRUFBRSxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7WUFDaEUsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxvQkFBb0IsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUM7UUFDNUQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsc0NBQXNDLFdBQVcsQ0FBQyxVQUFVLFNBQVMsU0FBUyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzFILENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSTtRQUNmLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNsQixNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQztZQUM1RCxJQUFJLG9CQUFvQixFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sb0JBQW9CLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ2xDLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEtBQUssb0JBQW9CLEVBQUUsQ0FBQztvQkFDNUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDO2dCQUM3QyxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQ3RCLFFBQXVELEVBQ3ZELGdCQUFnQixHQUFHLElBQUk7UUFFdkIsT0FBTyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDckMsSUFBSSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsMkJBQTJCLENBQUMsQ0FBQztZQUMvQyxDQUFDO1lBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsQ0FBQztZQUN0RCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN2QyxJQUFJLGdCQUFnQixJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ3ZELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUE4QjtRQUN0RCxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsSUFBSSxJQUFJLENBQUMsUUFBUTtnQkFBRSxPQUFPO1lBQzFCLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUNuQyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDMUQsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxjQUF3RDtRQUN2RixNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsSUFBSSxJQUFJLENBQUMsUUFBUTtnQkFBRSxPQUFPO1lBQzFCLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzFFLENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ25DLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMxRCxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLGlCQUFpQixDQUM1QixPQUF3QyxFQUN4QyxTQUFpQjtRQUVqQixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1FBQ3RELElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBRUQsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDbEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsaUJBQWlCLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sY0FBYyxHQUFHLGdCQUFnQixDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsT0FBTyxDQUFDO1FBRXJFLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxFQUFFO2dCQUM5QixNQUFNLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQ25DLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELElBQUksY0FBYyxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLHlDQUF5QyxFQUFFLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksRUFBRTtnQkFDOUIsTUFBTSxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztZQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRU8sbUJBQW1CLENBQUMsVUFBa0IsRUFBRSxPQUE2QjtRQUMzRSxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVE7ZUFDaEIsVUFBVSxLQUFLLElBQUksQ0FBQyxVQUFVO2VBQzlCLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEtBQUssT0FBTyxDQUFDO0lBQ3pELENBQUM7SUFFTyxTQUFTLENBQUksSUFBc0I7UUFDekMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDM0MsSUFBSSxDQUFDLGNBQWMsR0FBRyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNqRSxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFFTyxLQUFLLENBQUMsbUJBQW1CO1FBQy9CLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNsQixNQUFNLG9CQUFvQixHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxDQUFDO1FBQzVELElBQUksb0JBQW9CLEVBQUUsQ0FBQztZQUN6QixNQUFNLG9CQUFvQixDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2xDLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEtBQUssb0JBQW9CLEVBQUUsQ0FBQztnQkFDNUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDO1lBQzdDLENBQUM7UUFDSCxDQUFDO0lBQ0gsQ0FBQztJQUVPLEtBQUssQ0FBQyxzQkFBc0I7UUFDbEMsTUFBTSxVQUFVLEdBQUcsRUFBRSxJQUFJLENBQUMsVUFBVSxDQUFDO1FBQ3JDLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEVBQUUsY0FBYyxFQUFFLENBQUM7UUFDNUUsSUFBSSxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLElBQUksQ0FBQyxXQUFXLEVBQUUsT0FBTyxJQUFJLElBQUksQ0FBQyxRQUFRLEVBQUUsQ0FBQztZQUNyRixPQUFPO1FBQ1QsQ0FBQztRQUVELE1BQU0sb0JBQW9CLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUM7UUFDNUQsSUFBSSxvQkFBb0IsRUFBRSxDQUFDO1lBQ3pCLE1BQU0sb0JBQW9CLENBQUMsSUFBSSxFQUFFLENBQUM7WUFDbEMsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsS0FBSyxvQkFBb0IsRUFBRSxDQUFDO2dCQUM1RCxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsR0FBRyxTQUFTLENBQUM7WUFDN0MsQ0FBQztRQUNILENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxRQUFRLElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztZQUNwRCxPQUFPO1FBQ1QsQ0FBQztRQUNELE1BQU0sSUFBSSxDQUFDLG9CQUFvQixDQUFDLFVBQVUsQ0FBQyxDQUFDO0lBQzlDLENBQUM7SUFFTyxLQUFLLENBQUMsb0JBQW9CLENBQUMsVUFBa0I7UUFDbkQsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsQ0FBQztRQUN0RCxNQUFNLFdBQVcsR0FBRyxPQUFPLEVBQUUsY0FBYyxFQUFFLENBQUM7UUFDOUMsSUFBSSxDQUFDLE9BQU8sSUFBSSxDQUFDLFdBQVcsRUFBRSxPQUFPLElBQUksSUFBSSxDQUFDLFFBQVEsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3pGLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxjQUFjLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLHFCQUFxQixFQUFFLDRCQUE0QixFQUFFLENBQUM7UUFDcEcsSUFBSSxJQUFJLENBQUMsUUFBUSxJQUFJLFVBQVUsS0FBSyxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDekcsT0FBTztRQUNULENBQUM7UUFDRCxPQUFPLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFMUMsTUFBTSxTQUFTLEdBQUcsTUFBTSxJQUFJLENBQUMsZ0JBQWdCLENBQUMsV0FBVyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQ3JFLElBQUksSUFBSSxDQUFDLFFBQVEsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLFVBQVUsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixLQUFLLE9BQU8sRUFBRSxDQUFDO1lBQ3pHLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxhQUFhLEdBQUcsSUFBSSxhQUFhLENBQUMsT0FBTyxFQUFFO1lBQy9DLFVBQVUsRUFBRSxXQUFXLENBQUMsVUFBVTtZQUNsQyxVQUFVLEVBQUUsV0FBVztZQUN2QixHQUFHLEVBQUUsU0FBUztZQUNkLFdBQVcsRUFBRSxPQUFPLENBQUMsdUJBQXVCLEVBQUU7U0FDL0MsQ0FBQyxDQUFDO1FBQ0gsYUFBYSxDQUFDLG9CQUFvQixDQUFDLENBQUMsTUFBTSxFQUFFLEVBQUUsQ0FBQyxDQUM3QyxJQUFJLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQywyQkFBMkIsQ0FBQyxNQUFNLENBQUMsQ0FDakUsQ0FBQyxDQUFDO1FBQ0gsSUFBSSxDQUFDO1lBQ0gsTUFBTSxhQUFhLENBQUMsS0FBSyxFQUFFLENBQUM7UUFDOUIsQ0FBQztRQUFDLE9BQU8sR0FBRyxFQUFFLENBQUM7WUFDYixNQUFNLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsR0FBRyxFQUFFLEdBQUUsQ0FBQyxDQUFDLENBQUM7WUFDM0MsTUFBTSxHQUFHLENBQUM7UUFDWixDQUFDO1FBRUQsSUFBSSxJQUFJLENBQUMsUUFBUSxJQUFJLFVBQVUsS0FBSyxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDekcsTUFBTSxhQUFhLENBQUMsSUFBSSxFQUFFLENBQUMsS0FBSyxDQUFDLENBQUMsR0FBRyxFQUFFLEVBQUU7Z0JBQ3ZDLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLGtEQUFtRCxHQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUNqRyxDQUFDLENBQUMsQ0FBQztZQUNILE9BQU87UUFDVCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEdBQUcsYUFBYSxDQUFDO0lBQ2pELENBQUM7SUFFTyxLQUFLLENBQUMsZ0JBQWdCLENBQzVCLFNBQWtCO1FBRWxCLGlHQUFpRztRQUNqRyxJQUFJLFNBQTBELENBQUM7UUFFL0QsMkNBQTJDO1FBQzNDLE1BQU0sV0FBVyxHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsT0FBTyxDQUFDLG1CQUFtQixFQUFFLEdBQUcsQ0FBQztRQUN0RSxJQUFJLFdBQVcsRUFBRSxRQUFRLElBQUksV0FBVyxFQUFFLE9BQU8sRUFBRSxDQUFDO1lBQ2xELElBQUksQ0FBQztnQkFDSCxNQUFNLE9BQU8sR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsUUFBUSxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUN0RSxNQUFNLE1BQU0sR0FBRyxPQUFPLENBQUMsRUFBRSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO2dCQUNwRSxTQUFTLEdBQUcsRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLENBQUM7Z0JBQ2hDLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLHNEQUFzRCxDQUFDLENBQUM7WUFDN0UsQ0FBQztZQUFDLE9BQU8sR0FBWSxFQUFFLENBQUM7Z0JBQ3RCLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLG9EQUFxRCxHQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQztZQUNuRyxDQUFDO1FBQ0gsQ0FBQztRQUVELHFFQUFxRTtRQUNyRSxJQUFJLENBQUMsU0FBUyxJQUFJLFNBQVMsRUFBRSxDQUFDO1lBQzVCLElBQUksQ0FBQztnQkFDSCxNQUFNLE1BQU0sR0FBRyxNQUFNLFlBQVksQ0FBQyxZQUFZLENBQUMsU0FBUyxDQUFDLENBQUM7Z0JBQzFELElBQUksTUFBTSxFQUFFLFNBQVMsSUFBSSxNQUFNLEVBQUUsVUFBVSxFQUFFLENBQUM7b0JBQzVDLFNBQVMsR0FBRyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsU0FBUyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsVUFBVSxFQUFFLENBQUM7b0JBQ3JFLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLHdEQUF3RCxTQUFTLEVBQUUsQ0FBQyxDQUFDO2dCQUMxRixDQUFDO1lBQ0gsQ0FBQztZQUFDLE1BQU0sQ0FBQyxDQUFDLGtDQUFrQyxDQUFDLENBQUM7UUFDaEQsQ0FBQztRQUVELElBQUksQ0FBQyxTQUFTLEVBQUUsQ0FBQztZQUNmLE1BQU0sQ0FBQyxHQUFHLENBQUMsTUFBTSxFQUFFLG9GQUFvRixDQUFDLENBQUM7UUFDM0csQ0FBQztRQUVELE9BQU8sU0FBUyxDQUFDO0lBQ25CLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5odWItbGlmZWN5Y2xlLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vLi4vdHMvcmVtb3RlaW5ncmVzcy9jbGFzc2VzLmh1Yi1saWZlY3ljbGUudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQUEsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN0QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUFDOUMsT0FBTyxFQUFFLG9CQUFvQixFQUFxQyxNQUFNLG9DQUFvQyxDQUFDO0FBQzdHLE9BQU8sRUFBRSxhQUFhLEVBQUUsTUFBTSw2QkFBNkIsQ0FBQztBQUk1RDs7OztHQUlHO0FBQ0gsTUFBTSxPQUFPLHlCQUF5QjtJQUtoQjtJQUpaLGNBQWMsR0FBa0IsT0FBTyxDQUFDLE9BQU8sRUFBRSxDQUFDO0lBQ2xELFFBQVEsR0FBRyxLQUFLLENBQUM7SUFDakIsVUFBVSxHQUFHLENBQUMsQ0FBQztJQUV2QixZQUFvQixXQUFxQjtRQUFyQixnQkFBVyxHQUFYLFdBQVcsQ0FBVTtJQUFHLENBQUM7SUFFdEMsS0FBSyxDQUFDLEtBQUs7UUFDaEIsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1FBQ25FLElBQUksQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO1lBQzFCLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxXQUFXLEdBQUcsb0JBQW9CLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDMUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUN6QixNQUFNLENBQUMsR0FBRyxDQUFDLE1BQU0sRUFBRSwrQ0FBK0MsQ0FBQyxDQUFDO1lBQ3BFLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsa0NBQWtDLENBQUMsQ0FBQztRQUN2RCxJQUFJLENBQUMsUUFBUSxHQUFHLEtBQUssQ0FBQztRQUN0QixNQUFNLFVBQVUsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7UUFFckMsTUFBTSxjQUFjLEdBQUcsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLHFCQUFxQixFQUFFLDRCQUE0QixFQUFFLENBQUM7UUFDcEcsSUFBSSxDQUFDLElBQUksQ0FBQyxtQkFBbUIsQ0FBQyxVQUFVLEVBQUUsb0JBQW9CLENBQUMsRUFBRSxDQUFDO1lBQ2hFLE9BQU87UUFDVCxDQUFDO1FBQ0Qsb0JBQW9CLENBQUMsaUJBQWlCLENBQUMsY0FBYyxDQUFDLENBQUM7UUFFdkQsZ0ZBQWdGO1FBQ2hGLGdGQUFnRjtRQUNoRiw2Q0FBNkM7UUFDN0Msb0JBQW9CLENBQUMsU0FBUyxDQUFDLElBQUksQ0FBQyxXQUFXLENBQUMsK0JBQStCLEVBQVcsQ0FBQyxDQUFDO1FBRTVGLHdEQUF3RDtRQUN4RCxzRkFBc0Y7UUFDdEYsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixFQUFFLENBQUM7WUFDeEMsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLGtCQUFrQixDQUFDLFdBQVcsRUFBRSxDQUFDO1FBQzFELENBQUM7UUFDRCxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFVBQVUsRUFBRSxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7WUFDaEUsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7UUFDOUMsQ0FBQyxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUMsSUFBSSxDQUFDLG1CQUFtQixDQUFDLFVBQVUsRUFBRSxvQkFBb0IsQ0FBQyxFQUFFLENBQUM7WUFDaEUsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLFNBQVMsR0FBRyxvQkFBb0IsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxNQUFNLENBQUM7UUFDNUQsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsc0NBQXNDLFdBQVcsQ0FBQyxVQUFVLFNBQVMsU0FBUyxxQkFBcUIsQ0FBQyxDQUFDO0lBQzFILENBQUM7SUFFTSxLQUFLLENBQUMsSUFBSTtRQUNmLElBQUksQ0FBQyxRQUFRLEdBQUcsSUFBSSxDQUFDO1FBQ3JCLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNsQixNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQztZQUM1RCxJQUFJLG9CQUFvQixFQUFFLENBQUM7Z0JBQ3pCLE1BQU0sb0JBQW9CLENBQUMsSUFBSSxFQUFFLENBQUM7Z0JBQ2xDLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEtBQUssb0JBQW9CLEVBQUUsQ0FBQztvQkFDNUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDO2dCQUM3QyxDQUFDO1lBQ0gsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxXQUFXLENBQ3RCLFFBQXVELEVBQ3ZELGdCQUFnQixHQUFHLElBQUk7UUFFdkIsT0FBTyxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDckMsSUFBSSxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7Z0JBQ2xCLE1BQU0sSUFBSSxLQUFLLENBQUMsMkJBQTJCLENBQUMsQ0FBQztZQUMvQyxDQUFDO1lBQ0QsTUFBTSxPQUFPLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsQ0FBQztZQUN0RCxJQUFJLENBQUMsT0FBTyxFQUFFLENBQUM7Z0JBQ2IsTUFBTSxJQUFJLEtBQUssQ0FBQyw4QkFBOEIsQ0FBQyxDQUFDO1lBQ2xELENBQUM7WUFDRCxNQUFNLE1BQU0sR0FBRyxNQUFNLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztZQUN2QyxJQUFJLGdCQUFnQixJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ3ZELE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsT0FBTyxNQUFNLENBQUM7UUFDaEIsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLFlBQVksQ0FBQyxNQUE4QjtRQUN0RCxNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsSUFBSSxJQUFJLENBQUMsUUFBUTtnQkFBRSxPQUFPO1lBQzFCLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDLFNBQVMsQ0FBQyxNQUFNLENBQUMsQ0FBQztZQUMxRCxDQUFDO1lBQ0QsSUFBSSxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsRUFBRSxDQUFDO2dCQUNuQyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxDQUFDLGdCQUFnQixFQUFFLENBQUM7WUFDMUQsQ0FBQztRQUNILENBQUMsQ0FBQyxDQUFDO0lBQ0wsQ0FBQztJQUVNLEtBQUssQ0FBQyxtQkFBbUIsQ0FBQyxjQUF3RDtRQUN2RixNQUFNLElBQUksQ0FBQyxTQUFTLENBQUMsS0FBSyxJQUFJLEVBQUU7WUFDOUIsSUFBSSxJQUFJLENBQUMsUUFBUTtnQkFBRSxPQUFPO1lBQzFCLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxDQUFDO2dCQUMxQyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDLGlCQUFpQixDQUFDLGNBQWMsQ0FBQyxDQUFDO1lBQzFFLENBQUM7WUFDRCxJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxFQUFFLENBQUM7Z0JBQ25DLE1BQU0sSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsZ0JBQWdCLEVBQUUsQ0FBQztZQUMxRCxDQUFDO1FBQ0gsQ0FBQyxDQUFDLENBQUM7SUFDTCxDQUFDO0lBRU0sS0FBSyxDQUFDLGlCQUFpQixDQUM1QixPQUF3QyxFQUN4QyxTQUFpQjtRQUVqQixNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1FBQ3RELElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUNiLE1BQU0sSUFBSSxLQUFLLENBQUMsaUNBQWlDLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBRUQsTUFBTSxnQkFBZ0IsR0FBRyxPQUFPLENBQUMsY0FBYyxFQUFFLENBQUM7UUFDbEQsTUFBTSxRQUFRLEdBQUcsTUFBTSxPQUFPLENBQUMsaUJBQWlCLENBQUMsT0FBTyxFQUFFLFNBQVMsQ0FBQyxDQUFDO1FBQ3JFLE1BQU0sY0FBYyxHQUFHLGdCQUFnQixDQUFDLE9BQU8sS0FBSyxRQUFRLENBQUMsT0FBTyxDQUFDO1FBRXJFLElBQUksQ0FBQyxRQUFRLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDdEIsTUFBTSxJQUFJLENBQUMsU0FBUyxDQUFDLEtBQUssSUFBSSxFQUFFO2dCQUM5QixNQUFNLElBQUksQ0FBQyxtQkFBbUIsRUFBRSxDQUFDO1lBQ25DLENBQUMsQ0FBQyxDQUFDO1FBQ0wsQ0FBQztRQUVELElBQUksY0FBYyxFQUFFLENBQUM7WUFDbkIsTUFBTSxJQUFJLENBQUMsV0FBVyxDQUFDLHlDQUF5QyxFQUFFLENBQUM7UUFDckUsQ0FBQztRQUVELElBQUksUUFBUSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3JCLE1BQU0sSUFBSSxDQUFDLFNBQVMsQ0FBQyxLQUFLLElBQUksRUFBRTtnQkFDOUIsTUFBTSxJQUFJLENBQUMsc0JBQXNCLEVBQUUsQ0FBQztZQUN0QyxDQUFDLENBQUMsQ0FBQztRQUNMLENBQUM7UUFFRCxPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRU8sbUJBQW1CLENBQUMsVUFBa0IsRUFBRSxPQUE2QjtRQUMzRSxPQUFPLENBQUMsSUFBSSxDQUFDLFFBQVE7ZUFDaEIsVUFBVSxLQUFLLElBQUksQ0FBQyxVQUFVO2VBQzlCLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEtBQUssT0FBTyxDQUFDO0lBQ3pELENBQUM7SUFFTyxTQUFTLENBQUksSUFBc0I7UUFDekMsTUFBTSxHQUFHLEdBQUcsSUFBSSxDQUFDLGNBQWMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLENBQUM7UUFDM0MsSUFBSSxDQUFDLGNBQWMsR0FBRyxHQUFHLENBQUMsSUFBSSxDQUFDLEdBQUcsRUFBRSxDQUFDLFNBQVMsRUFBRSxHQUFHLEVBQUUsQ0FBQyxTQUFTLENBQUMsQ0FBQztRQUNqRSxPQUFPLEdBQUcsQ0FBQztJQUNiLENBQUM7SUFFTyxLQUFLLENBQUMsbUJBQW1CO1FBQy9CLElBQUksQ0FBQyxVQUFVLEVBQUUsQ0FBQztRQUNsQixNQUFNLG9CQUFvQixHQUFHLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxDQUFDO1FBQzVELElBQUksb0JBQW9CLEVBQUUsQ0FBQztZQUN6QixNQUFNLG9CQUFvQixDQUFDLElBQUksRUFBRSxDQUFDO1lBQ2xDLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEtBQUssb0JBQW9CLEVBQUUsQ0FBQztnQkFDNUQsSUFBSSxDQUFDLFdBQVcsQ0FBQyxhQUFhLEdBQUcsU0FBUyxDQUFDO1lBQzdDLENBQUM7UUFDSCxDQUFDO1FBQ0QsSUFBSSxDQUFDLFdBQVcsQ0FBQyxXQUFXLENBQUMsMkJBQTJCLENBQUMsMkJBQTJCLENBQUMsQ0FBQztJQUN4RixDQUFDO0lBRU8sS0FBSyxDQUFDLHNCQUFzQjtRQUNsQyxNQUFNLFVBQVUsR0FBRyxFQUFFLElBQUksQ0FBQyxVQUFVLENBQUM7UUFDckMsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRSxjQUFjLEVBQUUsQ0FBQztRQUM1RSxJQUFJLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsSUFBSSxDQUFDLFdBQVcsRUFBRSxPQUFPLElBQUksSUFBSSxDQUFDLFFBQVEsRUFBRSxDQUFDO1lBQ3JGLE9BQU87UUFDVCxDQUFDO1FBRUQsTUFBTSxvQkFBb0IsR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsQ0FBQztRQUM1RCxJQUFJLG9CQUFvQixFQUFFLENBQUM7WUFDekIsTUFBTSxvQkFBb0IsQ0FBQyxJQUFJLEVBQUUsQ0FBQztZQUNsQyxJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxLQUFLLG9CQUFvQixFQUFFLENBQUM7Z0JBQzVELElBQUksQ0FBQyxXQUFXLENBQUMsYUFBYSxHQUFHLFNBQVMsQ0FBQztZQUM3QyxDQUFDO1FBQ0gsQ0FBQztRQUVELElBQUksSUFBSSxDQUFDLFFBQVEsSUFBSSxVQUFVLEtBQUssSUFBSSxDQUFDLFVBQVUsRUFBRSxDQUFDO1lBQ3BELE9BQU87UUFDVCxDQUFDO1FBQ0QsTUFBTSxJQUFJLENBQUMsb0JBQW9CLENBQUMsVUFBVSxDQUFDLENBQUM7SUFDOUMsQ0FBQztJQUVPLEtBQUssQ0FBQyxvQkFBb0IsQ0FBQyxVQUFrQjtRQUNuRCxNQUFNLE9BQU8sR0FBRyxJQUFJLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1FBQ3RELE1BQU0sV0FBVyxHQUFHLE9BQU8sRUFBRSxjQUFjLEVBQUUsQ0FBQztRQUM5QyxJQUFJLENBQUMsT0FBTyxJQUFJLENBQUMsV0FBVyxFQUFFLE9BQU8sSUFBSSxJQUFJLENBQUMsUUFBUSxJQUFJLFVBQVUsS0FBSyxJQUFJLENBQUMsVUFBVSxFQUFFLENBQUM7WUFDekYsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLGNBQWMsR0FBRyxNQUFNLElBQUksQ0FBQyxXQUFXLENBQUMscUJBQXFCLEVBQUUsNEJBQTRCLEVBQUUsQ0FBQztRQUNwRyxJQUFJLElBQUksQ0FBQyxRQUFRLElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUN6RyxPQUFPO1FBQ1QsQ0FBQztRQUNELE9BQU8sQ0FBQyxpQkFBaUIsQ0FBQyxjQUFjLENBQUMsQ0FBQztRQUUxQyxNQUFNLFNBQVMsR0FBRyxNQUFNLElBQUksQ0FBQyxnQkFBZ0IsQ0FBQyxXQUFXLENBQUMsU0FBUyxDQUFDLENBQUM7UUFDckUsSUFBSSxJQUFJLENBQUMsUUFBUSxJQUFJLFVBQVUsS0FBSyxJQUFJLENBQUMsVUFBVSxJQUFJLElBQUksQ0FBQyxXQUFXLENBQUMsb0JBQW9CLEtBQUssT0FBTyxFQUFFLENBQUM7WUFDekcsT0FBTztRQUNULENBQUM7UUFFRCxNQUFNLGFBQWEsR0FBRyxJQUFJLGFBQWEsQ0FBQyxPQUFPLEVBQUU7WUFDL0MsVUFBVSxFQUFFLFdBQVcsQ0FBQyxVQUFVO1lBQ2xDLFVBQVUsRUFBRSxXQUFXO1lBQ3ZCLEdBQUcsRUFBRSxTQUFTO1lBQ2QsV0FBVyxFQUFFLE9BQU8sQ0FBQyx1QkFBdUIsRUFBRTtTQUMvQyxDQUFDLENBQUM7UUFDSCxhQUFhLENBQUMsb0JBQW9CLENBQUMsQ0FBQyxNQUFNLEVBQUUsRUFBRSxDQUFDLENBQzdDLElBQUksQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLDJCQUEyQixDQUFDLE1BQU0sQ0FBQyxDQUNqRSxDQUFDLENBQUM7UUFDSCxJQUFJLENBQUM7WUFDSCxNQUFNLGFBQWEsQ0FBQyxLQUFLLEVBQUUsQ0FBQztRQUM5QixDQUFDO1FBQUMsT0FBTyxHQUFHLEVBQUUsQ0FBQztZQUNiLE1BQU0sYUFBYSxDQUFDLElBQUksRUFBRSxDQUFDLEtBQUssQ0FBQyxHQUFHLEVBQUUsR0FBRSxDQUFDLENBQUMsQ0FBQztZQUMzQyxNQUFNLEdBQUcsQ0FBQztRQUNaLENBQUM7UUFFRCxJQUFJLElBQUksQ0FBQyxRQUFRLElBQUksVUFBVSxLQUFLLElBQUksQ0FBQyxVQUFVLElBQUksSUFBSSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsS0FBSyxPQUFPLEVBQUUsQ0FBQztZQUN6RyxNQUFNLGFBQWEsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxLQUFLLENBQUMsQ0FBQyxHQUFHLEVBQUUsRUFBRTtnQkFDdkMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsa0RBQW1ELEdBQWEsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQ2pHLENBQUMsQ0FBQyxDQUFDO1lBQ0gsT0FBTztRQUNULENBQUM7UUFDRCxJQUFJLENBQUMsV0FBVyxDQUFDLGFBQWEsR0FBRyxhQUFhLENBQUM7SUFDakQsQ0FBQztJQUVPLEtBQUssQ0FBQyxnQkFBZ0IsQ0FDNUIsU0FBa0I7UUFFbEIsaUdBQWlHO1FBQ2pHLElBQUksU0FBMEQsQ0FBQztRQUUvRCwyQ0FBMkM7UUFDM0MsTUFBTSxXQUFXLEdBQUcsSUFBSSxDQUFDLFdBQVcsQ0FBQyxPQUFPLENBQUMsbUJBQW1CLEVBQUUsR0FBRyxDQUFDO1FBQ3RFLElBQUksV0FBVyxFQUFFLFFBQVEsSUFBSSxXQUFXLEVBQUUsT0FBTyxFQUFFLENBQUM7WUFDbEQsSUFBSSxDQUFDO2dCQUNILE1BQU0sT0FBTyxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLE1BQU0sTUFBTSxHQUFHLE9BQU8sQ0FBQyxFQUFFLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3BFLFNBQVMsR0FBRyxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsQ0FBQztnQkFDaEMsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsc0RBQXNELENBQUMsQ0FBQztZQUM3RSxDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsb0RBQXFELEdBQWEsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDO1lBQ25HLENBQUM7UUFDSCxDQUFDO1FBRUQscUVBQXFFO1FBQ3JFLElBQUksQ0FBQyxTQUFTLElBQUksU0FBUyxFQUFFLENBQUM7WUFDNUIsSUFBSSxDQUFDO2dCQUNILE1BQU0sTUFBTSxHQUFHLE1BQU0sWUFBWSxDQUFDLFlBQVksQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDMUQsSUFBSSxNQUFNLEVBQUUsU0FBUyxJQUFJLE1BQU0sRUFBRSxVQUFVLEVBQUUsQ0FBQztvQkFDNUMsU0FBUyxHQUFHLEVBQUUsT0FBTyxFQUFFLE1BQU0sQ0FBQyxTQUFTLEVBQUUsTUFBTSxFQUFFLE1BQU0sQ0FBQyxVQUFVLEVBQUUsQ0FBQztvQkFDckUsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsd0RBQXdELFNBQVMsRUFBRSxDQUFDLENBQUM7Z0JBQzFGLENBQUM7WUFDSCxDQUFDO1lBQUMsTUFBTSxDQUFDLENBQUMsa0NBQWtDLENBQUMsQ0FBQztRQUNoRCxDQUFDO1FBRUQsSUFBSSxDQUFDLFNBQVMsRUFBRSxDQUFDO1lBQ2YsTUFBTSxDQUFDLEdBQUcsQ0FBQyxNQUFNLEVBQUUsb0ZBQW9GLENBQUMsQ0FBQztRQUMzRyxDQUFDO1FBRUQsT0FBTyxTQUFTLENBQUM7SUFDbkIsQ0FBQztDQUNGIn0=

package/dist_ts_interfaces/data/email-domain.d.ts

@@ -86,6 +86,8 @@ export interface IEmailDomainReconciliation {
     lastSuccessAt?: string;
     retryAt?: string;
     deletingAt?: string;
+    /** Provider record ids whose absence must be confirmed before a deletion tombstone can finalize. */
+    deletingProviderRecordIds?: string[];
 }
 /**
  * An email domain managed by dcrouter.

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '18.6.2',
+    version: '18.7.1',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "18.6.2",
+  "version": "18.7.1",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -18,8 +18,8 @@
     "@git.zone/tsbuild": "^4.4.2",
     "@git.zone/tsbundle": "^2.11.3",
     "@git.zone/tsdeno": "^1.7.0",
-    "@git.zone/tsdocker": "^3.1.0",
-    "@git.zone/tsrun": "^2.0.5",
+    "@git.zone/tsdocker": "^3.1.1",
+    "@git.zone/tsrun": "^2.0.6",
     "@git.zone/tstest": "^3.6.7",
     "@git.zone/tswatch": "^3.3.5",
     "@types/node": "26.1.1",
@@ -30,7 +30,7 @@
     "@api.global/typedrequest-interfaces": "^3.0.19",
     "@api.global/typedserver": "^8.6.4",
     "@api.global/typedsocket": "^5.0.0",
-    "@apiclient.xyz/cloudflare": "^7.1.0",
+    "@apiclient.xyz/cloudflare": "^8.0.0",
     "@design.estate/dees-catalog": "^3.99.0",
     "@design.estate/dees-element": "^2.4.0",
     "@idp.global/sdk": "^14.3.0",

package/readme.md

@@ -121,7 +121,7 @@ Bootstrap behavior:
 | `baseDir` | Root directory for dcrouter runtime data. Defaults to `~/.serve.zone/dcrouter`. |
 | `coreTrafficConfig` | Main CoreTraffic route configuration for HTTP/HTTPS/TCP/SNI traffic. `smartProxyConfig` remains accepted as a legacy alias. |
 | `emailConfig` | UnifiedEmailServer configuration: hostname, ports, domains, and mail routes. |
-| `emailOutboundMode` | Outbound SMTP mode. Defaults to `direct`; `remoteIngress` routes outbound SMTP through a RemoteIngress egress edge. |
+| `emailOutboundMode` | Outbound SMTP mode. Defaults to `remoteIngress`; explicit `direct` mode lets unmanaged/static senders dial from the hub. |
 | `emailPortConfig` | External-to-internal email port mapping and received-email storage path. |
 | `tls` | Legacy/static TLS and ACME contact settings used to seed certificate config. |
 | `dnsNsDomains` | Nameserver hostnames used for generated NS records and DoH routes. A zone becomes authoritative by having its public NS records observed naming one of these. |
@@ -495,7 +495,7 @@ from the destination server.
 
 ### RemoteIngress SMTP Egress
 
-The email settings API and Ops UI expose `outboundMode`. Keep it at `direct` to let SmartMTA dial destination MX hosts from the dcrouter hub. Set it to `remoteIngress` to make SmartMTA request a one-shot RemoteIngress TCP egress proxy for each outbound SMTP connection while keeping the logical MX host and port for SMTP/TLS identity.
+The email settings API and Ops UI expose `outboundMode`. Keep it at `direct` to let unmanaged/static senders dial destination MX hosts from the dcrouter hub; managed sender domains are always rejected in direct mode. Set it to `remoteIngress` to make SmartMTA request a one-shot RemoteIngress TCP egress proxy for each outbound SMTP connection while keeping the logical MX host and port for SMTP/TLS identity. Direct mode is explicit operator policy, never an automatic fallback.
 
 RemoteIngress edge create/update APIs accept an `egress` policy. Egress is default-disabled and is propagated to the hub only when `egress.enabled === true`.
 
@@ -510,17 +510,17 @@ Supported egress policy fields:
 | `deniedCidrs` | CIDRs denied after edge-side DNS resolution. |
 | `maxConcurrentStreams` | Optional concurrent outbound SMTP stream cap for the edge. |
 
-RemoteIngress status responses include `capabilities`, `egressEnabled`, and source-bound egress identity. A mail edge is eligible only when it is enabled, carries the `mail` tag, permits destination port `25`, is connected with a fresh heartbeat, uses native QUIC without TCP fallback, advertises both `egressTcpV1` and `egressIdentityV1`, and reports a fresh non-stale `localSocketBind` identity. That identity must match the edge's declared `publicIp` or `publicIpV6`, the edge must have a `mailHostname`, its PTR must resolve exactly to that hostname, and the hostname's A/AAAA set must contain the source address. Domain edge filters narrow this pool and remain fail-closed when they match nothing.
+RemoteIngress status responses include `capabilities`, `egressEnabled`, and source-bound egress identity. A mail edge is eligible only when it is enabled, carries the `mail` tag, permits destination port `25`, is connected with a fresh heartbeat, uses native QUIC without TCP fallback, advertises both `egressTcpV1` and `egressIdentityV1`, and reports a fresh non-stale `localSocketBind` identity. Every configured address family must have exactly one matching fresh proof: configuring both `publicIp` and `publicIpV6` requires valid IPv4 and IPv6 identities. Each identity must match the edge's declared address, the edge must have a `mailHostname`, its PTR must resolve exactly to that hostname, and the hostname's A/AAAA set must contain the source address. Domain edge filters narrow this pool and remain fail-closed when they match nothing.
 
 RemoteIngress v5 edge runtimes must configure `egressSourceIpv4` and/or `egressSourceIpv6` with concrete addresses assigned to the edge host. The equivalent CLI flags are `--egress-source-ipv4` and `--egress-source-ipv6`; the environment variables are `REMOTEINGRESS_EGRESS_SOURCE_IPV4` and `REMOTEINGRESS_EGRESS_SOURCE_IPV6`. These addresses must match dcrouter's declared edge IPs. Every outbound socket is bound to the matching family, and a missing or unbindable family fails closed. There is no OS-selected address or direct-hub fallback in `remoteIngress` mode.
 
-Managed email domains use the durable lifecycle `pending -> active | failed -> deleting`; the document is removed only after deletion cleanup completes. Creation must obtain a usable DKIM key before persistence, then automatically reconciles and validates MX, SPF, DKIM, DMARC, and direct per-edge A/AAAA records. Inbound acceptance is independent and remains available while outbound SMTP credentials and sending are gated until the domain has a validated `activeRevision` and a live eligible edge.
+Managed email domains use the durable lifecycle `pending -> active | failed -> deleting`; the document is removed only after deletion cleanup completes. Creation must obtain a usable DKIM key before persistence, then automatically reconciles and validates MX, SPF, DKIM, DMARC, and direct per-edge A/AAAA records. Inbound acceptance is independent and remains available while outbound SMTP credentials and sending are gated until the domain has a validated `activeRevision` and both selected MX edges are live.
 
-One eligible edge publishes one priority 10 MX target. Two or more eligible edges publish distinct stable priority 10 and priority 20 targets, each backed directly by A/AAAA rather than CNAME. SPF uses `-all` and authorizes every IPv4/IPv6 source identity required by the active or make-before-break transition revision. Activation requires the complete MX RRset, all record intents, and exact PTR plus forward-confirmed A/AAAA validation. Topology replacement validates the desired state before activation, then removes stale owned records.
+Managed domains require two eligible edges with distinct hostnames. The reconciler selects stable priority 10 and priority 20 targets and uses that same two-edge set for direct A/AAAA records, public validation, the active revision, and outbound egress. Zero or one eligible edge produces no partial desired MX/SPF set and never falls back to the hub. SPF uses `-all`; steady state authorizes the selected pair, while a make-before-break transition temporarily authorizes both the active and pending pairs until activation triggers immediate contraction. Activation requires the complete MX RRset, all record intents, and exact PTR plus forward-confirmed A/AAAA validation. Topology replacement validates the desired state before activation, then removes stale owned records; an incomplete pinned topology withdraws the previous owned MX/SPF state.
 
-The reconciler is globally serialized and coalesces concurrent triggers. It runs at startup, every five minutes, and after relevant domain, DNS, DKIM, topology, or egress-identity changes. Provider state is refreshed on each pass; only records marked `managedBy: 'mail-dns-reconciler'` are mutated or deleted. Unmanaged SPF, DMARC, DKIM, or MX conflicts fail visibly instead of being overwritten. Each domain persists desired and active revisions, per-record intent status, provider/validation errors, attempt and validation timestamps, capability state, and `retryAt`. Provider/API failures propagate through the email-domain API and never become false provisioning success.
+The reconciler is globally serialized and coalesces concurrent triggers. It runs at startup, schedules desired-state checks no more often than every five minutes, and reacts to relevant domain, DNS, DKIM, topology, or egress-identity changes. Failed domains honor persisted `retryAt` state with exponential backoff up to one hour. Provider state is refreshed on each pass; only records marked `managedBy: 'mail-dns-reconciler'` are mutated or deleted. Unmanaged SPF, DMARC, DKIM, or MX conflicts fail visibly instead of being overwritten. Each domain persists desired and active revisions, per-record intent status, provider/validation errors, attempt and validation timestamps, capability state, and `retryAt`. Provider/API failures propagate through the email-domain API and never become false provisioning success. Provider deletion retains local ownership until the provider returns an explicit not-found response or a complete provider-ID listing confirms absence; DNS domain migration/deletion and forced provider deletion are refused while managed email references or reconciler-owned mail records remain.
 
-DKIM generation failure is atomic. Automatic rotation defaults to 90 days with a 30-day retiring-selector overlap. dcrouter publishes and validates a staged selector, requires SmartMTA's selector-correct signing capability, promotes it for signing only after the DNS revision validates, retains the previous selector for the overlap, and later removes the owned record.
+DKIM generation failure is atomic. Automatic rotation defaults to 90 days with a 30-day retiring-selector overlap; `rotationIntervalDays` must be a positive integer. dcrouter publishes and validates a staged selector, requires SmartMTA's selector-correct signing capability, promotes it for signing only after the DNS revision validates, retains the previous selector for the overlap, and schedules retirement at `retireAfter`. Retiring metadata is pruned only after the owned DNS record has been removed successfully.
 
 The additive public contracts include `IEmailDomainActionResult`, `IEmailDomain.reconciliation`, lifecycle/error/capability/retry fields, active/pending/retiring DKIM material, DNS intents and revisions, and edge identities. For mutation requests, `success: true` means the operation was accepted and durably recorded; `lifecycleStatus: 'pending'` or `'deleting'` still means activation or cleanup has not completed.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '18.6.2',
+  version: '18.7.1',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }

package/ts/classes.dcrouter.ts

@@ -1891,6 +1891,10 @@ export class DcRouter {
     // final durable authentication-event and email-traffic drain.
     await this.stopOpsServer();
 
+    // Mail DNS reconciliation may legitimately outlive ServiceManager's
+    // non-cancelling per-service timeout. Drain it before dependency teardown.
+    await this.mailDnsSync.stop();
+
     // ServiceManager handles reverse-dependency-ordered shutdown
     await this.serviceManager.stop();
 

package/ts/dns/classes.dns-server-runtime.ts

@@ -560,8 +560,8 @@ export class DnsServerRuntime {
       case 'A':
         return value; // IP address as string
       case 'MX':
-        const [priority, exchange] = value.split(' ');
-        return { priority: parseInt(priority), exchange };
+        const [preference, exchange] = value.split(' ');
+        return { preference: parseInt(preference, 10), exchange };
       case 'TXT':
         return value;
       case 'NS':

package/ts/dns/manager.dns.ts

@@ -4,6 +4,7 @@ import {
   DnsProviderDoc,
   DomainDoc,
   DnsRecordDoc,
+  EmailDomainDoc,
 } from '../db/documents/index.js';
 import type { IDcRouterOptions } from '../classes.dcrouter.js';
 import type { IDnsProviderClient, IProviderRecord } from './providers/interfaces.js';
@@ -41,6 +42,12 @@ export interface IDnsRuntimeRegistration {
   origin: TDnsRuntimeRegistrationOrigin;
 }
 
+export interface IDnsRecordDeleteResult {
+  id: string;
+  success: boolean;
+  message?: string;
+}
+
 /**
  * DnsManager — owns runtime DNS state on top of the embedded DnsServer.
  *
@@ -83,11 +90,29 @@ export class DnsManager {
    */
   private runtimeRegistrations = new Map<string, Map<string, IDnsRuntimeRegistration>>();
 
+  /** Serializes managed-mail reconciliation with destructive domain/provider deletion. */
+  private managedMailDnsMutationChain: Promise<void> = Promise.resolve();
+  private acceptsManagedMailDnsMutations = true;
+
   /** Supplies the effective authority set (bootstrap ∪ delegation-verified). */
   private authorityZonesResolver?: () => string[];
 
   constructor(private options: IDcRouterOptions) {}
 
+  public async runManagedMailDnsMutationExclusive<T>(task: () => Promise<T>): Promise<T> {
+    if (!this.acceptsManagedMailDnsMutations) {
+      throw new Error('DnsManager is stopping; managed mail DNS mutations are closed');
+    }
+    const run = this.managedMailDnsMutationChain.then(async () => {
+      if (!this.acceptsManagedMailDnsMutations) {
+        throw new Error('DnsManager stopped before the managed mail DNS mutation could run');
+      }
+      return await task();
+    });
+    this.managedMailDnsMutationChain = run.then(() => undefined, () => undefined);
+    return await run;
+  }
+
   // ==========================================================================
   // Runtime registration registry
   // ==========================================================================
@@ -161,10 +186,13 @@ export class DnsManager {
   // ==========================================================================
 
   public async start(): Promise<void> {
+    this.acceptsManagedMailDnsMutations = true;
     logger.log('info', 'DnsManager: starting');
   }
 
   public async stop(): Promise<void> {
+    this.acceptsManagedMailDnsMutations = false;
+    await this.managedMailDnsMutationChain;
     this.providerClients.clear();
     this.runtimeRegistrations.clear();
     this.dnsServer = undefined;
@@ -507,7 +535,7 @@ export class DnsManager {
         return value;
       case 'MX': {
         const [priorityStr, exchange] = value.split(' ');
-        return { priority: parseInt(priorityStr, 10), exchange };
+        return { preference: parseInt(priorityStr, 10), exchange };
       }
       case 'SOA': {
         const parts = value.split(' ');
@@ -760,6 +788,15 @@ export class DnsManager {
   }
 
   public async deleteProvider(id: string, force: boolean): Promise<{ success: boolean; message?: string }> {
+    return await this.runManagedMailDnsMutationExclusive(
+      async () => await this.deleteProviderUnlocked(id, force),
+    );
+  }
+
+  private async deleteProviderUnlocked(
+    id: string,
+    force: boolean,
+  ): Promise<{ success: boolean; message?: string }> {
     const doc = await DnsProviderDoc.findById(id);
     if (!doc) return { success: false, message: 'Provider not found' };
     const linkedDomains = await DomainDoc.findByProviderId(id);
@@ -772,7 +809,16 @@ export class DnsManager {
     // If forcing, also delete the linked domains and their records.
     if (force) {
       for (const domain of linkedDomains) {
-        await this.deleteDomain(domain.id);
+        const references = await this.getManagedMailDnsReferences(domain.id);
+        if (references.emailDomains.length > 0 || references.managedRecordCount > 0) {
+          return {
+            success: false,
+            message: this.managedMailDnsReferenceMessage(domain.name, references),
+          };
+        }
+      }
+      for (const domain of linkedDomains) {
+        await this.deleteDomainUnlocked(domain.id);
       }
     }
     await doc.delete();
@@ -950,8 +996,18 @@ export class DnsManager {
    * domain's own recorded registrations are removed.
    */
   public async deleteDomain(id: string): Promise<boolean> {
+    return await this.runManagedMailDnsMutationExclusive(
+      async () => await this.deleteDomainUnlocked(id),
+    );
+  }
+
+  private async deleteDomainUnlocked(id: string): Promise<boolean> {
     const doc = await DomainDoc.findById(id);
     if (!doc) return false;
+    const references = await this.getManagedMailDnsReferences(id);
+    if (references.emailDomains.length > 0 || references.managedRecordCount > 0) {
+      throw new Error(this.managedMailDnsReferenceMessage(doc.name, references));
+    }
     // Tear runtime state down before the durable rows go away: the registry is
     // the authority on what to remove, so this does not depend on the records
     // still being readable.
@@ -972,6 +1028,28 @@ export class DnsManager {
     return true;
   }
 
+  private async getManagedMailDnsReferences(domainId: string): Promise<{
+    emailDomains: EmailDomainDoc[];
+    managedRecordCount: number;
+  }> {
+    const emailDomains = (await EmailDomainDoc.findAll()).filter((emailDomain) => (
+      emailDomain.linkedDomainId === domainId
+      || emailDomain.reconciliation?.providerZoneIds?.includes(domainId)
+      || emailDomain.reconciliation?.intents.some((intent) => intent.domainId === domainId)
+    ));
+    const managedRecordCount = (await DnsRecordDoc.findByDomainId(domainId)).filter((record) => (
+      record.managedBy === 'mail-dns-reconciler'
+    )).length;
+    return { emailDomains, managedRecordCount };
+  }
+
+  private managedMailDnsReferenceMessage(
+    domainName: string,
+    references: { emailDomains: EmailDomainDoc[]; managedRecordCount: number },
+  ): string {
+    return `DNS domain ${domainName} is referenced by ${references.emailDomains.length} managed email domain(s) and ${references.managedRecordCount} managed mail DNS record(s); delete those email domains first`;
+  }
+
   /**
    * Force-resync a provider-managed domain: re-pull all records from the
    * provider API, replacing the cached DnsRecordDocs.
@@ -992,8 +1070,12 @@ export class DnsManager {
       return { success: false, message: 'Provider client unavailable' };
     }
     let providerRecords: IProviderRecord[];
+    let allProviderIds: string[];
     try {
-      providerRecords = await client.listRecords(doc.name);
+      [providerRecords, allProviderIds] = await Promise.all([
+        client.listRecords(doc.name),
+        client.listRecordIds(doc.name),
+      ]);
     } catch (error: unknown) {
       return { success: false, message: `Provider list failed: ${(error as Error).message}` };
     }
@@ -1004,6 +1086,17 @@ export class DnsManager {
     if (new Set(providerIds).size !== providerIds.length) {
       return { success: false, message: 'Provider returned duplicate provider record ids' };
     }
+    allProviderIds = allProviderIds.map((providerId) => providerId.trim());
+    if (allProviderIds.some((providerId) => !providerId)) {
+      return { success: false, message: 'Provider returned a record without a non-empty provider id' };
+    }
+    if (new Set(allProviderIds).size !== allProviderIds.length) {
+      return { success: false, message: 'Provider returned duplicate provider record ids' };
+    }
+    const allProviderIdSet = new Set(allProviderIds);
+    if (providerIds.some((providerId) => !allProviderIdSet.has(providerId))) {
+      return { success: false, message: 'Provider record listings returned inconsistent record ids' };
+    }
 
     // Provider ids are the only identity proof. Tuple matching could adopt an
     // operator replacement and transfer reconciler ownership to the wrong row.
@@ -1064,7 +1157,7 @@ export class DnsManager {
     return {
       success: true,
       recordCount: providerRecords.length,
-      listedProviderRecordIds: providerIds,
+      listedProviderRecordIds: allProviderIds,
     };
   }
 
@@ -1094,20 +1187,29 @@ export class DnsManager {
     targetProviderId?: string;
     deleteExistingProviderRecords?: boolean;
   }): Promise<{ success: boolean; recordsMigrated?: number; message?: string }> {
-    const domain = await DomainDoc.findById(args.id);
-    if (!domain) return { success: false, message: 'Domain not found' };
+    return await this.runManagedMailDnsMutationExclusive(async () => {
+      const domain = await DomainDoc.findById(args.id);
+      if (!domain) return { success: false, message: 'Domain not found' };
 
-    if (domain.source === args.targetSource && domain.providerId === args.targetProviderId) {
-      return { success: false, message: 'Domain is already in the target configuration' };
-    }
-
-    const records = await DnsRecordDoc.findByDomainId(domain.id);
+      const references = await this.getManagedMailDnsReferences(domain.id);
+      if (references.emailDomains.length > 0 || references.managedRecordCount > 0) {
+        return { success: false, message: this.managedMailDnsReferenceMessage(domain.name, references) };
+      }
+      if (domain.source === args.targetSource && domain.providerId === args.targetProviderId) {
+        return { success: false, message: 'Domain is already in the target configuration' };
+      }
 
-    if (args.targetSource === 'provider') {
-      return this.migrateToDnsProvider(domain, records, args.targetProviderId!, args.deleteExistingProviderRecords ?? false);
-    } else {
-      return this.migrateToDcrouter(domain, records);
-    }
+      const records = await DnsRecordDoc.findByDomainId(domain.id);
+      if (args.targetSource === 'provider') {
+        return await this.migrateToDnsProvider(
+          domain,
+          records,
+          args.targetProviderId!,
+          args.deleteExistingProviderRecords ?? false,
+        );
+      }
+      return await this.migrateToDcrouter(domain, records);
+    });
   }
 
   /**
@@ -1345,6 +1447,7 @@ export class DnsManager {
   public async updateRecord(args: {
     id: string;
     name?: string;
+    type?: TDnsRecordType;
     value?: string;
     ttl?: number;
     proxied?: boolean;
@@ -1357,6 +1460,7 @@ export class DnsManager {
     const previousName = doc.name;
     const previousType = doc.type;
     if (args.name !== undefined) doc.name = args.name.toLowerCase();
+    if (args.type !== undefined) doc.type = args.type;
     if (args.value !== undefined) doc.value = args.value;
     if (args.ttl !== undefined) doc.ttl = args.ttl;
     if (args.proxied !== undefined) doc.proxied = args.proxied;
@@ -1384,7 +1488,7 @@ export class DnsManager {
     await doc.save();
     if (domain.source === 'dcrouter') {
       await this.refreshLocalRrset(doc.domainId, previousName, previousType);
-      if (previousName.toLowerCase() !== doc.name.toLowerCase()) {
+      if (previousName.toLowerCase() !== doc.name.toLowerCase() || previousType !== doc.type) {
         await this.refreshLocalRrset(doc.domainId, doc.name, doc.type);
       }
     }
@@ -1392,30 +1496,126 @@ export class DnsManager {
   }
 
   public async deleteRecord(id: string): Promise<{ success: boolean; message?: string }> {
-    const doc = await DnsRecordDoc.findById(id);
-    if (!doc) return { success: false, message: 'Record not found' };
-    const domain = await DomainDoc.findById(doc.domainId);
-    if (!domain) return { success: false, message: 'Parent domain not found' };
+    const [result] = await this.deleteRecords([id]);
+    return result.message
+      ? { success: result.success, message: result.message }
+      : { success: result.success };
+  }
 
-    if (domain.source === 'provider') {
-      if (!domain.providerId || !doc.providerRecordId) {
-        return { success: false, message: 'Provider record metadata missing' };
+  public async deleteRecords(ids: string[]): Promise<IDnsRecordDeleteResult[]> {
+    const results = new Map<string, IDnsRecordDeleteResult>();
+    const providerGroups = new Map<string, {
+      domain: DomainDoc;
+      client: IDnsProviderClient;
+      records: DnsRecordDoc[];
+    }>();
+
+    for (const id of [...new Set(ids)]) {
+      const doc = await DnsRecordDoc.findById(id);
+      if (!doc) {
+        results.set(id, { id, success: false, message: 'Record not found' });
+        continue;
       }
-      const client = await this.getProviderClientById(domain.providerId);
-      if (!client) {
-        return { success: false, message: 'Provider client unavailable' };
+      const domain = await DomainDoc.findById(doc.domainId);
+      if (!domain) {
+        results.set(id, { id, success: false, message: 'Parent domain not found' });
+        continue;
       }
-      try {
-        await client.deleteRecord(domain.name, doc.providerRecordId);
-      } catch (err: unknown) {
-        return { success: false, message: `Provider rejected delete: ${(err as Error).message}` };
+      if (domain.source !== 'provider') {
+        await doc.delete();
+        await this.refreshLocalRrset(doc.domainId, doc.name, doc.type);
+        results.set(id, { id, success: true });
+        continue;
+      }
+      if (!domain.providerId || !doc.providerRecordId?.trim()) {
+        results.set(id, { id, success: false, message: 'Provider record metadata missing' });
+        continue;
+      }
+      let group = providerGroups.get(domain.id);
+      if (!group) {
+        const client = await this.getProviderClientById(domain.providerId);
+        if (!client) {
+          results.set(id, { id, success: false, message: 'Provider client unavailable' });
+          continue;
+        }
+        group = { domain, client, records: [] };
+        providerGroups.set(domain.id, group);
       }
+      group.records.push(doc);
     }
-    await doc.delete();
-    if (domain.source === 'dcrouter') {
-      await this.refreshLocalRrset(doc.domainId, doc.name, doc.type);
+
+    for (const { domain, client, records } of providerGroups.values()) {
+      const deleteErrors = new Map<string, Error>();
+      for (const record of records) {
+        try {
+          await client.deleteRecord(domain.name, record.providerRecordId!);
+        } catch (error: unknown) {
+          deleteErrors.set(record.id, error instanceof Error ? error : new Error(String(error)));
+        }
+      }
+
+      let providerRecordIds: string[] | undefined;
+      let providerListError: Error | undefined;
+      try {
+        providerRecordIds = (await client.listRecordIds(domain.name)).map((providerRecordId) => (
+          providerRecordId.trim()
+        ));
+      } catch (error: unknown) {
+        providerListError = error instanceof Error ? error : new Error(String(error));
+      }
+      const invalidListingMessage = providerRecordIds?.some((providerRecordId) => !providerRecordId)
+        ? 'Provider deletion could not be confirmed: provider returned an empty record id'
+        : providerRecordIds && new Set(providerRecordIds).size !== providerRecordIds.length
+          ? 'Provider deletion could not be confirmed: provider returned duplicate record ids'
+          : undefined;
+      const listedIds = providerRecordIds && !invalidListingMessage
+        ? new Set(providerRecordIds)
+        : undefined;
+      for (const record of records) {
+        const providerRecordId = record.providerRecordId!.trim();
+        const deleteError = deleteErrors.get(record.id);
+        if (deleteError && this.isProviderRecordNotFoundError(deleteError)) {
+          await record.delete();
+          results.set(record.id, { id: record.id, success: true });
+          continue;
+        }
+        if (providerListError) {
+          results.set(record.id, {
+            id: record.id,
+            success: false,
+            message: `Provider deletion could not be confirmed: ${providerListError.message}`,
+          });
+          continue;
+        }
+        if (invalidListingMessage || !listedIds) {
+          results.set(record.id, {
+            id: record.id,
+            success: false,
+            message: invalidListingMessage || 'Provider deletion could not be confirmed',
+          });
+          continue;
+        }
+        if (listedIds.has(providerRecordId)) {
+          results.set(record.id, {
+            id: record.id,
+            success: false,
+            message: deleteError
+              ? `Provider rejected delete and still lists the record: ${deleteError.message}`
+              : 'Provider accepted delete but still lists the record',
+          });
+          continue;
+        }
+        await record.delete();
+        results.set(record.id, { id: record.id, success: true });
+      }
     }
-    return { success: true };
+
+    return ids.map((id) => results.get(id) || { id, success: false, message: 'Record deletion was not evaluated' });
+  }
+
+  private isProviderRecordNotFoundError(error: Error): boolean {
+    const providerError = error as Error & { status?: unknown; statusCode?: unknown };
+    return providerError.status === 404 || providerError.statusCode === 404;
   }
 
   /**