@serve.zone/dcrouter 32.6.3 → 32.7.0

package/dist_ts/email/classes.email-tls-manager.js

@@ -0,0 +1,321 @@
+import * as plugins from '../plugins.js';
+import { logger } from '../logger.js';
+import { ProxyCertDoc } from '../db/index.js';
+/** Whether `emailConfig.tls` carries operator-managed certificate material. */
+export const hasConfiguredEmailTlsMaterial = (tlsArg) => Boolean(tlsArg?.certPem || tlsArg?.keyPem || tlsArg?.certPath || tlsArg?.keyPath);
+/**
+ * Source for settings persisted without one: the material they served before
+ * the source existed — configured material when present, otherwise the
+ * managed certificate.
+ */
+export const deriveEmailTlsSource = (tlsArg) => hasConfiguredEmailTlsMaterial(tlsArg) ? 'configuredMaterial' : 'managedCertificate';
+/** The `tls` block without certificate material; undefined when nothing else remains. */
+export const withoutConfiguredEmailTlsMaterial = (tlsArg) => {
+    if (!tlsArg)
+        return undefined;
+    const { certPem, keyPem, certPath, keyPath, ...remaining } = tlsArg;
+    return Object.keys(remaining).length > 0 ? remaining : undefined;
+};
+/** The `tls` block handed to SmartMTA: configured options plus the resolved PEM material. */
+export const composeEmailServerTls = (tlsArg, materialArg) => {
+    const options = withoutConfiguredEmailTlsMaterial(tlsArg);
+    if (!materialArg)
+        return options;
+    return { ...options, certPem: materialArg.certPem, keyPem: materialArg.keyPem };
+};
+const describeError = (errorArg) => errorArg instanceof Error ? errorArg.message : String(errorArg);
+const normalizeHostname = (hostnameArg) => hostnameArg.trim().toLowerCase().replace(/\.$/, '');
+/** DNS subject alternative names of a certificate, lowercased. */
+export const getCertificateDnsNames = (certificateArg) => (certificateArg.subjectAltName || '')
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.startsWith('DNS:'))
+    .map((entry) => normalizeHostname(entry.slice('DNS:'.length).replace(/^"|"$/g, '')));
+/**
+ * RFC 6125 name matching: exact, or a `*.` wildcard standing for exactly one
+ * left-most label. Implemented here because X509Certificate.checkHost does not
+ * match wildcards on every runtime dcrouter ships on.
+ */
+export const certificateNameCovers = (nameArg, hostnameArg) => {
+    const hostname = normalizeHostname(hostnameArg);
+    if (nameArg === hostname)
+        return true;
+    if (!nameArg.startsWith('*.'))
+        return false;
+    const firstDot = hostname.indexOf('.');
+    return firstDot > 0 && hostname.slice(firstDot + 1) === nameArg.slice(2);
+};
+const findUncoveredHostnames = (namesArg, hostnamesArg) => hostnamesArg.filter((hostname) => !namesArg.some((name) => certificateNameCovers(name, hostname)));
+const parseCertificate = (certPemArg) => new plugins.crypto.X509Certificate(certPemArg);
+const isCurrentlyValid = (certificateArg, nowArg) => certificateArg.validFromDate.getTime() <= nowArg && nowArg < certificateArg.validToDate.getTime();
+/**
+ * Owns the SMTP listener's certificate: resolves it from the selected source
+ * on every listener start and relevant renewal, and reports what is served.
+ *
+ * Resolved material is held here and never written back into the email
+ * configuration, so every resolution reads the source of truth again.
+ */
+export class EmailTlsManager {
+    served;
+    /** Resolve the listener material from the selected source and record it as served. */
+    async resolve(requestArg) {
+        const material = requestArg.source === 'configuredMaterial'
+            ? await this.resolveConfiguredMaterial(requestArg.tls)
+            : await this.resolveManagedCertificate(requestArg.requiredHostnames);
+        const status = this.getStatus(requestArg.requiredHostnames);
+        if (status && status.problems.length > 0) {
+            logger.log('error', `SMTP TLS certificate problem (source=${status.source}, origin=${status.origin ?? 'none'}): ${status.problems.join('; ')}`);
+        }
+        else if (status) {
+            logger.log('info', `SMTP TLS certificate: source=${status.source}, origin=${status.origin}, notAfter=${status.notAfter === null ? 'unknown' : new Date(status.notAfter).toISOString()}, names=[${status.names.join(', ')}]`);
+        }
+        return material;
+    }
+    /**
+     * Push an issued or renewed certificate to the running listener when it can
+     * change what the listener should serve. Returns the applied material.
+     */
+    async applyIssuance(domainArg, listenerArg, requestArg) {
+        if (!(await this.isRelevantIssuance(domainArg, requestArg.requiredHostnames)))
+            return undefined;
+        const material = await this.resolve(requestArg);
+        if (!material)
+            return undefined;
+        listenerArg.updateOptions({ tls: composeEmailServerTls(requestArg.tls, material) });
+        return material;
+    }
+    /** Forget the served certificate (the listener is stopped). */
+    clear() {
+        this.served = undefined;
+    }
+    /**
+     * Whether an issued or renewed certificate can change what the listener
+     * should serve. Only the managed source follows issuance; the stored
+     * certificate is keyed by the requested route domain, so a wildcard or
+     * sibling issuance is matched by the names it covers, not by its key.
+     */
+    async isRelevantIssuance(domainArg, requiredHostnamesArg) {
+        const served = this.served;
+        if (!served || served.source !== 'managedCertificate')
+            return false;
+        const domain = normalizeHostname(domainArg);
+        if (served.storedDomain !== null && normalizeHostname(served.storedDomain) === domain)
+            return true;
+        if (requiredHostnamesArg.some((hostname) => normalizeHostname(hostname) === domain))
+            return true;
+        const stored = await ProxyCertDoc.findByDomain(domainArg);
+        if (!stored?.publicKey)
+            return false;
+        try {
+            const names = getCertificateDnsNames(parseCertificate(stored.publicKey));
+            return findUncoveredHostnames(names, requiredHostnamesArg).length < requiredHostnamesArg.length;
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * The best stored certificate for the required hostnames: currently valid
+     * and covering every name first, then valid, then the most names covered,
+     * then the latest expiry. Undefined when none covers any required hostname.
+     */
+    async selectStoredCertificate(requiredHostnamesArg, nowArg = Date.now()) {
+        const candidates = [];
+        for (const doc of await ProxyCertDoc.findAll()) {
+            if (!doc.publicKey || !doc.privateKey)
+                continue;
+            let certificate;
+            try {
+                certificate = parseCertificate(doc.publicKey);
+            }
+            catch {
+                continue;
+            }
+            const names = getCertificateDnsNames(certificate);
+            const uncoveredHostnames = findUncoveredHostnames(names, requiredHostnamesArg);
+            if (uncoveredHostnames.length === requiredHostnamesArg.length)
+                continue;
+            candidates.push({
+                domain: doc.domain,
+                certPem: doc.publicKey,
+                keyPem: doc.privateKey,
+                certificate,
+                names,
+                uncoveredHostnames,
+                currentlyValid: isCurrentlyValid(certificate, nowArg),
+            });
+        }
+        const rank = (candidateArg) => [
+            candidateArg.currentlyValid && candidateArg.uncoveredHostnames.length === 0 ? 1 : 0,
+            candidateArg.currentlyValid ? 1 : 0,
+            -candidateArg.uncoveredHostnames.length,
+            candidateArg.certificate.validToDate.getTime(),
+        ];
+        candidates.sort((left, right) => {
+            const leftRank = rank(left);
+            const rightRank = rank(right);
+            for (let index = 0; index < leftRank.length; index++) {
+                if (leftRank[index] !== rightRank[index])
+                    return rightRank[index] - leftRank[index];
+            }
+            return left.domain.localeCompare(right.domain);
+        });
+        return candidates[0];
+    }
+    /**
+     * Gate for switching to the managed source: refuses unless a currently
+     * valid stored certificate covers every required hostname.
+     */
+    async assertManagedCertificateAvailable(requiredHostnamesArg) {
+        const stored = await this.selectStoredCertificate(requiredHostnamesArg);
+        if (stored?.currentlyValid && stored.uncoveredHostnames.length === 0)
+            return stored;
+        const closest = !stored
+            ? ''
+            : stored.currentlyValid
+                ? ` The closest stored certificate '${stored.domain}' does not cover ${stored.uncoveredHostnames.join(', ')}.`
+                : ` The closest stored certificate '${stored.domain}' is outside its validity period (notAfter ${stored.certificate.validToDate.toISOString()}).`;
+        throw new Error(`Refusing the managedCertificate email TLS source: no currently valid stored certificate covers ${requiredHostnamesArg.join(', ')}.${closest}`);
+    }
+    /**
+     * The served certificate checked against the required hostnames now, so
+     * expiry while running shows up without a new resolution.
+     */
+    getStatus(requiredHostnamesArg, nowArg = Date.now()) {
+        const served = this.served;
+        if (!served)
+            return undefined;
+        const problems = [...served.materialProblems];
+        const certificate = served.certificate;
+        if (certificate) {
+            const notBefore = certificate.validFromDate.getTime();
+            const notAfter = certificate.validToDate.getTime();
+            if (nowArg >= notAfter) {
+                problems.push(`certificate expired at ${new Date(notAfter).toISOString()}`);
+            }
+            else if (nowArg < notBefore) {
+                problems.push(`certificate is not valid before ${new Date(notBefore).toISOString()}`);
+            }
+            const uncovered = findUncoveredHostnames(served.names, requiredHostnamesArg);
+            if (uncovered.length > 0) {
+                problems.push(`certificate does not cover ${uncovered.join(', ')}`);
+            }
+        }
+        return {
+            source: served.source,
+            origin: served.origin,
+            names: [...served.names],
+            notBefore: certificate ? certificate.validFromDate.getTime() : null,
+            notAfter: certificate ? certificate.validToDate.getTime() : null,
+            requiredHostnames: [...requiredHostnamesArg],
+            problems,
+            checkedAt: nowArg,
+        };
+    }
+    /**
+     * Operator-managed material. Paths that cannot be read FAIL listener
+     * startup: continuing without TLS is what once produced a cleartext
+     * submission port, so a broken explicit configuration must be impossible
+     * to miss.
+     */
+    async resolveConfiguredMaterial(tlsArg) {
+        let material;
+        if (tlsArg?.certPem && tlsArg.keyPem) {
+            material = { certPem: tlsArg.certPem, keyPem: tlsArg.keyPem, origin: 'inline PEM' };
+        }
+        else if (tlsArg?.certPath || tlsArg?.keyPath) {
+            if (!tlsArg.certPath || !tlsArg.keyPath) {
+                throw new Error('emailConfig.tls requires both certPath and keyPath when either is configured');
+            }
+            let certPem;
+            let keyPem;
+            try {
+                certPem = await plugins.fs.promises.readFile(tlsArg.certPath, 'utf8');
+                keyPem = await plugins.fs.promises.readFile(tlsArg.keyPath, 'utf8');
+            }
+            catch (error) {
+                throw new Error(`Unable to read the configured SMTP TLS material (certPath=${tlsArg.certPath}, keyPath=${tlsArg.keyPath}): ${describeError(error)}`);
+            }
+            if (!certPem.trim() || !keyPem.trim()) {
+                throw new Error(`The configured SMTP TLS material is empty (certPath=${tlsArg.certPath}, keyPath=${tlsArg.keyPath})`);
+            }
+            material = { certPem, keyPem, origin: `configured paths (${tlsArg.certPath})` };
+        }
+        else if (tlsArg?.certPem || tlsArg?.keyPem) {
+            throw new Error('emailConfig.tls requires both certPem and keyPem when either is configured');
+        }
+        if (!material) {
+            this.served = {
+                source: 'configuredMaterial',
+                origin: null,
+                storedDomain: null,
+                certificate: null,
+                names: [],
+                materialProblems: ['the configuredMaterial source is selected but emailConfig.tls carries no certificate material'],
+            };
+            return undefined;
+        }
+        const materialProblems = [];
+        let certificate = null;
+        try {
+            certificate = parseCertificate(material.certPem);
+        }
+        catch (error) {
+            materialProblems.push(`certificate cannot be parsed: ${describeError(error)}`);
+        }
+        if (certificate) {
+            materialProblems.push(...this.checkKeyPair(certificate, material.keyPem));
+        }
+        this.served = {
+            source: 'configuredMaterial',
+            origin: material.origin,
+            storedDomain: null,
+            certificate,
+            names: certificate ? getCertificateDnsNames(certificate) : [],
+            materialProblems,
+        };
+        return material;
+    }
+    async resolveManagedCertificate(requiredHostnamesArg) {
+        let stored;
+        let lookupProblem;
+        try {
+            stored = await this.selectStoredCertificate(requiredHostnamesArg);
+        }
+        catch (error) {
+            lookupProblem = `stored certificates cannot be read: ${describeError(error)}`;
+        }
+        if (!stored) {
+            this.served = {
+                source: 'managedCertificate',
+                origin: null,
+                storedDomain: null,
+                certificate: null,
+                names: [],
+                materialProblems: [lookupProblem ?? `no stored certificate covers ${requiredHostnamesArg.join(', ')}`],
+            };
+            return undefined;
+        }
+        const origin = `stored certificate '${stored.domain}'`;
+        this.served = {
+            source: 'managedCertificate',
+            origin,
+            storedDomain: stored.domain,
+            certificate: stored.certificate,
+            names: stored.names,
+            materialProblems: this.checkKeyPair(stored.certificate, stored.keyPem),
+        };
+        return { certPem: stored.certPem, keyPem: stored.keyPem, origin };
+    }
+    checkKeyPair(certificateArg, keyPemArg) {
+        try {
+            return certificateArg.checkPrivateKey(plugins.crypto.createPrivateKey(keyPemArg))
+                ? []
+                : ['private key does not match the certificate'];
+        }
+        catch (error) {
+            return [`private key cannot be parsed: ${describeError(error)}`];
+        }
+    }
+}
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiY2xhc3Nlcy5lbWFpbC10bHMtbWFuYWdlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uL3RzL2VtYWlsL2NsYXNzZXMuZW1haWwtdGxzLW1hbmFnZXIudHMiXSwibmFtZXMiOltdLCJtYXBwaW5ncyI6IkFBQ0EsT0FBTyxLQUFLLE9BQU8sTUFBTSxlQUFlLENBQUM7QUFDekMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLGNBQWMsQ0FBQztBQUN0QyxPQUFPLEVBQUUsWUFBWSxFQUFFLE1BQU0sZ0JBQWdCLENBQUM7QUE4QzlDLCtFQUErRTtBQUMvRSxNQUFNLENBQUMsTUFBTSw2QkFBNkIsR0FBRyxDQUFDLE1BQTJDLEVBQVcsRUFBRSxDQUNwRyxPQUFPLENBQUMsTUFBTSxFQUFFLE9BQU8sSUFBSSxNQUFNLEVBQUUsTUFBTSxJQUFJLE1BQU0sRUFBRSxRQUFRLElBQUksTUFBTSxFQUFFLE9BQU8sQ0FBQyxDQUFDO0FBRXBGOzs7O0dBSUc7QUFDSCxNQUFNLENBQUMsTUFBTSxvQkFBb0IsR0FBRyxDQUFDLE1BQTJDLEVBQW1CLEVBQUUsQ0FDbkcsNkJBQTZCLENBQUMsTUFBTSxDQUFDLENBQUMsQ0FBQyxDQUFDLG9CQUFvQixDQUFDLENBQUMsQ0FBQyxvQkFBb0IsQ0FBQztBQUV0Rix5RkFBeUY7QUFDekYsTUFBTSxDQUFDLE1BQU0saUNBQWlDLEdBQUcsQ0FDL0MsTUFBMkMsRUFDTixFQUFFO0lBQ3ZDLElBQUksQ0FBQyxNQUFNO1FBQUUsT0FBTyxTQUFTLENBQUM7SUFDOUIsTUFBTSxFQUFFLE9BQU8sRUFBRSxNQUFNLEVBQUUsUUFBUSxFQUFFLE9BQU8sRUFBRSxHQUFHLFNBQVMsRUFBRSxHQUFHLE1BQU0sQ0FBQztJQUNwRSxPQUFPLE1BQU0sQ0FBQyxJQUFJLENBQUMsU0FBUyxDQUFDLENBQUMsTUFBTSxHQUFHLENBQUMsQ0FBQyxDQUFDLENBQUMsU0FBUyxDQUFDLENBQUMsQ0FBQyxTQUFTLENBQUM7QUFDbkUsQ0FBQyxDQUFDO0FBRUYsNkZBQTZGO0FBQzdGLE1BQU0sQ0FBQyxNQUFNLHFCQUFxQixHQUFHLENBQ25DLE1BQTJDLEVBQzNDLFdBQTBDLEVBQ0wsRUFBRTtJQUN2QyxNQUFNLE9BQU8sR0FBRyxpQ0FBaUMsQ0FBQyxNQUFNLENBQUMsQ0FBQztJQUMxRCxJQUFJLENBQUMsV0FBVztRQUFFLE9BQU8sT0FBTyxDQUFDO0lBQ2pDLE9BQU8sRUFBRSxHQUFHLE9BQU8sRUFBRSxPQUFPLEVBQUUsV0FBVyxDQUFDLE9BQU8sRUFBRSxNQUFNLEVBQUUsV0FBVyxDQUFDLE1BQU0sRUFBRSxDQUFDO0FBQ2xGLENBQUMsQ0FBQztBQUVGLE1BQU0sYUFBYSxHQUFHLENBQUMsUUFBaUIsRUFBVSxFQUFFLENBQ2xELFFBQVEsWUFBWSxLQUFLLENBQUMsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQyxDQUFDLE1BQU0sQ0FBQyxRQUFRLENBQUMsQ0FBQztBQUVsRSxNQUFNLGlCQUFpQixHQUFHLENBQUMsV0FBbUIsRUFBVSxFQUFFLENBQ3hELFdBQVcsQ0FBQyxJQUFJLEVBQUUsQ0FBQyxXQUFXLEVBQUUsQ0FBQyxPQUFPLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxDQUFDO0FBRXRELGtFQUFrRTtBQUNsRSxNQUFNLENBQUMsTUFBTSxzQkFBc0IsR0FBRyxDQUFDLGNBQThDLEVBQVksRUFBRSxDQUNqRyxDQUFDLGNBQWMsQ0FBQyxjQUFjLElBQUksRUFBRSxDQUFDO0tBQ2xDLEtBQUssQ0FBQyxHQUFHLENBQUM7S0FDVixHQUFHLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxJQUFJLEVBQUUsQ0FBQztLQUM1QixNQUFNLENBQUMsQ0FBQyxLQUFLLEVBQUUsRUFBRSxDQUFDLEtBQUssQ0FBQyxVQUFVLENBQUMsTUFBTSxDQUFDLENBQUM7S0FDM0MsR0FBRyxDQUFDLENBQUMsS0FBSyxFQUFFLEVBQUUsQ0FBQyxpQkFBaUIsQ0FBQyxLQUFLLENBQUMsS0FBSyxDQUFDLE1BQU0sQ0FBQyxNQUFNLENBQUMsQ0FBQyxPQUFPLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLENBQUMsQ0FBQztBQUV6Rjs7OztHQUlHO0FBQ0gsTUFBTSxDQUFDLE1BQU0scUJBQXFCLEdBQUcsQ0FBQyxPQUFlLEVBQUUsV0FBbUIsRUFBVyxFQUFFO0lBQ3JGLE1BQU0sUUFBUSxHQUFHLGlCQUFpQixDQUFDLFdBQVcsQ0FBQyxDQUFDO0lBQ2hELElBQUksT0FBTyxLQUFLLFFBQVE7UUFBRSxPQUFPLElBQUksQ0FBQztJQUN0QyxJQUFJLENBQUMsT0FBTyxDQUFDLFVBQVUsQ0FBQyxJQUFJLENBQUM7UUFBRSxPQUFPLEtBQUssQ0FBQztJQUM1QyxNQUFNLFFBQVEsR0FBRyxRQUFRLENBQUMsT0FBTyxDQUFDLEdBQUcsQ0FBQyxDQUFDO0lBQ3ZDLE9BQU8sUUFBUSxHQUFHLENBQUMsSUFBSSxRQUFRLENBQUMsS0FBSyxDQUFDLFFBQVEsR0FBRyxDQUFDLENBQUMsS0FBSyxPQUFPLENBQUMsS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDO0FBQzNFLENBQUMsQ0FBQztBQUVGLE1BQU0sc0JBQXNCLEdBQUcsQ0FBQyxRQUFrQixFQUFFLFlBQXNCLEVBQVksRUFBRSxDQUN0RixZQUFZLENBQUMsTUFBTSxDQUFDLENBQUMsUUFBUSxFQUFFLEVBQUUsQ0FBQyxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDLHFCQUFxQixDQUFDLElBQUksRUFBRSxRQUFRLENBQUMsQ0FBQyxDQUFDLENBQUM7QUFFckcsTUFBTSxnQkFBZ0IsR0FBRyxDQUFDLFVBQWtCLEVBQWtDLEVBQUUsQ0FBQyxJQUFJLE9BQU8sQ0FBQyxNQUFNLENBQUMsZUFBZSxDQUFDLFVBQVUsQ0FBQyxDQUFDO0FBRWhJLE1BQU0sZ0JBQWdCLEdBQUcsQ0FBQyxjQUE4QyxFQUFFLE1BQWMsRUFBVyxFQUFFLENBQ25HLGNBQWMsQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLElBQUksTUFBTSxJQUFJLE1BQU0sR0FBRyxjQUFjLENBQUMsV0FBVyxDQUFDLE9BQU8sRUFBRSxDQUFDO0FBRXBHOzs7Ozs7R0FNRztBQUNILE1BQU0sT0FBTyxlQUFlO0lBQ2xCLE1BQU0sQ0FBOEI7SUFFNUMsc0ZBQXNGO0lBQy9FLEtBQUssQ0FBQyxPQUFPLENBQUMsVUFBNEI7UUFDL0MsTUFBTSxRQUFRLEdBQUcsVUFBVSxDQUFDLE1BQU0sS0FBSyxvQkFBb0I7WUFDekQsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxHQUFHLENBQUM7WUFDdEQsQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLHlCQUF5QixDQUFDLFVBQVUsQ0FBQyxpQkFBaUIsQ0FBQyxDQUFDO1FBRXZFLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxTQUFTLENBQUMsVUFBVSxDQUFDLGlCQUFpQixDQUFDLENBQUM7UUFDNUQsSUFBSSxNQUFNLElBQUksTUFBTSxDQUFDLFFBQVEsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7WUFDekMsTUFBTSxDQUFDLEdBQUcsQ0FDUixPQUFPLEVBQ1Asd0NBQXdDLE1BQU0sQ0FBQyxNQUFNLFlBQVksTUFBTSxDQUFDLE1BQU0sSUFBSSxNQUFNLE1BQU0sTUFBTSxDQUFDLFFBQVEsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FDM0gsQ0FBQztRQUNKLENBQUM7YUFBTSxJQUFJLE1BQU0sRUFBRSxDQUFDO1lBQ2xCLE1BQU0sQ0FBQyxHQUFHLENBQ1IsTUFBTSxFQUNOLGdDQUFnQyxNQUFNLENBQUMsTUFBTSxZQUFZLE1BQU0sQ0FBQyxNQUFNLGNBQWMsTUFBTSxDQUFDLFFBQVEsS0FBSyxJQUFJLENBQUMsQ0FBQyxDQUFDLFNBQVMsQ0FBQyxDQUFDLENBQUMsSUFBSSxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFdBQVcsRUFBRSxZQUFZLE1BQU0sQ0FBQyxLQUFLLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxHQUFHLENBQ3pNLENBQUM7UUFDSixDQUFDO1FBQ0QsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUVEOzs7T0FHRztJQUNJLEtBQUssQ0FBQyxhQUFhLENBQ3hCLFNBQWlCLEVBQ2pCLFdBQThCLEVBQzlCLFVBQTRCO1FBRTVCLElBQUksQ0FBQyxDQUFDLE1BQU0sSUFBSSxDQUFDLGtCQUFrQixDQUFDLFNBQVMsRUFBRSxVQUFVLENBQUMsaUJBQWlCLENBQUMsQ0FBQztZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ2hHLE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLE9BQU8sQ0FBQyxVQUFVLENBQUMsQ0FBQztRQUNoRCxJQUFJLENBQUMsUUFBUTtZQUFFLE9BQU8sU0FBUyxDQUFDO1FBQ2hDLFdBQVcsQ0FBQyxhQUFhLENBQUMsRUFBRSxHQUFHLEVBQUUscUJBQXFCLENBQUMsVUFBVSxDQUFDLEdBQUcsRUFBRSxRQUFRLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDcEYsT0FBTyxRQUFRLENBQUM7SUFDbEIsQ0FBQztJQUVELCtEQUErRDtJQUN4RCxLQUFLO1FBQ1YsSUFBSSxDQUFDLE1BQU0sR0FBRyxTQUFTLENBQUM7SUFDMUIsQ0FBQztJQUVEOzs7OztPQUtHO0lBQ0ksS0FBSyxDQUFDLGtCQUFrQixDQUFDLFNBQWlCLEVBQUUsb0JBQThCO1FBQy9FLE1BQU0sTUFBTSxHQUFHLElBQUksQ0FBQyxNQUFNLENBQUM7UUFDM0IsSUFBSSxDQUFDLE1BQU0sSUFBSSxNQUFNLENBQUMsTUFBTSxLQUFLLG9CQUFvQjtZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3BFLE1BQU0sTUFBTSxHQUFHLGlCQUFpQixDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzVDLElBQUksTUFBTSxDQUFDLFlBQVksS0FBSyxJQUFJLElBQUksaUJBQWlCLENBQUMsTUFBTSxDQUFDLFlBQVksQ0FBQyxLQUFLLE1BQU07WUFBRSxPQUFPLElBQUksQ0FBQztRQUNuRyxJQUFJLG9CQUFvQixDQUFDLElBQUksQ0FBQyxDQUFDLFFBQVEsRUFBRSxFQUFFLENBQUMsaUJBQWlCLENBQUMsUUFBUSxDQUFDLEtBQUssTUFBTSxDQUFDO1lBQUUsT0FBTyxJQUFJLENBQUM7UUFDakcsTUFBTSxNQUFNLEdBQUcsTUFBTSxZQUFZLENBQUMsWUFBWSxDQUFDLFNBQVMsQ0FBQyxDQUFDO1FBQzFELElBQUksQ0FBQyxNQUFNLEVBQUUsU0FBUztZQUFFLE9BQU8sS0FBSyxDQUFDO1FBQ3JDLElBQUksQ0FBQztZQUNILE1BQU0sS0FBSyxHQUFHLHNCQUFzQixDQUFDLGdCQUFnQixDQUFDLE1BQU0sQ0FBQyxTQUFTLENBQUMsQ0FBQyxDQUFDO1lBQ3pFLE9BQU8sc0JBQXNCLENBQUMsS0FBSyxFQUFFLG9CQUFvQixDQUFDLENBQUMsTUFBTSxHQUFHLG9CQUFvQixDQUFDLE1BQU0sQ0FBQztRQUNsRyxDQUFDO1FBQUMsTUFBTSxDQUFDO1lBQ1AsT0FBTyxLQUFLLENBQUM7UUFDZixDQUFDO0lBQ0gsQ0FBQztJQUVEOzs7O09BSUc7SUFDSSxLQUFLLENBQUMsdUJBQXVCLENBQ2xDLG9CQUE4QixFQUM5QixNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUVuQixNQUFNLFVBQVUsR0FBOEIsRUFBRSxDQUFDO1FBQ2pELEtBQUssTUFBTSxHQUFHLElBQUksTUFBTSxZQUFZLENBQUMsT0FBTyxFQUFFLEVBQUUsQ0FBQztZQUMvQyxJQUFJLENBQUMsR0FBRyxDQUFDLFNBQVMsSUFBSSxDQUFDLEdBQUcsQ0FBQyxVQUFVO2dCQUFFLFNBQVM7WUFDaEQsSUFBSSxXQUEyQyxDQUFDO1lBQ2hELElBQUksQ0FBQztnQkFDSCxXQUFXLEdBQUcsZ0JBQWdCLENBQUMsR0FBRyxDQUFDLFNBQVMsQ0FBQyxDQUFDO1lBQ2hELENBQUM7WUFBQyxNQUFNLENBQUM7Z0JBQ1AsU0FBUztZQUNYLENBQUM7WUFDRCxNQUFNLEtBQUssR0FBRyxzQkFBc0IsQ0FBQyxXQUFXLENBQUMsQ0FBQztZQUNsRCxNQUFNLGtCQUFrQixHQUFHLHNCQUFzQixDQUFDLEtBQUssRUFBRSxvQkFBb0IsQ0FBQyxDQUFDO1lBQy9FLElBQUksa0JBQWtCLENBQUMsTUFBTSxLQUFLLG9CQUFvQixDQUFDLE1BQU07Z0JBQUUsU0FBUztZQUN4RSxVQUFVLENBQUMsSUFBSSxDQUFDO2dCQUNkLE1BQU0sRUFBRSxHQUFHLENBQUMsTUFBTTtnQkFDbEIsT0FBTyxFQUFFLEdBQUcsQ0FBQyxTQUFTO2dCQUN0QixNQUFNLEVBQUUsR0FBRyxDQUFDLFVBQVU7Z0JBQ3RCLFdBQVc7Z0JBQ1gsS0FBSztnQkFDTCxrQkFBa0I7Z0JBQ2xCLGNBQWMsRUFBRSxnQkFBZ0IsQ0FBQyxXQUFXLEVBQUUsTUFBTSxDQUFDO2FBQ3RELENBQUMsQ0FBQztRQUNMLENBQUM7UUFDRCxNQUFNLElBQUksR0FBRyxDQUFDLFlBQXFDLEVBQVksRUFBRSxDQUFDO1lBQ2hFLFlBQVksQ0FBQyxjQUFjLElBQUksWUFBWSxDQUFDLGtCQUFrQixDQUFDLE1BQU0sS0FBSyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQztZQUNuRixZQUFZLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUMsQ0FBQyxDQUFDLENBQUM7WUFDbkMsQ0FBQyxZQUFZLENBQUMsa0JBQWtCLENBQUMsTUFBTTtZQUN2QyxZQUFZLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUU7U0FDL0MsQ0FBQztRQUNGLFVBQVUsQ0FBQyxJQUFJLENBQUMsQ0FBQyxJQUFJLEVBQUUsS0FBSyxFQUFFLEVBQUU7WUFDOUIsTUFBTSxRQUFRLEdBQUcsSUFBSSxDQUFDLElBQUksQ0FBQyxDQUFDO1lBQzVCLE1BQU0sU0FBUyxHQUFHLElBQUksQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUM5QixLQUFLLElBQUksS0FBSyxHQUFHLENBQUMsRUFBRSxLQUFLLEdBQUcsUUFBUSxDQUFDLE1BQU0sRUFBRSxLQUFLLEVBQUUsRUFBRSxDQUFDO2dCQUNyRCxJQUFJLFFBQVEsQ0FBQyxLQUFLLENBQUMsS0FBSyxTQUFTLENBQUMsS0FBSyxDQUFDO29CQUFFLE9BQU8sU0FBUyxDQUFDLEtBQUssQ0FBQyxHQUFHLFFBQVEsQ0FBQyxLQUFLLENBQUMsQ0FBQztZQUN0RixDQUFDO1lBQ0QsT0FBTyxJQUFJLENBQUMsTUFBTSxDQUFDLGFBQWEsQ0FBQyxLQUFLLENBQUMsTUFBTSxDQUFDLENBQUM7UUFDakQsQ0FBQyxDQUFDLENBQUM7UUFDSCxPQUFPLFVBQVUsQ0FBQyxDQUFDLENBQUMsQ0FBQztJQUN2QixDQUFDO0lBRUQ7OztPQUdHO0lBQ0ksS0FBSyxDQUFDLGlDQUFpQyxDQUFDLG9CQUE4QjtRQUMzRSxNQUFNLE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3hFLElBQUksTUFBTSxFQUFFLGNBQWMsSUFBSSxNQUFNLENBQUMsa0JBQWtCLENBQUMsTUFBTSxLQUFLLENBQUM7WUFBRSxPQUFPLE1BQU0sQ0FBQztRQUNwRixNQUFNLE9BQU8sR0FBRyxDQUFDLE1BQU07WUFDckIsQ0FBQyxDQUFDLEVBQUU7WUFDSixDQUFDLENBQUMsTUFBTSxDQUFDLGNBQWM7Z0JBQ3JCLENBQUMsQ0FBQyxvQ0FBb0MsTUFBTSxDQUFDLE1BQU0sb0JBQW9CLE1BQU0sQ0FBQyxrQkFBa0IsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEdBQUc7Z0JBQzlHLENBQUMsQ0FBQyxvQ0FBb0MsTUFBTSxDQUFDLE1BQU0sOENBQThDLE1BQU0sQ0FBQyxXQUFXLENBQUMsV0FBVyxDQUFDLFdBQVcsRUFBRSxJQUFJLENBQUM7UUFDdEosTUFBTSxJQUFJLEtBQUssQ0FDYixrR0FBa0csb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxJQUFJLE9BQU8sRUFBRSxDQUMvSSxDQUFDO0lBQ0osQ0FBQztJQUVEOzs7T0FHRztJQUNJLFNBQVMsQ0FBQyxvQkFBOEIsRUFBRSxNQUFNLEdBQUcsSUFBSSxDQUFDLEdBQUcsRUFBRTtRQUNsRSxNQUFNLE1BQU0sR0FBRyxJQUFJLENBQUMsTUFBTSxDQUFDO1FBQzNCLElBQUksQ0FBQyxNQUFNO1lBQUUsT0FBTyxTQUFTLENBQUM7UUFDOUIsTUFBTSxRQUFRLEdBQUcsQ0FBQyxHQUFHLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxDQUFDO1FBQzlDLE1BQU0sV0FBVyxHQUFHLE1BQU0sQ0FBQyxXQUFXLENBQUM7UUFDdkMsSUFBSSxXQUFXLEVBQUUsQ0FBQztZQUNoQixNQUFNLFNBQVMsR0FBRyxXQUFXLENBQUMsYUFBYSxDQUFDLE9BQU8sRUFBRSxDQUFDO1lBQ3RELE1BQU0sUUFBUSxHQUFHLFdBQVcsQ0FBQyxXQUFXLENBQUMsT0FBTyxFQUFFLENBQUM7WUFDbkQsSUFBSSxNQUFNLElBQUksUUFBUSxFQUFFLENBQUM7Z0JBQ3ZCLFFBQVEsQ0FBQyxJQUFJLENBQUMsMEJBQTBCLElBQUksSUFBSSxDQUFDLFFBQVEsQ0FBQyxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUMsQ0FBQztZQUM5RSxDQUFDO2lCQUFNLElBQUksTUFBTSxHQUFHLFNBQVMsRUFBRSxDQUFDO2dCQUM5QixRQUFRLENBQUMsSUFBSSxDQUFDLG1DQUFtQyxJQUFJLElBQUksQ0FBQyxTQUFTLENBQUMsQ0FBQyxXQUFXLEVBQUUsRUFBRSxDQUFDLENBQUM7WUFDeEYsQ0FBQztZQUNELE1BQU0sU0FBUyxHQUFHLHNCQUFzQixDQUFDLE1BQU0sQ0FBQyxLQUFLLEVBQUUsb0JBQW9CLENBQUMsQ0FBQztZQUM3RSxJQUFJLFNBQVMsQ0FBQyxNQUFNLEdBQUcsQ0FBQyxFQUFFLENBQUM7Z0JBQ3pCLFFBQVEsQ0FBQyxJQUFJLENBQUMsOEJBQThCLFNBQVMsQ0FBQyxJQUFJLENBQUMsSUFBSSxDQUFDLEVBQUUsQ0FBQyxDQUFDO1lBQ3RFLENBQUM7UUFDSCxDQUFDO1FBQ0QsT0FBTztZQUNMLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTTtZQUNyQixNQUFNLEVBQUUsTUFBTSxDQUFDLE1BQU07WUFDckIsS0FBSyxFQUFFLENBQUMsR0FBRyxNQUFNLENBQUMsS0FBSyxDQUFDO1lBQ3hCLFNBQVMsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLFdBQVcsQ0FBQyxhQUFhLENBQUMsT0FBTyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDbkUsUUFBUSxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUMsV0FBVyxDQUFDLFdBQVcsQ0FBQyxPQUFPLEVBQUUsQ0FBQyxDQUFDLENBQUMsSUFBSTtZQUNoRSxpQkFBaUIsRUFBRSxDQUFDLEdBQUcsb0JBQW9CLENBQUM7WUFDNUMsUUFBUTtZQUNSLFNBQVMsRUFBRSxNQUFNO1NBQ2xCLENBQUM7SUFDSixDQUFDO0lBRUQ7Ozs7O09BS0c7SUFDSyxLQUFLLENBQUMseUJBQXlCLENBQ3JDLE1BQTJDO1FBRTNDLElBQUksUUFBdUMsQ0FBQztRQUM1QyxJQUFJLE1BQU0sRUFBRSxPQUFPLElBQUksTUFBTSxDQUFDLE1BQU0sRUFBRSxDQUFDO1lBQ3JDLFFBQVEsR0FBRyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxZQUFZLEVBQUUsQ0FBQztRQUN0RixDQUFDO2FBQU0sSUFBSSxNQUFNLEVBQUUsUUFBUSxJQUFJLE1BQU0sRUFBRSxPQUFPLEVBQUUsQ0FBQztZQUMvQyxJQUFJLENBQUMsTUFBTSxDQUFDLFFBQVEsSUFBSSxDQUFDLE1BQU0sQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDeEMsTUFBTSxJQUFJLEtBQUssQ0FBQyw4RUFBOEUsQ0FBQyxDQUFDO1lBQ2xHLENBQUM7WUFDRCxJQUFJLE9BQWUsQ0FBQztZQUNwQixJQUFJLE1BQWMsQ0FBQztZQUNuQixJQUFJLENBQUM7Z0JBQ0gsT0FBTyxHQUFHLE1BQU0sT0FBTyxDQUFDLEVBQUUsQ0FBQyxRQUFRLENBQUMsUUFBUSxDQUFDLE1BQU0sQ0FBQyxRQUFRLEVBQUUsTUFBTSxDQUFDLENBQUM7Z0JBQ3RFLE1BQU0sR0FBRyxNQUFNLE9BQU8sQ0FBQyxFQUFFLENBQUMsUUFBUSxDQUFDLFFBQVEsQ0FBQyxNQUFNLENBQUMsT0FBTyxFQUFFLE1BQU0sQ0FBQyxDQUFDO1lBQ3RFLENBQUM7WUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO2dCQUN4QixNQUFNLElBQUksS0FBSyxDQUNiLDZEQUE2RCxNQUFNLENBQUMsUUFBUSxhQUFhLE1BQU0sQ0FBQyxPQUFPLE1BQU0sYUFBYSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQ3BJLENBQUM7WUFDSixDQUFDO1lBQ0QsSUFBSSxDQUFDLE9BQU8sQ0FBQyxJQUFJLEVBQUUsSUFBSSxDQUFDLE1BQU0sQ0FBQyxJQUFJLEVBQUUsRUFBRSxDQUFDO2dCQUN0QyxNQUFNLElBQUksS0FBSyxDQUNiLHVEQUF1RCxNQUFNLENBQUMsUUFBUSxhQUFhLE1BQU0sQ0FBQyxPQUFPLEdBQUcsQ0FDckcsQ0FBQztZQUNKLENBQUM7WUFDRCxRQUFRLEdBQUcsRUFBRSxPQUFPLEVBQUUsTUFBTSxFQUFFLE1BQU0sRUFBRSxxQkFBcUIsTUFBTSxDQUFDLFFBQVEsR0FBRyxFQUFFLENBQUM7UUFDbEYsQ0FBQzthQUFNLElBQUksTUFBTSxFQUFFLE9BQU8sSUFBSSxNQUFNLEVBQUUsTUFBTSxFQUFFLENBQUM7WUFDN0MsTUFBTSxJQUFJLEtBQUssQ0FBQyw0RUFBNEUsQ0FBQyxDQUFDO1FBQ2hHLENBQUM7UUFFRCxJQUFJLENBQUMsUUFBUSxFQUFFLENBQUM7WUFDZCxJQUFJLENBQUMsTUFBTSxHQUFHO2dCQUNaLE1BQU0sRUFBRSxvQkFBb0I7Z0JBQzVCLE1BQU0sRUFBRSxJQUFJO2dCQUNaLFlBQVksRUFBRSxJQUFJO2dCQUNsQixXQUFXLEVBQUUsSUFBSTtnQkFDakIsS0FBSyxFQUFFLEVBQUU7Z0JBQ1QsZ0JBQWdCLEVBQUUsQ0FBQywrRkFBK0YsQ0FBQzthQUNwSCxDQUFDO1lBQ0YsT0FBTyxTQUFTLENBQUM7UUFDbkIsQ0FBQztRQUVELE1BQU0sZ0JBQWdCLEdBQWEsRUFBRSxDQUFDO1FBQ3RDLElBQUksV0FBVyxHQUEwQyxJQUFJLENBQUM7UUFDOUQsSUFBSSxDQUFDO1lBQ0gsV0FBVyxHQUFHLGdCQUFnQixDQUFDLFFBQVEsQ0FBQyxPQUFPLENBQUMsQ0FBQztRQUNuRCxDQUFDO1FBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztZQUN4QixnQkFBZ0IsQ0FBQyxJQUFJLENBQUMsaUNBQWlDLGFBQWEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDakYsQ0FBQztRQUNELElBQUksV0FBVyxFQUFFLENBQUM7WUFDaEIsZ0JBQWdCLENBQUMsSUFBSSxDQUFDLEdBQUcsSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsUUFBUSxDQUFDLE1BQU0sQ0FBQyxDQUFDLENBQUM7UUFDNUUsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEdBQUc7WUFDWixNQUFNLEVBQUUsb0JBQW9CO1lBQzVCLE1BQU0sRUFBRSxRQUFRLENBQUMsTUFBTTtZQUN2QixZQUFZLEVBQUUsSUFBSTtZQUNsQixXQUFXO1lBQ1gsS0FBSyxFQUFFLFdBQVcsQ0FBQyxDQUFDLENBQUMsc0JBQXNCLENBQUMsV0FBVyxDQUFDLENBQUMsQ0FBQyxDQUFDLEVBQUU7WUFDN0QsZ0JBQWdCO1NBQ2pCLENBQUM7UUFDRixPQUFPLFFBQVEsQ0FBQztJQUNsQixDQUFDO0lBRU8sS0FBSyxDQUFDLHlCQUF5QixDQUFDLG9CQUE4QjtRQUNwRSxJQUFJLE1BQTJDLENBQUM7UUFDaEQsSUFBSSxhQUFpQyxDQUFDO1FBQ3RDLElBQUksQ0FBQztZQUNILE1BQU0sR0FBRyxNQUFNLElBQUksQ0FBQyx1QkFBdUIsQ0FBQyxvQkFBb0IsQ0FBQyxDQUFDO1FBQ3BFLENBQUM7UUFBQyxPQUFPLEtBQWMsRUFBRSxDQUFDO1lBQ3hCLGFBQWEsR0FBRyx1Q0FBdUMsYUFBYSxDQUFDLEtBQUssQ0FBQyxFQUFFLENBQUM7UUFDaEYsQ0FBQztRQUNELElBQUksQ0FBQyxNQUFNLEVBQUUsQ0FBQztZQUNaLElBQUksQ0FBQyxNQUFNLEdBQUc7Z0JBQ1osTUFBTSxFQUFFLG9CQUFvQjtnQkFDNUIsTUFBTSxFQUFFLElBQUk7Z0JBQ1osWUFBWSxFQUFFLElBQUk7Z0JBQ2xCLFdBQVcsRUFBRSxJQUFJO2dCQUNqQixLQUFLLEVBQUUsRUFBRTtnQkFDVCxnQkFBZ0IsRUFBRSxDQUFDLGFBQWEsSUFBSSxnQ0FBZ0Msb0JBQW9CLENBQUMsSUFBSSxDQUFDLElBQUksQ0FBQyxFQUFFLENBQUM7YUFDdkcsQ0FBQztZQUNGLE9BQU8sU0FBUyxDQUFDO1FBQ25CLENBQUM7UUFDRCxNQUFNLE1BQU0sR0FBRyx1QkFBdUIsTUFBTSxDQUFDLE1BQU0sR0FBRyxDQUFDO1FBQ3ZELElBQUksQ0FBQyxNQUFNLEdBQUc7WUFDWixNQUFNLEVBQUUsb0JBQW9CO1lBQzVCLE1BQU07WUFDTixZQUFZLEVBQUUsTUFBTSxDQUFDLE1BQU07WUFDM0IsV0FBVyxFQUFFLE1BQU0sQ0FBQyxXQUFXO1lBQy9CLEtBQUssRUFBRSxNQUFNLENBQUMsS0FBSztZQUNuQixnQkFBZ0IsRUFBRSxJQUFJLENBQUMsWUFBWSxDQUFDLE1BQU0sQ0FBQyxXQUFXLEVBQUUsTUFBTSxDQUFDLE1BQU0sQ0FBQztTQUN2RSxDQUFDO1FBQ0YsT0FBTyxFQUFFLE9BQU8sRUFBRSxNQUFNLENBQUMsT0FBTyxFQUFFLE1BQU0sRUFBRSxNQUFNLENBQUMsTUFBTSxFQUFFLE1BQU0sRUFBRSxDQUFDO0lBQ3BFLENBQUM7SUFFTyxZQUFZLENBQUMsY0FBOEMsRUFBRSxTQUFpQjtRQUNwRixJQUFJLENBQUM7WUFDSCxPQUFPLGNBQWMsQ0FBQyxlQUFlLENBQUMsT0FBTyxDQUFDLE1BQU0sQ0FBQyxnQkFBZ0IsQ0FBQyxTQUFTLENBQUMsQ0FBQztnQkFDL0UsQ0FBQyxDQUFDLEVBQUU7Z0JBQ0osQ0FBQyxDQUFDLENBQUMsNENBQTRDLENBQUMsQ0FBQztRQUNyRCxDQUFDO1FBQUMsT0FBTyxLQUFjLEVBQUUsQ0FBQztZQUN4QixPQUFPLENBQUMsaUNBQWlDLGFBQWEsQ0FBQyxLQUFLLENBQUMsRUFBRSxDQUFDLENBQUM7UUFDbkUsQ0FBQztJQUNILENBQUM7Q0FDRiJ9

package/dist_ts/email/index.d.ts

@@ -8,6 +8,7 @@ export * from './reconcile-mail-dns-singleton.js';
 export * from './classes.mail-egress-coordinator.js';
 export * from './classes.mail-edge-eligibility.js';
 export * from './classes.email-settings.manager.js';
+export * from './classes.email-tls-manager.js';
 export * from './classes.gateway-mail-domain.store.js';
 export * from './classes.coremail-gateway.manager.js';
 export * from './classes.coremail-gateway.store.js';

package/dist_ts/email/index.js

@@ -8,6 +8,7 @@ export * from './reconcile-mail-dns-singleton.js';
 export * from './classes.mail-egress-coordinator.js';
 export * from './classes.mail-edge-eligibility.js';
 export * from './classes.email-settings.manager.js';
+export * from './classes.email-tls-manager.js';
 export * from './classes.gateway-mail-domain.store.js';
 export * from './classes.coremail-gateway.manager.js';
 export * from './classes.coremail-gateway.store.js';
@@ -24,4 +25,4 @@ export * from './gateway-mail-domain-authority.js';
 export * from './email-dns-records.js';
 export * from './helpers.email-log-traffic.js';
 export * from './helpers.inbound-security.js';
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9lbWFpbC9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxrQ0FBa0MsQ0FBQztBQUNqRCxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsc0NBQXNDLENBQUM7QUFDckQsY0FBYyxvQ0FBb0MsQ0FBQztBQUNuRCxjQUFjLHFDQUFxQyxDQUFDO0FBQ3BELGNBQWMsd0NBQXdDLENBQUM7QUFDdkQsY0FBYyx1Q0FBdUMsQ0FBQztBQUN0RCxjQUFjLHFDQUFxQyxDQUFDO0FBQ3BELGNBQWMsdUNBQXVDLENBQUM7QUFDdEQsY0FBYyxpQ0FBaUMsQ0FBQztBQUNoRCxjQUFjLCtCQUErQixDQUFDO0FBQzlDLGNBQWMsNENBQTRDLENBQUM7QUFDM0QsY0FBYyx1Q0FBdUMsQ0FBQztBQUN0RCxjQUFjLDhCQUE4QixDQUFDO0FBQzdDLGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxpQkFBaUIsQ0FBQztBQUNoQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsb0NBQW9DLENBQUM7QUFDbkQsY0FBYyx3QkFBd0IsQ0FBQztBQUN2QyxjQUFjLGdDQUFnQyxDQUFDO0FBQy9DLGNBQWMsK0JBQStCLENBQUMifQ==
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiaW5kZXguanMiLCJzb3VyY2VSb290IjoiIiwic291cmNlcyI6WyIuLi8uLi8uLi90cy9lbWFpbC9pbmRleC50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQSxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxrQ0FBa0MsQ0FBQztBQUNqRCxjQUFjLDRCQUE0QixDQUFDO0FBQzNDLGNBQWMsMEJBQTBCLENBQUM7QUFDekMsY0FBYyxzQkFBc0IsQ0FBQztBQUNyQyxjQUFjLG1DQUFtQyxDQUFDO0FBQ2xELGNBQWMsc0NBQXNDLENBQUM7QUFDckQsY0FBYyxvQ0FBb0MsQ0FBQztBQUNuRCxjQUFjLHFDQUFxQyxDQUFDO0FBQ3BELGNBQWMsZ0NBQWdDLENBQUM7QUFDL0MsY0FBYyx3Q0FBd0MsQ0FBQztBQUN2RCxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMscUNBQXFDLENBQUM7QUFDcEQsY0FBYyx1Q0FBdUMsQ0FBQztBQUN0RCxjQUFjLGlDQUFpQyxDQUFDO0FBQ2hELGNBQWMsK0JBQStCLENBQUM7QUFDOUMsY0FBYyw0Q0FBNEMsQ0FBQztBQUMzRCxjQUFjLHVDQUF1QyxDQUFDO0FBQ3RELGNBQWMsOEJBQThCLENBQUM7QUFDN0MsY0FBYyxtQ0FBbUMsQ0FBQztBQUNsRCxjQUFjLGlCQUFpQixDQUFDO0FBQ2hDLGNBQWMsbUNBQW1DLENBQUM7QUFDbEQsY0FBYyxvQ0FBb0MsQ0FBQztBQUNuRCxjQUFjLHdCQUF3QixDQUFDO0FBQ3ZDLGNBQWMsZ0NBQWdDLENBQUM7QUFDL0MsY0FBYywrQkFBK0IsQ0FBQyJ9

package/dist_ts/opsserver/handlers/email-settings.handler.js

@@ -40,10 +40,12 @@ export class EmailSettingsHandler {
         const smtpListenerActive = dcRouter.emailServer
             ? dcRouter.emailServer.isSmtpListenerActive()
             : undefined;
+        const tlsCertificate = dcRouter.getEmailTlsCertificateStatus();
         const manager = dcRouter.emailSettingsManager;
         if (manager) {
             return {
                 ...manager.getPublicSettings(),
+                ...(tlsCertificate ? { tlsCertificate } : {}),
                 outboundEgress,
                 mailerBridgeState,
                 smtpAccountCount,
@@ -64,6 +66,8 @@ export class EmailSettingsHandler {
             portMapping: emailPortConfig?.portMapping ? { ...emailPortConfig.portMapping } : null,
             receivedEmailsPath: emailPortConfig?.receivedEmailsPath || null,
             maxMessageSize: emailConfig?.maxMessageSize ?? null,
+            tlsSource: dcRouter.getEmailTlsSource(),
+            ...(tlsCertificate ? { tlsCertificate } : {}),
             domainCount: emailConfig?.domains?.length || 0,
             routeCount: emailConfig?.routes?.length || 0,
             authUserCount: emailConfig?.auth?.users?.length || 0,
@@ -74,4 +78,4 @@ export class EmailSettingsHandler {
         };
     }
 }
-//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW1haWwtc2V0dGluZ3MuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL29wc3NlcnZlci9oYW5kbGVycy9lbWFpbC1zZXR0aW5ncy5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxLQUFLLFVBQVUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM5RCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFcEQsTUFBTSxPQUFPLG9CQUFvQjtJQUdYO0lBRmIsV0FBVyxHQUFHLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUU1RCxZQUFvQixZQUF1QjtRQUF2QixpQkFBWSxHQUFaLFlBQVksQ0FBVztRQUN6QyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQy9ELElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFTyxnQkFBZ0I7UUFDdEIsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLHdCQUF3QixFQUN4QixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsb0JBQTJCLEVBQUUsQ0FBQyxDQUFDO1lBQ3pGLE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7UUFDMUMsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUNuQywyQkFBMkIsRUFDM0IsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLE1BQU0sSUFBSSxHQUFHLE1BQU0sY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsT0FBTyxFQUFFO2dCQUM1RCxLQUFLLEVBQUUscUJBQTRCO2dCQUNuQyxvQkFBb0IsRUFBRSxJQUFJO2FBQzNCLENBQUMsQ0FBQztZQUNILE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1lBQ25FLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDYixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsc0NBQXNDLEVBQUUsQ0FBQztZQUM3RSxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMseUJBQXlCLENBQzVFLE9BQU8sQ0FBQyxRQUFRLEVBQ2hCLElBQUksQ0FBQyxNQUFNLENBQ1osQ0FBQztnQkFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQztZQUNyQyxDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFHLEdBQWEsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUM3RCxDQUFDO1FBQ0gsQ0FBQyxDQUNGLENBQ0YsQ0FBQztJQUNKLENBQUM7SUFFTyxXQUFXO1FBQ2pCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDO1FBQy9DLE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1FBQzFELE1BQU0saUJBQWlCLEdBQUcsUUFBUSxDQUFDLFdBQVcsRUFBRSxjQUFjLEVBRWpELENBQUM7UUFDZCxNQUFNLGdCQUFnQixHQUFHLFFBQVEsQ0FBQyxrQkFBa0IsRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDN0UsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsV0FBVztZQUM3QyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRTtZQUM3QyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2QsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLG9CQUFvQixDQUFDO1FBQzlDLElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixPQUFPO2dCQUNMLEdBQUcsT0FBTyxDQUFDLGlCQUFpQixFQUFFO2dCQUM5QixjQUFjO2dCQUNkLGlCQUFpQjtnQkFDakIsZ0JBQWdCO2dCQUNoQixHQUFHLENBQUMsa0JBQWtCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQzthQUNwRSxDQUFDO1FBQ0osQ0FBQztRQUNELE1BQU0sV0FBVyxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsV0FBVyxDQUFDO1FBQ2pELE1BQU0sZUFBZSxHQUFHLFFBQVEsQ0FBQyxPQUFPLENBQUMsZUFBZSxDQUFDO1FBQ3pELE9BQU87WUFDTCxPQUFPLEVBQUUsT0FBTyxDQUFDLFdBQVcsQ0FBQztZQUM3QixRQUFRLEVBQUUsV0FBVyxFQUFFLFFBQVEsSUFBSSxJQUFJO1lBQ3ZDLG9FQUFvRTtZQUNwRSxtRUFBbUU7WUFDbkUsWUFBWSxFQUFFLFFBQVEsQ0FBQyxPQUFPLENBQUMsaUJBQWlCLElBQUksZUFBZTtZQUNuRSxjQUFjO1lBQ2QsaUJBQWlCO1lBQ2pCLEtBQUssRUFBRSxDQUFDLEdBQUcsQ0FBQyxXQUFXLEVBQUUsS0FBSyxJQUFJLEVBQUUsQ0FBQyxDQUFDO1lBQ3RDLFdBQVcsRUFBRSxlQUFlLEVBQUUsV0FBVyxDQUFDLENBQUMsQ0FBQyxFQUFFLEdBQUcsZUFBZSxDQUFDLFdBQVcsRUFBRSxDQUFDLENBQUMsQ0FBQyxJQUFJO1lBQ3JGLGtCQUFrQixFQUFFLGVBQWUsRUFBRSxrQkFBa0IsSUFBSSxJQUFJO1lBQy9ELGNBQWMsRUFBRSxXQUFXLEVBQUUsY0FBYyxJQUFJLElBQUk7WUFDbkQsV0FBVyxFQUFFLFdBQVcsRUFBRSxPQUFPLEVBQUUsTUFBTSxJQUFJLENBQUM7WUFDOUMsVUFBVSxFQUFFLFdBQVcsRUFBRSxNQUFNLEVBQUUsTUFBTSxJQUFJLENBQUM7WUFDNUMsYUFBYSxFQUFFLFdBQVcsRUFBRSxJQUFJLEVBQUUsS0FBSyxFQUFFLE1BQU0sSUFBSSxDQUFDO1lBQ3BELGdCQUFnQjtZQUNoQixHQUFHLENBQUMsa0JBQWtCLEtBQUssU0FBUyxDQUFDLENBQUMsQ0FBQyxFQUFFLGtCQUFrQixFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUNuRSxTQUFTLEVBQUUsQ0FBQztZQUNaLFNBQVMsRUFBRSxpQkFBaUI7U0FDN0IsQ0FBQztJQUNKLENBQUM7Q0FDRiJ9
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiZW1haWwtc2V0dGluZ3MuaGFuZGxlci5qcyIsInNvdXJjZVJvb3QiOiIiLCJzb3VyY2VzIjpbIi4uLy4uLy4uLy4uL3RzL29wc3NlcnZlci9oYW5kbGVycy9lbWFpbC1zZXR0aW5ncy5oYW5kbGVyLnRzIl0sIm5hbWVzIjpbXSwibWFwcGluZ3MiOiJBQUFBLE9BQU8sS0FBSyxPQUFPLE1BQU0sa0JBQWtCLENBQUM7QUFFNUMsT0FBTyxLQUFLLFVBQVUsTUFBTSxpQ0FBaUMsQ0FBQztBQUM5RCxPQUFPLEVBQUUsY0FBYyxFQUFFLE1BQU0sb0JBQW9CLENBQUM7QUFFcEQsTUFBTSxPQUFPLG9CQUFvQjtJQUdYO0lBRmIsV0FBVyxHQUFHLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxXQUFXLEVBQUUsQ0FBQztJQUU1RCxZQUFvQixZQUF1QjtRQUF2QixpQkFBWSxHQUFaLFlBQVksQ0FBVztRQUN6QyxJQUFJLENBQUMsWUFBWSxDQUFDLFdBQVcsQ0FBQyxjQUFjLENBQUMsSUFBSSxDQUFDLFdBQVcsQ0FBQyxDQUFDO1FBQy9ELElBQUksQ0FBQyxnQkFBZ0IsRUFBRSxDQUFDO0lBQzFCLENBQUM7SUFFTyxnQkFBZ0I7UUFDdEIsSUFBSSxDQUFDLFdBQVcsQ0FBQyxlQUFlLENBQzlCLElBQUksT0FBTyxDQUFDLFlBQVksQ0FBQyxZQUFZLENBQ25DLHdCQUF3QixFQUN4QixLQUFLLEVBQUUsT0FBTyxFQUFFLEVBQUU7WUFDaEIsTUFBTSxjQUFjLENBQUMsSUFBSSxDQUFDLFlBQVksRUFBRSxPQUFPLEVBQUUsRUFBRSxLQUFLLEVBQUUsb0JBQTJCLEVBQUUsQ0FBQyxDQUFDO1lBQ3pGLE9BQU8sRUFBRSxRQUFRLEVBQUUsSUFBSSxDQUFDLFdBQVcsRUFBRSxFQUFFLENBQUM7UUFDMUMsQ0FBQyxDQUNGLENBQ0YsQ0FBQztRQUVGLElBQUksQ0FBQyxXQUFXLENBQUMsZUFBZSxDQUM5QixJQUFJLE9BQU8sQ0FBQyxZQUFZLENBQUMsWUFBWSxDQUNuQywyQkFBMkIsRUFDM0IsS0FBSyxFQUFFLE9BQU8sRUFBRSxFQUFFO1lBQ2hCLE1BQU0sSUFBSSxHQUFHLE1BQU0sY0FBYyxDQUFDLElBQUksQ0FBQyxZQUFZLEVBQUUsT0FBTyxFQUFFO2dCQUM1RCxLQUFLLEVBQUUscUJBQTRCO2dCQUNuQyxvQkFBb0IsRUFBRSxJQUFJO2FBQzNCLENBQUMsQ0FBQztZQUNILE1BQU0sT0FBTyxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDLG9CQUFvQixDQUFDO1lBQ25FLElBQUksQ0FBQyxPQUFPLEVBQUUsQ0FBQztnQkFDYixPQUFPLEVBQUUsT0FBTyxFQUFFLEtBQUssRUFBRSxPQUFPLEVBQUUsc0NBQXNDLEVBQUUsQ0FBQztZQUM3RSxDQUFDO1lBQ0QsSUFBSSxDQUFDO2dCQUNILE1BQU0sUUFBUSxHQUFHLE1BQU0sSUFBSSxDQUFDLFlBQVksQ0FBQyxXQUFXLENBQUMseUJBQXlCLENBQzVFLE9BQU8sQ0FBQyxRQUFRLEVBQ2hCLElBQUksQ0FBQyxNQUFNLENBQ1osQ0FBQztnQkFDRixPQUFPLEVBQUUsT0FBTyxFQUFFLElBQUksRUFBRSxRQUFRLEVBQUUsQ0FBQztZQUNyQyxDQUFDO1lBQUMsT0FBTyxHQUFZLEVBQUUsQ0FBQztnQkFDdEIsT0FBTyxFQUFFLE9BQU8sRUFBRSxLQUFLLEVBQUUsT0FBTyxFQUFHLEdBQWEsQ0FBQyxPQUFPLEVBQUUsQ0FBQztZQUM3RCxDQUFDO1FBQ0gsQ0FBQyxDQUNGLENBQ0YsQ0FBQztJQUNKLENBQUM7SUFFTyxXQUFXO1FBQ2pCLE1BQU0sUUFBUSxHQUFHLElBQUksQ0FBQyxZQUFZLENBQUMsV0FBVyxDQUFDO1FBQy9DLE1BQU0sY0FBYyxHQUFHLFFBQVEsQ0FBQyx1QkFBdUIsRUFBRSxDQUFDO1FBQzFELE1BQU0saUJBQWlCLEdBQUcsUUFBUSxDQUFDLFdBQVcsRUFBRSxjQUFjLEVBRWpELENBQUM7UUFDZCxNQUFNLGdCQUFnQixHQUFHLFFBQVEsQ0FBQyxrQkFBa0IsRUFBRSxlQUFlLEVBQUUsSUFBSSxDQUFDLENBQUM7UUFDN0UsTUFBTSxrQkFBa0IsR0FBRyxRQUFRLENBQUMsV0FBVztZQUM3QyxDQUFDLENBQUMsUUFBUSxDQUFDLFdBQVcsQ0FBQyxvQkFBb0IsRUFBRTtZQUM3QyxDQUFDLENBQUMsU0FBUyxDQUFDO1FBQ2QsTUFBTSxjQUFjLEdBQUcsUUFBUSxDQUFDLDRCQUE0QixFQUFFLENBQUM7UUFDL0QsTUFBTSxPQUFPLEdBQUcsUUFBUSxDQUFDLG9CQUFvQixDQUFDO1FBQzlDLElBQUksT0FBTyxFQUFFLENBQUM7WUFDWixPQUFPO2dCQUNMLEdBQUcsT0FBTyxDQUFDLGlCQUFpQixFQUFFO2dCQUM5QixHQUFHLENBQUMsY0FBYyxDQUFDLENBQUMsQ0FBQyxFQUFFLGNBQWMsRUFBRSxDQUFDLENBQUMsQ0FBQyxFQUFFLENBQUM7Z0JBQzdDLGNBQWM7Z0JBQ2QsaUJBQWlCO2dCQUNqQixnQkFBZ0I7Z0JBQ2hCLEdBQUcsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO2FBQ3BFLENBQUM7UUFDSixDQUFDO1FBQ0QsTUFBTSxXQUFXLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxXQUFXLENBQUM7UUFDakQsTUFBTSxlQUFlLEdBQUcsUUFBUSxDQUFDLE9BQU8sQ0FBQyxlQUFlLENBQUM7UUFDekQsT0FBTztZQUNMLE9BQU8sRUFBRSxPQUFPLENBQUMsV0FBVyxDQUFDO1lBQzdCLFFBQVEsRUFBRSxXQUFXLEVBQUUsUUFBUSxJQUFJLElBQUk7WUFDdkMsb0VBQW9FO1lBQ3BFLG1FQUFtRTtZQUNuRSxZQUFZLEVBQUUsUUFBUSxDQUFDLE9BQU8sQ0FBQyxpQkFBaUIsSUFBSSxlQUFlO1lBQ25FLGNBQWM7WUFDZCxpQkFBaUI7WUFDakIsS0FBSyxFQUFFLENBQUMsR0FBRyxDQUFDLFdBQVcsRUFBRSxLQUFLLElBQUksRUFBRSxDQUFDLENBQUM7WUFDdEMsV0FBVyxFQUFFLGVBQWUsRUFBRSxXQUFXLENBQUMsQ0FBQyxDQUFDLEVBQUUsR0FBRyxlQUFlLENBQUMsV0FBVyxFQUFFLENBQUMsQ0FBQyxDQUFDLElBQUk7WUFDckYsa0JBQWtCLEVBQUUsZUFBZSxFQUFFLGtCQUFrQixJQUFJLElBQUk7WUFDL0QsY0FBYyxFQUFFLFdBQVcsRUFBRSxjQUFjLElBQUksSUFBSTtZQUNuRCxTQUFTLEVBQUUsUUFBUSxDQUFDLGlCQUFpQixFQUFFO1lBQ3ZDLEdBQUcsQ0FBQyxjQUFjLENBQUMsQ0FBQyxDQUFDLEVBQUUsY0FBYyxFQUFFLENBQUMsQ0FBQyxDQUFDLEVBQUUsQ0FBQztZQUM3QyxXQUFXLEVBQUUsV0FBVyxFQUFFLE9BQU8sRUFBRSxNQUFNLElBQUksQ0FBQztZQUM5QyxVQUFVLEVBQUUsV0FBVyxFQUFFLE1BQU0sRUFBRSxNQUFNLElBQUksQ0FBQztZQUM1QyxhQUFhLEVBQUUsV0FBVyxFQUFFLElBQUksRUFBRSxLQUFLLEVBQUUsTUFBTSxJQUFJLENBQUM7WUFDcEQsZ0JBQWdCO1lBQ2hCLEdBQUcsQ0FBQyxrQkFBa0IsS0FBSyxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUUsa0JBQWtCLEVBQUUsQ0FBQyxDQUFDLENBQUMsRUFBRSxDQUFDO1lBQ25FLFNBQVMsRUFBRSxDQUFDO1lBQ1osU0FBUyxFQUFFLGlCQUFpQjtTQUM3QixDQUFDO0lBQ0osQ0FBQztDQUNGIn0=

package/dist_ts_interfaces/data/email-settings.d.ts

@@ -11,6 +11,38 @@ export interface IEmailOutboundEgressStatus {
 }
 /** Lifecycle state of the smartmta Rust mailer bridge. 'failed' and 'restarting' mean mail processing is degraded. */
 export type TEmailBridgeState = 'idle' | 'starting' | 'running' | 'restarting' | 'failed' | 'stopped';
+/**
+ * Where the SMTP listener's certificate (STARTTLS on 25/587, implicit TLS on
+ * the smartmta-terminated secure port) comes from.
+ * - 'managedCertificate': the stored ACME certificate that covers the mail
+ *   hostname and every enabled mail-edge hostname. Configured `emailConfig.tls`
+ *   material is ignored, and is removed when an operator switches to this
+ *   source. Renewals reach the running listener without a restart.
+ * - 'configuredMaterial': the operator-managed `emailConfig.tls` material
+ *   (inline `certPem`/`keyPem`, or `certPath`/`keyPath` read when the listener
+ *   starts). ACME renewals never replace it.
+ * Settings persisted without a source keep their previous behaviour:
+ * 'configuredMaterial' while `emailConfig.tls` carries material, otherwise
+ * 'managedCertificate'.
+ */
+export type TEmailTlsSource = 'managedCertificate' | 'configuredMaterial';
+/** The certificate the running SMTP listener serves, checked at read time. */
+export interface IEmailTlsCertificateStatus {
+    source: TEmailTlsSource;
+    /** Where the served material was read from; null when no material was found. */
+    origin: string | null;
+    /** DNS subject alternative names of the served certificate. */
+    names: string[];
+    /** Epoch milliseconds; null when no parseable certificate is served. */
+    notBefore: number | null;
+    /** Epoch milliseconds; null when no parseable certificate is served. */
+    notAfter: number | null;
+    /** Mail hostname plus every enabled mail-edge hostname the certificate must cover. */
+    requiredHostnames: string[];
+    /** Empty when the served certificate is valid, matches its key and covers every required hostname. */
+    problems: string[];
+    checkedAt: number;
+}
 export interface IEmailPortConfig {
     /** External to internal SMTP port mapping. */
     portMapping?: Record<number, number>;
@@ -31,6 +63,10 @@ export interface IEmailServerSettings {
     portMapping: Record<number, number> | null;
     receivedEmailsPath: string | null;
     maxMessageSize: number | null;
+    /** Effective SMTP certificate source (see TEmailTlsSource for the default of settings persisted without one). */
+    tlsSource: TEmailTlsSource;
+    /** Present when the email server is running: the certificate the SMTP listener serves. */
+    tlsCertificate?: IEmailTlsCertificateStatus;
     domainCount: number;
     routeCount: number;
     authUserCount: number;
@@ -59,6 +95,13 @@ export type TEmailServerSettingsUpdate = {
     portMapping?: Record<number, number> | null;
     receivedEmailsPath?: string | null;
     maxMessageSize?: number | null;
+    /**
+     * Switch the SMTP certificate source. 'managedCertificate' is refused while
+     * no valid stored certificate covers the mail hostname and every enabled
+     * mail-edge hostname; accepting it removes the configured `emailConfig.tls`
+     * material. 'configuredMaterial' is refused while none is persisted.
+     */
+    tlsSource?: TEmailTlsSource;
     /**
      * Exact names of persisted legacy routes to remove (the internal-relay
      * retirement lever). Fails loudly on unknown names and refuses generated

package/dist_ts_web/00_commitinfo_data.js

@@ -3,7 +3,7 @@
  */
 export const commitinfo = {
     name: '@serve.zone/dcrouter',
-    version: '32.6.3',
+    version: '32.7.0',
     description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 };
 //# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJmaWxlIjoiMDBfY29tbWl0aW5mb19kYXRhLmpzIiwic291cmNlUm9vdCI6IiIsInNvdXJjZXMiOlsiLi4vLi4vdHNfd2ViLzAwX2NvbW1pdGluZm9fZGF0YS50cyJdLCJuYW1lcyI6W10sIm1hcHBpbmdzIjoiQUFBQTs7R0FFRztBQUNILE1BQU0sQ0FBQyxNQUFNLFVBQVUsR0FBRztJQUN4QixJQUFJLEVBQUUsc0JBQXNCO0lBQzVCLE9BQU8sRUFBRSxRQUFRO0lBQ2pCLFdBQVcsRUFBRSwwRUFBMEU7Q0FDeEYsQ0FBQSJ9

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@serve.zone/dcrouter",
   "private": false,
-  "version": "32.6.3",
+  "version": "32.7.0",
   "description": "A multifaceted routing service handling mail and SMS delivery functions.",
   "type": "module",
   "bin": {
@@ -15,16 +15,16 @@
   "author": "Task Venture Capital GmbH",
   "license": "MIT",
   "devDependencies": {
-    "@git.zone/tsbuild": "^5.0.0",
-    "@git.zone/tsbundle": "^3.0.0",
-    "@git.zone/tsdeno": "^1.12.0",
-    "@git.zone/tsdocker": "^3.9.0",
+    "@git.zone/tsbuild": "^5.1.2",
+    "@git.zone/tsbundle": "^3.1.3",
+    "@git.zone/tsdeno": "^1.15.0",
+    "@git.zone/tsdocker": "^3.11.0",
     "@git.zone/tsrun": "^3.0.2",
-    "@git.zone/tstest": "^6.3.2",
-    "@git.zone/tswatch": "^4.0.2",
+    "@git.zone/tstest": "^7.1.0",
+    "@git.zone/tswatch": "^6.0.1",
     "@push.rocks/smartdb-v2": "npm:@push.rocks/smartdb@2.14.6",
     "@push.rocks/smartdb-v5.2": "npm:@push.rocks/smartdb@5.2.2",
-    "@types/node": "26.6.2",
+    "@types/node": "26.6.3",
     "@types/web-push": "3.6.4"
   },
   "dependencies": {

package/readme.md

@@ -818,11 +818,14 @@ On upgrade, a migration converts legacy plaintext `emailConfig.auth.users` entri
 
 SMTP AUTH is only ever offered on an encrypted transport. A submission port that has no TLS material and no upstream TLS terminator advertises neither `STARTTLS` nor `AUTH`, and refuses an `AUTH` command with `538 5.7.11` — credentials never cross a cleartext channel.
 
-`emailConfig.tls` therefore has to actually reach the SMTP listener. SmartMTA consumes PEM content, so dcrouter resolves it in this order:
+The SMTP listener's certificate therefore has to actually reach it. SmartMTA consumes PEM content and takes one certificate for every name the listener answers, so dcrouter resolves it from one of two sources, chosen by the email server setting `tlsSource`:
 
-1. `emailConfig.tls.certPem` / `keyPem` — inline PEM.
-2. `emailConfig.tls.certPath` / `keyPath` — file paths, read eagerly at startup. Both are required together. A path that cannot be read, or that holds an empty file, **fails startup** rather than silently leaving the listener without TLS.
-3. The stored ACME certificate for `emailConfig.hostname` in the proxy certificate store. Renewals are pushed to the running listener automatically (unless explicit paths are configured, which are never superseded by an ACME renewal for the same name).
+- `managedCertificate` — the stored ACME certificate that covers `emailConfig.hostname` and the `mailHostname` of every enabled mail edge (dcrouter issues it with the domain wildcard included, so one certificate covers them all). Every issuance or renewal of a stored certificate that covers one of those names is pushed to the running listener, including one stored under a wildcard or sibling route domain; SmartMTA restarts only the Rust listener when the PEM material changes.
+- `configuredMaterial` — operator-managed material in `emailConfig.tls`: inline `certPem` / `keyPem`, or `certPath` / `keyPath` read when the listener starts. Both paths are required together; a path that cannot be read, or that holds an empty file, **fails startup** rather than silently leaving the listener without TLS. ACME renewals never replace this material.
+
+Settings stored without a `tlsSource` keep their previous behaviour: `configuredMaterial` while `emailConfig.tls` carries material, otherwise `managedCertificate`. Operators switch with `updateEmailServerSettings { settings: { tlsSource } }`, which restarts the email components in-process. Switching to `managedCertificate` is refused, and the settings stay unchanged, while no currently valid stored certificate covers the mail hostname and every enabled mail-edge hostname; once accepted it removes the configured material from the persisted settings. Switching to `configuredMaterial` is refused while no material is persisted.
+
+`getEmailServerSettings` reports the effective `tlsSource` and, while the listener runs, `tlsCertificate`: where the served material came from, its DNS names, `notBefore` / `notAfter`, the hostnames it must cover, and `problems`. The material is checked on every read, so a certificate that expires while the listener runs, does not cover a required hostname, or does not match its key is listed in `problems`; resolving such material also logs an error.
 
 CoreTraffic terminates public TLS for port 465 and forwards the decrypted stream to the internal SMTP leg, so that leg is plaintext even though the client's channel was encrypted. dcrouter derives those ports from the generated email routes and declares them to SmartMTA as `smtp.tlsTerminatedPorts`, gated on the PROXY-protocol trust dcrouter already requires from `127.0.0.1`/`::1` — so implicit-TLS submission keeps authenticating while the plain ports require `STARTTLS` first.
 

package/ts/00_commitinfo_data.ts

@@ -3,6 +3,6 @@
  */
 export const commitinfo = {
   name: '@serve.zone/dcrouter',
-  version: '32.6.3',
+  version: '32.7.0',
   description: 'A multifaceted routing service handling mail and SMS delivery functions.'
 }