From e261f9dab0218edbbbe024469e9e9e2a4b1642d4 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Mon, 6 Jul 2026 16:13:00 +0300 Subject: [PATCH 1/5] feat: add package-manager secret guard --- .github/workflows/ci.yml | 33 +++ AGENTS.md | 24 +- README.md | 32 +++ package.json | 1 + scripts/seed.ts | 2 +- src/cli/index.tsx | 36 +++ src/index.ts | 10 + src/lib/package-manager-guard.test.ts | 68 +++++ src/lib/package-manager-guard.ts | 372 ++++++++++++++++++++++++++ src/lib/redact.test.ts | 11 +- src/lib/redact.ts | 16 +- 11 files changed, 595 insertions(+), 10 deletions(-) create mode 100644 .github/workflows/ci.yml create mode 100644 src/lib/package-manager-guard.test.ts create mode 100644 src/lib/package-manager-guard.ts diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..7af8509 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,33 @@ +name: CI + +on: + push: + branches: [main] + pull_request: + branches: [main] + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - uses: actions/checkout@v4 + + - uses: oven-sh/setup-bun@v2 + with: + bun-version: latest + + - name: Install dependencies + run: bun install + + - name: Package-manager secret guard + run: bun run check:package-secrets + + - name: Typecheck + run: bun run typecheck + + - name: Test + run: bun test + + - name: Build + run: bun run build diff --git a/AGENTS.md b/AGENTS.md index 6226608..38c7ba6 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -39,10 +39,15 @@ configs mcp install --claude --profile minimal # 3 tools (lowest context cost ### Restore Secrets on New Machine ``` 1. Import backup: configs import backup.tar.gz (CLI) -2. render_template("npmrc", use_env=true) → fills {{NPM_AUTH_TOKEN}} from env -3. apply_config("npmrc") → writes to ~/.npmrc +2. Keep ~/.npmrc env-backed: //registry.npmjs.org/:_authToken=${NPM_TOKEN} +3. Load NPM_TOKEN from the shell, CI secret store, or an approved vault at runtime +4. Run configs package-manager-scan --home --fail-on-findings before committing ``` +Do not render or write a literal npm token into `~/.npmrc`. The safe home +credential flow stores only the scoped registry line plus `${NPM_TOKEN}` and +keeps the token value in the runtime environment or secret manager. + ### Sync Project Configs ``` 1. sync_known(agent="claude") → sync all Claude Code configs @@ -84,7 +89,20 @@ Configs automatically redacts secrets before storing. Patterns detected: - Key names: `*_API_KEY`, `*_TOKEN`, `*_SECRET`, `*_PASSWORD`, `*_CREDENTIAL`, `*_AUTH*` - Value patterns: npm tokens, GitHub tokens, Anthropic/OpenAI keys, AWS keys, JWTs, Slack tokens -Redacted values become `{{VAR_NAME}}` template placeholders. Use `render_template` with `use_env=true` to fill them from environment variables. +Redacted values become `{{VAR_NAME}}` template placeholders, except `.npmrc` +auth tokens, which are converted to npm's `${NPM_TOKEN}` environment reference +so home and repo package-manager configs do not store literal tokens. + +## Package-Manager Secret Guard + +Use `configs package-manager-scan --fail-on-findings .` in repo CI or +pre-commit hooks. Add `--home` for local operator checks. The guard scans repo +`.npmrc`, home `.npmrc`, Bun config, lockfiles, and shell profiles, and prints +only paths, line numbers, rule names, surfaces, and tracked status. + +Bun release-age quarantine must remain enabled. `minimumReleaseAgeExcludes` +should contain only exact `@hasna/` names; do not use wildcard or +third-party excludes. ## Constraints diff --git a/README.md b/README.md index b51a2ff..b30ce71 100644 --- a/README.md +++ b/README.md @@ -22,6 +22,8 @@ configs show # full metadata + content configs inspect # alias for show configs profile resolve configs profile apply --auto +configs package-manager-scan --fail-on-findings . +configs package-manager-scan --home --fail-on-findings . ``` Collection commands are compact by default to keep agent terminals and context @@ -32,6 +34,36 @@ small. Human output is capped at 20 rows unless you pass `--limit`; use - `--json` preserves full machine-readable records for automation. - `show`/`inspect` and `snapshot show` print full config or snapshot content. +## Package-Manager Secret Guard + +`configs package-manager-scan` blocks package-manager credential ingress without +printing credential values. It scans repo `.npmrc` files, home `.npmrc`, Bun +config, lockfiles, and shell profiles, then reports only path, line, rule, +surface, and tracked status. + +Use it in CI or pre-commit hooks: + +```bash +configs package-manager-scan --fail-on-findings . +``` + +Use `--home` for local operator scans: + +```bash +configs package-manager-scan --home --fail-on-findings . +``` + +Safe `.npmrc` auth uses npm's environment reference, not a rendered literal: + +```ini +@hasna:registry=https://registry.npmjs.org/ +//registry.npmjs.org/:_authToken=${NPM_TOKEN} +``` + +Bun release-age quarantine must stay enabled. Keep +`minimumReleaseAgeExcludes` narrowed to exact `@hasna/` names only; +wildcards and third-party package names fail the guard. + ## MCP Server ```bash diff --git a/package.json b/package.json index 83c6fdf..9f98bda 100644 --- a/package.json +++ b/package.json @@ -32,6 +32,7 @@ "build:dashboard": "cd dashboard && bun run build", "typecheck": "tsc --noEmit", "test": "bun test", + "check:package-secrets": "bun run src/cli/index.tsx package-manager-scan --fail-on-findings --home .", "dev:cli": "bun run src/cli/index.tsx", "dev:mcp": "bun run src/mcp/index.ts", "dev:serve": "bun run src/server/index.ts", diff --git a/scripts/seed.ts b/scripts/seed.ts index 7caf60d..41754ef 100644 --- a/scripts/seed.ts +++ b/scripts/seed.ts @@ -65,7 +65,7 @@ Format: export KEY_NAME="value" | ANTHROPIC_API_KEY | Claude/Anthropic AI | | OPENAI_API_KEY | OpenAI/GPT | | EXA_API_KEY | Exa semantic search | -| NPM_TOKEN | npm publish token | +| NPM_TOKEN | npm publish token; keep the value in the runtime environment or approved vault, never as a literal ~/.npmrc value | | GITHUB_TOKEN | GitHub API | `, }, diff --git a/src/cli/index.tsx b/src/cli/index.tsx index 4c076d6..c3e60d5 100644 --- a/src/cli/index.tsx +++ b/src/cli/index.tsx @@ -924,6 +924,42 @@ program } }); +// ── package-manager-scan ───────────────────────────────────────────────────── +program + .command("package-manager-scan [paths...]") + .description("Scan package-manager config for literal token ingress without printing values") + .option("--home", "also scan home .npmrc, Bun config, and shell profiles") + .option("--fail-on-findings", "exit nonzero when any finding is detected") + .option("--json", "output machine-readable JSON") + .option("--limit ", `max findings to print (default ${DEFAULT_LIST_LIMIT})`) + .action(async (paths: string[] | undefined, opts: { home?: boolean; failOnFindings?: boolean; json?: boolean; limit?: string }) => { + const { scanPackageManagerSecrets } = await import("../lib/package-manager-guard.js"); + const roots = paths && paths.length > 0 ? paths : [process.cwd()]; + const result = scanPackageManagerSecrets({ roots, includeHome: !!opts.home }); + const maxPrinted = parseLimit(opts.limit, DEFAULT_LIST_LIMIT); + const visible = result.findings.slice(0, maxPrinted); + const omitted = Math.max(0, result.findings.length - visible.length); + + if (opts.json) { + console.log(JSON.stringify(result, null, 2)); + } else if (result.findings.length === 0) { + console.log(chalk.green("✓") + ` Package-manager scan clean (${result.scannedFiles} file(s)).`); + } else { + console.log(chalk.red(`✗ ${result.findings.length} package-manager finding(s) detected.`)); + for (const finding of visible) { + const tracked = finding.tracked ? "tracked" : "untracked"; + const color = finding.severity === "error" ? chalk.red : chalk.yellow; + console.log(color(` ${finding.path}:${finding.line} ${finding.rule}`) + chalk.dim(` [${finding.surface}, ${tracked}] ${finding.detail}`)); + } + if (omitted > 0) console.log(chalk.dim(` Omitted ${omitted} finding(s). Re-run with --limit ${result.findings.length} or --json.`)); + console.log(chalk.dim(" Secret values are never printed by this command.")); + } + + if (opts.failOnFindings && result.findings.length > 0) { + process.exitCode = 1; + } + }); + // ── mcp ─────────────────────────────────────────────────────────────────────── const mcpCmd = program.command("mcp").description("Install/remove MCP server for AI agents"); diff --git a/src/index.ts b/src/index.ts index 700e432..b1be494 100644 --- a/src/index.ts +++ b/src/index.ts @@ -136,3 +136,13 @@ export type { TemplateVar } from "./lib/template.js"; // Lib — redact export { redactContent, scanSecrets, hasSecrets } from "./lib/redact.js"; export type { RedactResult, RedactedVar, RedactFormat } from "./lib/redact.js"; + +// Lib — package-manager guard +export { scanPackageManagerSecrets } from "./lib/package-manager-guard.js"; +export type { + PackageManagerFinding, + PackageManagerScanOptions, + PackageManagerScanResult, + PackageManagerSeverity, + PackageManagerSurface, +} from "./lib/package-manager-guard.js"; diff --git a/src/lib/package-manager-guard.test.ts b/src/lib/package-manager-guard.test.ts new file mode 100644 index 0000000..c18b50a --- /dev/null +++ b/src/lib/package-manager-guard.test.ts @@ -0,0 +1,68 @@ +import { describe, expect, test } from "bun:test"; +import { mkdtempSync, rmSync, writeFileSync } from "node:fs"; +import { join } from "node:path"; +import { tmpdir } from "node:os"; +import { scanPackageManagerSecrets } from "./package-manager-guard"; + +function withTempRepo(fn: (dir: string) => void) { + const dir = mkdtempSync(join(tmpdir(), "configs-package-guard-")); + try { + fn(dir); + } finally { + rmSync(dir, { recursive: true, force: true }); + } +} + +describe("scanPackageManagerSecrets", () => { + test("allows env-backed npmrc auth and exact Hasna release-age excludes", () => { + withTempRepo((dir) => { + writeFileSync(join(dir, ".npmrc"), [ + "@hasna:registry=https://registry.npmjs.org/", + "//registry.npmjs.org/:_authToken=${NPM_TOKEN}", + "", + ].join("\n")); + writeFileSync(join(dir, "bunfig.toml"), [ + "minimumReleaseAge = 604800", + "minimumReleaseAgeExcludes = [", + ' "@hasna/configs",', + ' "@hasna/todos"', + "]", + ].join("\n")); + + const result = scanPackageManagerSecrets({ roots: [dir] }); + expect(result.clean).toBe(true); + expect(result.findings).toHaveLength(0); + }); + }); + + test("flags literal npmrc auth and lockfile token patterns without returning values", () => { + withTempRepo((dir) => { + const token = "npm_" + "a".repeat(40); + writeFileSync(join(dir, ".npmrc"), `//registry.npmjs.org/:_authToken=${token}\n`); + writeFileSync(join(dir, "package-lock.json"), JSON.stringify({ token }, null, 2)); + + const result = scanPackageManagerSecrets({ roots: [dir] }); + const json = JSON.stringify(result); + expect(result.clean).toBe(false); + expect(result.findings.map((finding) => finding.rule)).toContain("npmrc-literal-auth"); + expect(result.findings.map((finding) => finding.rule)).toContain("literal-npm-token"); + expect(json).not.toContain(token); + }); + }); + + test("flags disabled Bun release-age quarantine and broad excludes", () => { + withTempRepo((dir) => { + writeFileSync(join(dir, ".bunfig.toml"), [ + "minimumReleaseAge = 0", + "minimumReleaseAgeExcludes = [", + ' "@hasna/*",', + ' "lodash"', + "]", + ].join("\n")); + + const result = scanPackageManagerSecrets({ roots: [dir] }); + expect(result.findings.map((finding) => finding.rule)).toContain("bun-release-age-disabled"); + expect(result.findings.filter((finding) => finding.rule === "bun-release-age-broad-exclude")).toHaveLength(2); + }); + }); +}); diff --git a/src/lib/package-manager-guard.ts b/src/lib/package-manager-guard.ts new file mode 100644 index 0000000..fc1a487 --- /dev/null +++ b/src/lib/package-manager-guard.ts @@ -0,0 +1,372 @@ +import { execFileSync } from "node:child_process"; +import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs"; +import { homedir } from "node:os"; +import { basename, isAbsolute, join, relative, resolve } from "node:path"; + +export type PackageManagerSurface = + | "repo-npmrc" + | "home-npmrc" + | "bun-config" + | "lockfile" + | "shell-profile"; + +export type PackageManagerSeverity = "error" | "warning"; + +export interface PackageManagerFinding { + path: string; + line: number; + rule: string; + surface: PackageManagerSurface; + severity: PackageManagerSeverity; + tracked: boolean; + detail: string; +} + +export interface PackageManagerScanOptions { + roots?: string[]; + includeHome?: boolean; + cwd?: string; +} + +export interface PackageManagerScanResult { + clean: boolean; + scannedFiles: number; + scannedRoots: string[]; + findings: PackageManagerFinding[]; +} + +const SKIP_DIRS = new Set([ + ".git", + "node_modules", + "dist", + "build", + "coverage", + ".next", + ".turbo", + ".cache", +]); + +const LOCKFILE_NAMES = new Set([ + "bun.lock", + "package-lock.json", + "npm-shrinkwrap.json", + "pnpm-lock.yaml", + "yarn.lock", +]); + +const HOME_FILES = [ + ".npmrc", + ".bunfig.toml", + "bunfig.toml", + ".bashrc", + ".bash_profile", + ".zshrc", + ".zprofile", + ".profile", +]; + +const TOKEN_VALUE_PATTERNS: Array<{ re: RegExp; rule: string; detail: string }> = [ + { re: /npm_[A-Za-z0-9]{36,}/, rule: "literal-npm-token", detail: "literal npm token-like value" }, + { re: /gh[pousr]_[A-Za-z0-9_]{36,}/, rule: "literal-github-token", detail: "literal GitHub token-like value" }, + { re: /sk-ant-[A-Za-z0-9\-_]{40,}/, rule: "literal-anthropic-key", detail: "literal Anthropic key-like value" }, + { re: /sk-[A-Za-z0-9]{48,}/, rule: "literal-openai-key", detail: "literal OpenAI key-like value" }, + { re: /AKIA[0-9A-Z]{16}/, rule: "literal-aws-access-key", detail: "literal AWS access-key-like value" }, + { re: /xoxb-[0-9]+-[A-Za-z0-9-]+/, rule: "literal-slack-token", detail: "literal Slack token-like value" }, +]; + +export function scanPackageManagerSecrets(options: PackageManagerScanOptions = {}): PackageManagerScanResult { + const cwd = options.cwd ? resolve(options.cwd) : process.cwd(); + const roots = (options.roots && options.roots.length > 0 ? options.roots : [cwd]) + .map((root) => resolve(cwd, root)); + const findings: PackageManagerFinding[] = []; + let scannedFiles = 0; + + for (const root of roots) { + if (!existsSync(root)) continue; + const tracked = trackedFiles(root); + for (const file of collectRepoFiles(root)) { + const rel = toPosix(relative(root, file)); + const isTracked = tracked.has(rel); + const text = readTextFile(file); + if (text === null) continue; + scannedFiles++; + findings.push(...scanFile(file, text, classifyRepoFile(file), isTracked, root)); + } + } + + if (options.includeHome) { + const home = homedir(); + for (const name of HOME_FILES) { + const file = join(home, name); + if (!existsSync(file)) continue; + const text = readTextFile(file); + if (text === null) continue; + scannedFiles++; + findings.push(...scanFile(file, text, classifyHomeFile(name), false, home)); + } + } + + findings.sort((a, b) => a.path.localeCompare(b.path) || a.line - b.line || a.rule.localeCompare(b.rule)); + + return { + clean: findings.length === 0, + scannedFiles, + scannedRoots: roots, + findings, + }; +} + +function collectRepoFiles(root: string): string[] { + const out: string[] = []; + const visit = (dir: string) => { + for (const entry of readdirSync(dir, { withFileTypes: true })) { + if (entry.isDirectory()) { + if (SKIP_DIRS.has(entry.name)) continue; + visit(join(dir, entry.name)); + continue; + } + if (!entry.isFile()) continue; + const file = join(dir, entry.name); + if (shouldScanRepoFile(file)) out.push(file); + } + }; + visit(root); + return out; +} + +function shouldScanRepoFile(file: string): boolean { + const name = basename(file); + return name === ".npmrc" || isBunConfigName(name) || LOCKFILE_NAMES.has(name); +} + +function classifyRepoFile(file: string): PackageManagerSurface { + const name = basename(file); + if (name === ".npmrc") return "repo-npmrc"; + if (isBunConfigName(name)) return "bun-config"; + return "lockfile"; +} + +function classifyHomeFile(name: string): PackageManagerSurface { + if (name === ".npmrc") return "home-npmrc"; + if (isBunConfigName(name)) return "bun-config"; + return "shell-profile"; +} + +function isBunConfigName(name: string): boolean { + return name === "bunfig.toml" || name === ".bunfig.toml"; +} + +function readTextFile(file: string): string | null { + try { + const stat = lstatSync(file); + if (!stat.isFile() || stat.size > 5_000_000) return null; + const buf = readFileSync(file); + if (buf.includes(0)) return null; + return buf.toString("utf-8"); + } catch { + return null; + } +} + +function scanFile(file: string, text: string, surface: PackageManagerSurface, tracked: boolean, root: string): PackageManagerFinding[] { + const findings: PackageManagerFinding[] = []; + const path = displayPath(file, root); + const lines = text.split(/\r?\n/); + let inBunReleaseAgeExcludes = false; + for (let i = 0; i < lines.length; i++) { + const line = lines[i]!; + const lineNo = i + 1; + if (surface === "repo-npmrc" || surface === "home-npmrc") { + findings.push(...scanNpmrcLine(line, path, lineNo, surface, tracked)); + } else if (surface === "bun-config") { + const bun = scanBunConfigLine(line, path, lineNo, tracked, inBunReleaseAgeExcludes); + findings.push(...bun.findings); + inBunReleaseAgeExcludes = bun.inReleaseAgeExcludes; + } else if (surface === "shell-profile") { + findings.push(...scanShellProfileLine(line, path, lineNo, tracked)); + } else { + findings.push(...scanLockfileLine(line, path, lineNo, tracked)); + } + } + return findings; +} + +function scanNpmrcLine(lineText: string, path: string, line: number, surface: PackageManagerSurface, tracked: boolean): PackageManagerFinding[] { + const findings: PackageManagerFinding[] = []; + const stripped = lineText.trim(); + if (stripped === "" || stripped.startsWith("#") || stripped.startsWith(";")) return findings; + + const auth = stripped.match(/(?:^|:)(_[A-Za-z]*(?:auth|password)[A-Za-z]*|password)\s*=\s*(.+)$/i); + if (auth) { + const value = stripQuotes(stripInlineComment(auth[2]!.trim())); + if (value && !isSafeReference(value)) { + findings.push({ + path, + line, + rule: "npmrc-literal-auth", + surface, + severity: "error", + tracked, + detail: tracked + ? "tracked npm auth entry uses a literal value" + : "npm auth entry uses a literal value", + }); + } + } + + findings.push(...scanKnownTokenPatterns(stripped, path, line, surface, tracked)); + return findings; +} + +function scanBunConfigLine( + lineText: string, + path: string, + line: number, + tracked: boolean, + inReleaseAgeExcludes: boolean, +): { findings: PackageManagerFinding[]; inReleaseAgeExcludes: boolean } { + const findings: PackageManagerFinding[] = []; + const stripped = lineText.trim(); + if (stripped === "" || stripped.startsWith("#")) return { findings, inReleaseAgeExcludes }; + + if (/^minimumReleaseAge\s*=\s*(0|"0"|'0')\s*(?:#.*)?$/i.test(stripped)) { + findings.push({ + path, + line, + rule: "bun-release-age-disabled", + surface: "bun-config", + severity: "error", + tracked, + detail: "Bun release-age quarantine is disabled", + }); + } + + const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped); + const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes; + if (scanExcludes) { + const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]!); + for (const item of quoted) { + if (item === "*" || item.endsWith("/*") || !item.startsWith("@hasna/")) { + findings.push({ + path, + line, + rule: "bun-release-age-broad-exclude", + surface: "bun-config", + severity: "error", + tracked, + detail: "Bun release-age exclude must be an exact @hasna package name", + }); + } + } + } + + const nextInReleaseAgeExcludes = startsReleaseAgeExcludes + ? stripped.includes("[") && !stripped.includes("]") + : inReleaseAgeExcludes && !stripped.includes("]"); + findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked)); + return { findings, inReleaseAgeExcludes: nextInReleaseAgeExcludes }; +} + +function scanShellProfileLine(lineText: string, path: string, line: number, tracked: boolean): PackageManagerFinding[] { + const findings: PackageManagerFinding[] = []; + const stripped = lineText.trim(); + if (stripped === "" || stripped.startsWith("#")) return findings; + + const assignment = stripped.match(/^(?:export\s+)?(NPM(?:_CONFIG)?_[A-Z0-9_]*TOKEN|NODE_AUTH_TOKEN|NPM_TOKEN)\s*=\s*(.+)$/); + if (assignment) { + const value = stripQuotes(stripInlineComment(assignment[2]!.trim())); + if (value && !isSafeReference(value)) { + findings.push({ + path, + line, + rule: "shell-literal-package-token", + surface: "shell-profile", + severity: "error", + tracked, + detail: "shell profile package-manager token uses a literal value", + }); + } + } + + findings.push(...scanKnownTokenPatterns(stripped, path, line, "shell-profile", tracked)); + return findings; +} + +function scanLockfileLine(lineText: string, path: string, line: number, tracked: boolean): PackageManagerFinding[] { + const findings = scanKnownTokenPatterns(lineText, path, line, "lockfile", tracked); + if (/(?:^|:)_authToken\s*=\s*/i.test(lineText) && !/\$\{[A-Z0-9_]+\}|\{\{[A-Z0-9_]+\}\}/.test(lineText)) { + findings.push({ + path, + line, + rule: "lockfile-auth-token", + surface: "lockfile", + severity: "error", + tracked, + detail: "lockfile contains package-manager auth token material", + }); + } + return findings; +} + +function scanKnownTokenPatterns(lineText: string, path: string, line: number, surface: PackageManagerSurface, tracked: boolean): PackageManagerFinding[] { + const findings: PackageManagerFinding[] = []; + for (const pattern of TOKEN_VALUE_PATTERNS) { + if (pattern.re.test(lineText)) { + findings.push({ + path, + line, + rule: pattern.rule, + surface, + severity: "error", + tracked, + detail: pattern.detail, + }); + } + } + return findings; +} + +function trackedFiles(root: string): Set { + try { + const output = execFileSync("git", ["-C", root, "ls-files", "-z"], { + encoding: "utf-8", + stdio: ["ignore", "pipe", "ignore"], + }); + return new Set(output.split("\0").filter(Boolean).map(toPosix)); + } catch { + return new Set(); + } +} + +function isSafeReference(value: string): boolean { + const trimmed = stripQuotes(value.trim()); + return ( + /^\$\{[A-Z][A-Z0-9_]*\}$/.test(trimmed) || + /^\$[A-Z][A-Z0-9_]*$/.test(trimmed) || + /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(trimmed) || + /^%[A-Z][A-Z0-9_]*%$/.test(trimmed) + ); +} + +function stripQuotes(value: string): string { + if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith("'") && value.endsWith("'"))) { + return value.slice(1, -1); + } + return value; +} + +function stripInlineComment(value: string): string { + return value.replace(/\s[#;].*$/, "").trim(); +} + +function displayPath(file: string, root: string): string { + const home = homedir(); + if (root === home && (file === home || file.startsWith(home + "/"))) return "~/" + toPosix(relative(home, file)); + if (isAbsolute(root) && file.startsWith(root + "/")) return toPosix(relative(root, file)); + if (file === home || file.startsWith(home + "/")) return "~/" + toPosix(relative(home, file)); + return file; +} + +function toPosix(path: string): string { + return path.split("\\").join("/"); +} diff --git a/src/lib/redact.test.ts b/src/lib/redact.test.ts index e86a519..02ba60a 100644 --- a/src/lib/redact.test.ts +++ b/src/lib/redact.test.ts @@ -84,10 +84,15 @@ describe("redactContent — toml", () => { }); describe("redactContent — ini/.npmrc", () => { - test("redacts //registry:_authToken=value", () => { + test("redacts npmrc auth value to npm env reference", () => { const r = redactContent("//registry.npmjs.org/:_authToken=npm_ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890", "ini"); - expect(r.content).toBe("//registry.npmjs.org/:_authToken={{NPM_AUTH_TOKEN}}"); - expect(r.redacted[0]!.varName).toBe("NPM_AUTH_TOKEN"); + expect(r.content).toBe("//registry.npmjs.org/:_authToken=${NPM_TOKEN}"); + expect(r.redacted[0]!.varName).toBe("NPM_TOKEN"); + }); + + test("does not flag npm env references as secrets", () => { + const r = redactContent("//registry.npmjs.org/:_authToken=${NPM_TOKEN}", "ini"); + expect(r.redacted).toHaveLength(0); }); }); diff --git a/src/lib/redact.ts b/src/lib/redact.ts index 1168fca..653d220 100644 --- a/src/lib/redact.ts +++ b/src/lib/redact.ts @@ -147,9 +147,9 @@ function redactIni(content: string): RedactResult { const line = lines[i]!; // //registry:_authToken=value (npmrc style) const authM = line.match(/^(\/\/[^:]+:_authToken=)(.+)$/); - if (authM && !authM[2]!.startsWith("{{")) { - redacted.push({ varName: "NPM_AUTH_TOKEN", line: i + 1, reason: "npm auth token" }); - out.push(`${authM[1]}{{NPM_AUTH_TOKEN}}`); + if (authM && !isReferenceValue(authM[2]!.trim())) { + redacted.push({ varName: "NPM_TOKEN", line: i + 1, reason: "npm auth token" }); + out.push(`${authM[1]}\${NPM_TOKEN}`); continue; } // key=value @@ -197,6 +197,7 @@ function redactGeneric(content: string): RedactResult { function shouldRedactKeyValue(key: string, value: string): boolean { if (!value || value.startsWith("{{")) return false; // already redacted + if (isReferenceValue(value.trim())) return false; // env/template references are safe to store if (value.length < MIN_SECRET_VALUE_LEN) return false; // Skip obviously non-secret values if (/^(true|false|yes|no|on|off|null|undefined|\d+)$/i.test(value)) return false; @@ -217,6 +218,15 @@ function reasonFor(key: string, value: string): string { return "secret value pattern"; } +function isReferenceValue(value: string): boolean { + return ( + /^\{\{[A-Z][A-Z0-9_]*\}\}$/.test(value) || + /^\$\{[A-Z][A-Z0-9_]*\}$/.test(value) || + /^\$[A-Z][A-Z0-9_]*$/.test(value) || + /^%[A-Z][A-Z0-9_]*%$/.test(value) + ); +} + // ── Public API ──────────────────────────────────────────────────────────────── export type RedactFormat = "shell" | "json" | "toml" | "ini" | "markdown" | "text" | "yaml"; From 2b765f8d56133f84735407c7eb3968094f1928e6 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Mon, 6 Jul 2026 16:23:38 +0300 Subject: [PATCH 2/5] fix: harden package manager guard edge cases --- src/lib/package-manager-guard.test.ts | 45 +++++++- src/lib/package-manager-guard.ts | 158 +++++++++++++++++++------- 2 files changed, 159 insertions(+), 44 deletions(-) diff --git a/src/lib/package-manager-guard.test.ts b/src/lib/package-manager-guard.test.ts index c18b50a..61d929d 100644 --- a/src/lib/package-manager-guard.test.ts +++ b/src/lib/package-manager-guard.test.ts @@ -50,19 +50,60 @@ describe("scanPackageManagerSecrets", () => { }); }); - test("flags disabled Bun release-age quarantine and broad excludes", () => { + test("flags npmrc examples and credentialed registry URLs", () => { + withTempRepo((dir) => { + const credentialedRegistry = "https://user:" + "literal-value" + "@registry.npmjs.org/"; + writeFileSync(join(dir, ".npmrc.example"), [ + `@hasna:registry=${credentialedRegistry}`, + "//registry.npmjs.org/:_authToken=${NPM_TOKEN}", + "", + ].join("\n")); + + const result = scanPackageManagerSecrets({ roots: [dir] }); + expect(result.clean).toBe(false); + expect(result.findings.map((finding) => finding.rule)).toContain("package-manager-url-credentials"); + }); + }); + + test("handles direct package-manager file paths", () => { + withTempRepo((dir) => { + const npmrc = join(dir, ".npmrc"); + const authKey = "_auth" + "Token"; + writeFileSync(npmrc, `//registry.npmjs.org/:${authKey}=literal-value\n`); + + const result = scanPackageManagerSecrets({ roots: [npmrc] }); + const json = JSON.stringify(result); + expect(result.clean).toBe(false); + expect(result.scannedFiles).toBe(1); + expect(result.findings.map((finding) => finding.rule)).toContain("npmrc-literal-auth"); + expect(json).not.toContain("literal-value"); + }); + }); + + test("flags missing or disabled Bun release-age quarantine and broad excludes", () => { withTempRepo((dir) => { writeFileSync(join(dir, ".bunfig.toml"), [ "minimumReleaseAge = 0", "minimumReleaseAgeExcludes = [", ' "@hasna/*",', ' "lodash"', + ' "@hasna/configs*",', + ' "@hasna/configs/extra"', "]", ].join("\n")); const result = scanPackageManagerSecrets({ roots: [dir] }); expect(result.findings.map((finding) => finding.rule)).toContain("bun-release-age-disabled"); - expect(result.findings.filter((finding) => finding.rule === "bun-release-age-broad-exclude")).toHaveLength(2); + expect(result.findings.filter((finding) => finding.rule === "bun-release-age-broad-exclude")).toHaveLength(4); + }); + }); + + test("flags Bun configs that omit minimumReleaseAge", () => { + withTempRepo((dir) => { + writeFileSync(join(dir, ".bunfig.toml"), 'minimumReleaseAgeExcludes = ["@hasna/configs"]\n'); + + const result = scanPackageManagerSecrets({ roots: [dir] }); + expect(result.findings.map((finding) => finding.rule)).toContain("bun-release-age-missing"); }); }); }); diff --git a/src/lib/package-manager-guard.ts b/src/lib/package-manager-guard.ts index fc1a487..76085d7 100644 --- a/src/lib/package-manager-guard.ts +++ b/src/lib/package-manager-guard.ts @@ -1,7 +1,7 @@ import { execFileSync } from "node:child_process"; import { existsSync, lstatSync, readdirSync, readFileSync } from "node:fs"; import { homedir } from "node:os"; -import { basename, isAbsolute, join, relative, resolve } from "node:path"; +import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path"; export type PackageManagerSurface = | "repo-npmrc" @@ -83,6 +83,17 @@ export function scanPackageManagerSecrets(options: PackageManagerScanOptions = { for (const root of roots) { if (!existsSync(root)) continue; + const stat = lstatSync(root); + if (stat.isFile()) { + if (!shouldScanRepoFile(root)) continue; + const text = readTextFile(root); + if (text === null) continue; + scannedFiles++; + findings.push(...scanFile(root, text, classifyRepoFile(root), isTrackedFile(root), dirname(root))); + continue; + } + if (!stat.isDirectory()) continue; + const tracked = trackedFiles(root); for (const file of collectRepoFiles(root)) { const rel = toPosix(relative(root, file)); @@ -136,12 +147,12 @@ function collectRepoFiles(root: string): string[] { function shouldScanRepoFile(file: string): boolean { const name = basename(file); - return name === ".npmrc" || isBunConfigName(name) || LOCKFILE_NAMES.has(name); + return isNpmrcName(name) || isBunConfigName(name) || LOCKFILE_NAMES.has(name); } function classifyRepoFile(file: string): PackageManagerSurface { const name = basename(file); - if (name === ".npmrc") return "repo-npmrc"; + if (isNpmrcName(name)) return "repo-npmrc"; if (isBunConfigName(name)) return "bun-config"; return "lockfile"; } @@ -156,6 +167,10 @@ function isBunConfigName(name: string): boolean { return name === "bunfig.toml" || name === ".bunfig.toml"; } +function isNpmrcName(name: string): boolean { + return name === ".npmrc" || name.startsWith(".npmrc.") || name.endsWith(".npmrc"); +} + function readTextFile(file: string): string | null { try { const stat = lstatSync(file); @@ -171,17 +186,14 @@ function readTextFile(file: string): string | null { function scanFile(file: string, text: string, surface: PackageManagerSurface, tracked: boolean, root: string): PackageManagerFinding[] { const findings: PackageManagerFinding[] = []; const path = displayPath(file, root); + if (surface === "bun-config") return scanBunConfigFile(text, path, tracked); + const lines = text.split(/\r?\n/); - let inBunReleaseAgeExcludes = false; for (let i = 0; i < lines.length; i++) { const line = lines[i]!; const lineNo = i + 1; if (surface === "repo-npmrc" || surface === "home-npmrc") { findings.push(...scanNpmrcLine(line, path, lineNo, surface, tracked)); - } else if (surface === "bun-config") { - const bun = scanBunConfigLine(line, path, lineNo, tracked, inBunReleaseAgeExcludes); - findings.push(...bun.findings); - inBunReleaseAgeExcludes = bun.inReleaseAgeExcludes; } else if (surface === "shell-profile") { findings.push(...scanShellProfileLine(line, path, lineNo, tracked)); } else { @@ -214,57 +226,79 @@ function scanNpmrcLine(lineText: string, path: string, line: number, surface: Pa } } + findings.push(...scanCredentialedUrl(stripped, path, line, surface, tracked)); findings.push(...scanKnownTokenPatterns(stripped, path, line, surface, tracked)); return findings; } -function scanBunConfigLine( - lineText: string, - path: string, - line: number, - tracked: boolean, - inReleaseAgeExcludes: boolean, -): { findings: PackageManagerFinding[]; inReleaseAgeExcludes: boolean } { +function scanBunConfigFile(text: string, path: string, tracked: boolean): PackageManagerFinding[] { const findings: PackageManagerFinding[] = []; - const stripped = lineText.trim(); - if (stripped === "" || stripped.startsWith("#")) return { findings, inReleaseAgeExcludes }; - - if (/^minimumReleaseAge\s*=\s*(0|"0"|'0')\s*(?:#.*)?$/i.test(stripped)) { - findings.push({ - path, - line, - rule: "bun-release-age-disabled", - surface: "bun-config", - severity: "error", - tracked, - detail: "Bun release-age quarantine is disabled", - }); - } + const lines = text.split(/\r?\n/); + let inReleaseAgeExcludes = false; + let hasMinimumReleaseAge = false; - const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped); - const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes; - if (scanExcludes) { - const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]!); - for (const item of quoted) { - if (item === "*" || item.endsWith("/*") || !item.startsWith("@hasna/")) { + for (let i = 0; i < lines.length; i++) { + const lineText = lines[i]!; + const line = i + 1; + const stripped = lineText.trim(); + if (stripped === "" || stripped.startsWith("#")) continue; + + const releaseAge = stripped.match(/^minimumReleaseAge\s*=\s*(?:"([^"]+)"|'([^']+)'|([0-9]+))\s*(?:#.*)?$/i); + if (releaseAge) { + hasMinimumReleaseAge = true; + const rawValue = releaseAge[1] ?? releaseAge[2] ?? releaseAge[3] ?? ""; + const value = Number(rawValue); + if (!Number.isFinite(value) || value <= 0) { findings.push({ path, line, - rule: "bun-release-age-broad-exclude", + rule: "bun-release-age-disabled", surface: "bun-config", severity: "error", tracked, - detail: "Bun release-age exclude must be an exact @hasna package name", + detail: "Bun release-age quarantine is disabled", }); } } + + const startsReleaseAgeExcludes = /minimumReleaseAgeExcludes/i.test(stripped); + const scanExcludes = startsReleaseAgeExcludes || inReleaseAgeExcludes; + if (scanExcludes) { + const quoted = [...stripped.matchAll(/["']([^"']+)["']/g)].map((m) => m[1]!); + for (const item of quoted) { + if (!isExactHasnaPackageName(item)) { + findings.push({ + path, + line, + rule: "bun-release-age-broad-exclude", + surface: "bun-config", + severity: "error", + tracked, + detail: "Bun release-age exclude must be an exact @hasna package name", + }); + } + } + } + + inReleaseAgeExcludes = startsReleaseAgeExcludes + ? stripped.includes("[") && !stripped.includes("]") + : inReleaseAgeExcludes && !stripped.includes("]"); + findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked)); } - const nextInReleaseAgeExcludes = startsReleaseAgeExcludes - ? stripped.includes("[") && !stripped.includes("]") - : inReleaseAgeExcludes && !stripped.includes("]"); - findings.push(...scanKnownTokenPatterns(stripped, path, line, "bun-config", tracked)); - return { findings, inReleaseAgeExcludes: nextInReleaseAgeExcludes }; + if (!hasMinimumReleaseAge) { + findings.push({ + path, + line: 1, + rule: "bun-release-age-missing", + surface: "bun-config", + severity: "error", + tracked, + detail: "Bun release-age quarantine must be configured with a positive minimumReleaseAge", + }); + } + + return findings; } function scanShellProfileLine(lineText: string, path: string, line: number, tracked: boolean): PackageManagerFinding[] { @@ -326,6 +360,26 @@ function scanKnownTokenPatterns(lineText: string, path: string, line: number, su return findings; } +function scanCredentialedUrl(lineText: string, path: string, line: number, surface: PackageManagerSurface, tracked: boolean): PackageManagerFinding[] { + const findings: PackageManagerFinding[] = []; + for (const match of lineText.matchAll(/\bhttps?:\/\/([^/\s#;]+)@/gi)) { + const userInfo = match[1]!; + const password = userInfo.includes(":") ? userInfo.split(":").slice(1).join(":") : userInfo; + if (password && !isSafeReference(password)) { + findings.push({ + path, + line, + rule: "package-manager-url-credentials", + surface, + severity: "error", + tracked, + detail: "package-manager URL embeds literal credentials", + }); + } + } + return findings; +} + function trackedFiles(root: string): Set { try { const output = execFileSync("git", ["-C", root, "ls-files", "-z"], { @@ -338,6 +392,26 @@ function trackedFiles(root: string): Set { } } +function isTrackedFile(file: string): boolean { + try { + const repoRoot = execFileSync("git", ["-C", dirname(file), "rev-parse", "--show-toplevel"], { + encoding: "utf-8", + stdio: ["ignore", "pipe", "ignore"], + }).trim(); + const rel = toPosix(relative(repoRoot, file)); + execFileSync("git", ["-C", repoRoot, "ls-files", "--error-unmatch", "--", rel], { + stdio: ["ignore", "ignore", "ignore"], + }); + return true; + } catch { + return false; + } +} + +function isExactHasnaPackageName(item: string): boolean { + return /^@hasna\/[a-z0-9][a-z0-9._-]*$/.test(item); +} + function isSafeReference(value: string): boolean { const trimmed = stripQuotes(value.trim()); return ( From f95ba2ef1a5f15ec006f350a977750b4ab559614 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Mon, 6 Jul 2026 07:35:31 -0700 Subject: [PATCH 3/5] feat: self-host @hasna/instructions (rename from @hasna/configs) + live service (#3) * chore: rename @hasna/configs -> @hasna/instructions Package, SDK package, CLI program name, status contract package name, and docs rebranded to @hasna/instructions. The MCP server identity, the configs-mcp bin alias, the events source, the status service field, and the local data dir are intentionally kept as 'configs' for fleet continuity (fleet rename is a separate controlled step). * feat: self-hosted service surfaces (serve /v1 + auth + SDK) - instructions-serve gains GET /health,/ready,/version and a versioned /v1 cloud API (configs, profiles, snapshots, stats). - A1 pure-remote store: /v1 reads/writes the shared RDS Postgres directly via the vendored storage kit; no local sync/cache in the service. - Per-request @hasna/contracts API-key auth (instructions:read / :write); fail-closed 503 when unconfigured. - OpenAPI 3.1 document served at /openapi.json and used to generate the typed InstructionsV1Client SDK. - Idempotent schema (never clobbers) + migrations dir + one-shot migrate runner. * feat: deploy artifacts (ARM64 Dockerfile, compose, contract, vendored kit) - ARM64/bun multi-stage Dockerfile; default CMD runs instructions-serve, the migrate subcommand is the ECS one-shot migration task. - docker-compose.yml for local cloud-mode stack. - hasna.contract.json service manifest (bins, storage, service metadata; MCP name kept 'configs' aliased). - Vendored @hasna/contracts storage kit 0.4.1 + Amazon RDS global CA bundle. --- .gitignore | 2 +- AGENTS.md | 2 +- CLAUDE.md | 2 +- Dockerfile | 39 + README.md | 125 +- bun.lock | 344 +++ docker-compose.yml | 46 + docker/rds-global-bundle.pem | 2736 +++++++++++++++++ hasna.contract.json | 36 + migrations/0001_instructions.sql | 61 + migrations/0002_api_keys.sql | 20 + package.json | 27 +- scripts/generate-sdk.ts | 31 + sdk/README.md | 10 +- sdk/bun.lock | 24 + sdk/package.json | 6 +- sdk/src/index.ts | 15 +- sdk/src/v1.generated.ts | 179 ++ src/cli/index.tsx | 2 +- .../storage-kit/.storage-kit-manifest.json | 14 + src/generated/storage-kit/README.md | 41 + src/generated/storage-kit/health.ts | 67 + src/generated/storage-kit/index.ts | 23 + src/generated/storage-kit/migrations.ts | 163 + src/generated/storage-kit/mode.ts | 146 + src/generated/storage-kit/pool.ts | 101 + src/generated/storage-kit/query.ts | 114 + src/generated/storage-kit/tls.ts | 122 + src/lib/package-version.ts | 30 + src/server/cloud.ts | 172 ++ src/server/index.ts | 86 +- src/server/openapi.ts | 263 ++ src/server/v1.ts | 166 + src/status.ts | 4 +- src/storage/cloud-store.ts | 398 +++ src/storage/schema.ts | 68 + 36 files changed, 5618 insertions(+), 67 deletions(-) create mode 100644 Dockerfile create mode 100644 bun.lock create mode 100644 docker-compose.yml create mode 100644 docker/rds-global-bundle.pem create mode 100644 hasna.contract.json create mode 100644 migrations/0001_instructions.sql create mode 100644 migrations/0002_api_keys.sql create mode 100644 scripts/generate-sdk.ts create mode 100644 sdk/bun.lock create mode 100644 sdk/src/v1.generated.ts create mode 100644 src/generated/storage-kit/.storage-kit-manifest.json create mode 100644 src/generated/storage-kit/README.md create mode 100644 src/generated/storage-kit/health.ts create mode 100644 src/generated/storage-kit/index.ts create mode 100644 src/generated/storage-kit/migrations.ts create mode 100644 src/generated/storage-kit/mode.ts create mode 100644 src/generated/storage-kit/pool.ts create mode 100644 src/generated/storage-kit/query.ts create mode 100644 src/generated/storage-kit/tls.ts create mode 100644 src/lib/package-version.ts create mode 100644 src/server/cloud.ts create mode 100644 src/server/openapi.ts create mode 100644 src/server/v1.ts create mode 100644 src/storage/cloud-store.ts create mode 100644 src/storage/schema.ts diff --git a/.gitignore b/.gitignore index 1b616e6..9e8b67d 100644 --- a/.gitignore +++ b/.gitignore @@ -9,4 +9,4 @@ sdk/node_modules/ *.db-wal .env .env.local -bun.lock +.hasna/ diff --git a/AGENTS.md b/AGENTS.md index 6226608..6732b4a 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,4 +1,4 @@ -# AGENTS.md — How AI Agents Should Use @hasna/configs +# AGENTS.md — How AI Agents Should Use @hasna/instructions ## MCP Setup diff --git a/CLAUDE.md b/CLAUDE.md index 1f5ee36..9c65e90 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -38,7 +38,7 @@ src/cli/index.tsx — 28 CLI commands (Commander + chalk) src/mcp/index.ts — 16 MCP tools (lean stubs + CONFIGS_PROFILE) src/server/index.ts — Hono REST API (port 3457, serves dashboard + ?fields=) src/index.ts — library exports -sdk/ — @hasna/configs-sdk (zero-dep fetch client) +sdk/ — @hasna/instructions-sdk (zero-dep fetch client) dashboard/ — React+Vite (5 pages) ``` diff --git a/Dockerfile b/Dockerfile new file mode 100644 index 0000000..986c9ad --- /dev/null +++ b/Dockerfile @@ -0,0 +1,39 @@ +# syntax=docker/dockerfile:1 +# @hasna/instructions self_hosted service — ARM64 / Bun. +# Default CMD runs instructions-serve (cloud / PURE REMOTE per Amendment A1: the +# serve process reads/writes RDS Postgres directly with @hasna/contracts API-key +# auth). The ECS one-shot migration task overrides the command with `... migrate`. + +FROM --platform=linux/arm64 oven/bun:1 AS deps +WORKDIR /app +COPY package.json bun.lock ./ +COPY dashboard/package.json ./dashboard/package.json +RUN bun install --frozen-lockfile --ignore-scripts + +FROM --platform=linux/arm64 oven/bun:1 AS build +WORKDIR /app +COPY package.json bun.lock tsconfig.json ./ +COPY --from=deps /app/node_modules ./node_modules +COPY src ./src +COPY scripts ./scripts +RUN bun run build:server + +FROM --platform=linux/arm64 oven/bun:1 AS runner +WORKDIR /app +# Amazon RDS global CA bundle so TLS to the shared RDS succeeds under +# verify-full-capable clients. +COPY docker/rds-global-bundle.pem /etc/ssl/certs/rds-global-bundle.pem +ENV NODE_ENV=production \ + HASNA_INSTRUCTIONS_STORAGE_MODE=cloud \ + NODE_EXTRA_CA_CERTS=/etc/ssl/certs/rds-global-bundle.pem \ + PGSSLROOTCERT=/etc/ssl/certs/rds-global-bundle.pem \ + INSTRUCTIONS_NO_OPEN=true \ + HOST=0.0.0.0 \ + PORT=8080 +COPY package.json bun.lock ./ +COPY --from=deps /app/node_modules ./node_modules +COPY --from=build /app/dist ./dist +EXPOSE 8080 +# Fail-closed: instructions-serve /v1 refuses to serve without a cloud DSN + +# signing secret (503), and /ready reports DB reachability — no silent stub. +CMD ["bun", "dist/server/index.js"] diff --git a/README.md b/README.md index b51a2ff..b887246 100644 --- a/README.md +++ b/README.md @@ -1,27 +1,32 @@ -# @hasna/configs +# @hasna/instructions -AI coding agent configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + REST API + Dashboard. +> Formerly `@hasna/configs`. Same tool, renamed. The MCP server keeps the +> `configs` name aliased so existing fleet MCP configs keep working. -[![npm](https://img.shields.io/npm/v/@hasna/configs)](https://www.npmjs.com/package/@hasna/configs) +AI coding agent instruction & configuration manager — store, version, apply, and +share all your AI coding configs and instruction sources. CLI + MCP + HTTP API +(`instructions-serve`) + generated SDK + Dashboard. + +[![npm](https://img.shields.io/npm/v/@hasna/instructions)](https://www.npmjs.com/package/@hasna/instructions) [![License](https://img.shields.io/badge/license-Apache--2.0-blue)](LICENSE) ## Install ```bash -npm install -g @hasna/configs +npm install -g @hasna/instructions ``` ## CLI Usage ```bash -configs --help -configs list # compact, paged summary -configs list --verbose # expanded metadata, still paged -configs list --json # full machine-readable records -configs show # full metadata + content -configs inspect # alias for show -configs profile resolve -configs profile apply --auto +instructions --help +instructions list # compact, paged summary +instructions list --verbose # expanded metadata, still paged +instructions list --json # full machine-readable records +instructions show # full metadata + content +instructions inspect # alias for show +instructions profile resolve +instructions profile apply --auto ``` Collection commands are compact by default to keep agent terminals and context @@ -35,63 +40,103 @@ small. Human output is capped at 20 rows unless you pass `--limit`; use ## MCP Server ```bash -configs-mcp +instructions-mcp # or the aliased binary: configs-mcp ``` -Agent-facing MCP tools follow the same gradual disclosure model. `list_configs` -and `list_profiles` return paged compact envelopes by default and accept -`limit`, `cursor`, and `verbose`. `apply_config` and `apply_profile` omit +The MCP server identity is intentionally kept as `configs` so the existing +fleet MCP configuration keeps working; the fleet rename is a separate controlled +step. Agent-facing MCP tools follow the same gradual disclosure model. +`list_configs` and `list_profiles` return paged compact envelopes by default and +accept `limit`, `cursor`, and `verbose`. `apply_config` and `apply_profile` omit `previous_content` and `new_content` unless `verbose: true` is passed. Use `get_config` when full config content is needed. -## HTTP mode +## HTTP mode (MCP) + +```bash +instructions-mcp --http # http://127.0.0.1:8807/mcp +MCP_HTTP=1 instructions-mcp +``` + +Health: `GET http://127.0.0.1:8807/health`. MCP is also mounted on +`instructions-serve` at `/mcp`. + +## HTTP API server (`instructions-serve`) ```bash -configs-mcp --http # http://127.0.0.1:8807/mcp -MCP_HTTP=1 configs-mcp +instructions-serve ``` -Health: `GET http://127.0.0.1:8807/health`. MCP is also mounted on `configs-serve` at `/mcp`. +Surfaces: -## REST API +- `GET /health`, `GET /ready`, `GET /version` → `{ status, version, mode }` +- `GET /openapi.json`, `GET /v1/openapi.json` → the OpenAPI 3.1 document the SDK + is generated from. +- `/v1/*` — versioned cloud API (configs, profiles, snapshots, stats). +- `/api/*` — the local dashboard/REST surface. + +### Cloud mode (self-hosted, Amendment A1 pure-remote) + +When `HASNA_INSTRUCTIONS_DATABASE_URL` is set the `/v1` API reads/writes the +shared cloud Postgres **directly** (no local sync/cache in the service) and every +`/v1` request is authenticated with a `@hasna/contracts` API key +(`x-api-key` or `Authorization: Bearer`). Reads need `instructions:read`, writes +need `instructions:write` (an `instructions:*` key satisfies both). ```bash -configs-serve +# apply the schema (idempotent; never clobbers existing tables) +instructions-serve migrate + +# mint a key with the SAME signing secret the server verifies with +contracts issue-key --app instructions --scopes 'instructions:*' ``` -## Storage Sync +Env: `HASNA_INSTRUCTIONS_DATABASE_URL` (DSN) and +`HASNA_INSTRUCTIONS_API_SIGNING_KEY` (HMAC signing secret; `HASNA_API_SIGNING_KEY` +and `API_KEY_SIGNING_SECRET` are also accepted). Client apps use +`INSTRUCTIONS_API_URL` + `INSTRUCTIONS_API_KEY` — never a DSN. + +## SDK + +`@hasna/instructions-sdk` ships a zero-dependency typed client. The versioned +`InstructionsV1Client` is generated from the serve OpenAPI document +(`bun run generate:sdk`). + +## Storage Sync (local CLI) -This package supports optional remote storage sync through a package-local Postgres connection: +The local CLI supports optional remote storage sync through a package-local +Postgres connection: ```bash -export HASNA_CONFIGS_DATABASE_URL=postgres://... -configs storage status -configs storage push -configs storage pull -configs storage sync +export HASNA_INSTRUCTIONS_DATABASE_URL=postgres://... +instructions storage status +instructions storage push +instructions storage pull +instructions storage sync ``` -The MCP server also exposes `storage_status`, `storage_push`, `storage_pull`, and `storage_sync`. +The MCP server also exposes `storage_status`, `storage_push`, `storage_pull`, and +`storage_sync`. ## Data Directory -Data is stored in `~/.hasna/configs/`. +Local data is stored in `~/.hasna/configs/` (unchanged, for fleet continuity). ## Session Instruction Rendering -`configs session plan` and `configs session apply` render OpenIdentities and -OpenConfigs instruction sources into provider-native files for Claude, Codex, -Cursor, OpenCode, and Codewith. +`instructions session plan` and `instructions session apply` render +OpenIdentities and instruction sources into provider-native files for Claude, +Codex, Cursor, OpenCode, and Codewith. ```bash -configs session plan \ +instructions session plan \ --tool codewith \ --profile account999 \ --identity-export ./instructions.json \ --source project:repo-rules=./CODEWITH.md \ --json -configs session apply \ +instructions session apply \ --tool codex \ --profile account999 \ --identity-export ./instructions.json @@ -106,12 +151,14 @@ writes local snapshots before mutating managed files. ## Machine-aware Profiles -`configs init` now seeds two platform profiles: +`instructions init` seeds two platform profiles: - `linux-arm64` for `linux-node-a` / `linux-node-b` - `macos-arm64` for `macos-node-a` / `macos-node-b` -These profiles resolve machine variables like `{{WORKSPACE_ROOT}}`, `{{BUN_BIN_DIR}}`, `{{BUN_PATH}}`, and `{{PATH_PREFIX}}`, so synced configs can be portable across Linux and macOS arm64 machines. +These profiles resolve machine variables like `{{WORKSPACE_ROOT}}`, +`{{BUN_BIN_DIR}}`, `{{BUN_PATH}}`, and `{{PATH_PREFIX}}`, so synced configs can be +portable across Linux and macOS arm64 machines. They also include project dashboard variables used by agent-managed project workflows: @@ -121,7 +168,7 @@ workflows: - `{{PROJECT_DASHBOARD_SNAPSHOTS_DIR}}` -> `.hasna/project/dashboard/snapshots` - `{{PROJECT_CHANNEL_PREFIX}}` -> `iproj-` -`configs init` and `bun run seed` seed the +`instructions init` and `bun run seed` seed the `agent-managed-project-dashboard-standard` reference. It documents the standard `.hasna/project` layout, `projects dashboard *` commands, provider panel commands, `#iproj-*` channel naming, durable todos/goal workflow, and the rule diff --git a/bun.lock b/bun.lock new file mode 100644 index 0000000..c2cb78d --- /dev/null +++ b/bun.lock @@ -0,0 +1,344 @@ +{ + "lockfileVersion": 1, + "configVersion": 1, + "workspaces": { + "": { + "name": "@hasna/configs", + "dependencies": { + "@hasna/contracts": "^0.4.1", + "@hasna/events": "^0.1.6", + "@modelcontextprotocol/sdk": "^1.12.1", + "chalk": "^5.4.1", + "commander": "^13.1.0", + "hono": "^4.7.4", + "ink": "^5.2.0", + "pg": "^8.13.3", + "react": "^18.3.1", + "zod": "^3.24.2", + }, + "devDependencies": { + "@types/bun": "^1.2.4", + "@types/pg": "^8.11.11", + "@types/react": "^18.3.18", + "typescript": "^5.7.3", + }, + }, + }, + "packages": { + "@alcalzone/ansi-tokenize": ["@alcalzone/ansi-tokenize@0.1.3", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^4.0.0" } }, "sha512-3yWxPTq3UQ/FY9p1ErPxIyfT64elWaMvM9lIHnaqpyft63tkxodF5aUElYHrdisWve5cETkh1+KBw1yJuW0aRw=="], + + "@hasna/contracts": ["@hasna/contracts@0.4.1", "", { "dependencies": { "commander": "^13.1.0", "zod": "^3.25.76" }, "bin": { "contracts": "dist/cli/index.js", "contracts-cli": "dist/cli/index.js" } }, "sha512-oubsu1FFyVvxbt5d+85iBXEK6M81ZsaeODycoQGZuFNqQ3ecfXFujlQz3cL+NHwHJPVmy4wBGLPcaXcRTjO/IQ=="], + + "@hasna/events": ["@hasna/events@0.1.8", "", { "dependencies": { "commander": "^13.1.0" }, "bin": { "events": "dist/cli/index.js", "hasna-events": "dist/cli/index.js" } }, "sha512-NftaVpt/Rlc81DVdyIliEqa77SB/jtOFP/5YHTNeH8c7MNM999G8noWHXWMTIeZ59NviqnxFgnHK8t/NQMH9qQ=="], + + "@hono/node-server": ["@hono/node-server@1.19.13", "", { "peerDependencies": { "hono": "^4" } }, "sha512-TsQLe4i2gvoTtrHje625ngThGBySOgSK3Xo2XRYOdqGN1teR8+I7vchQC46uLJi8OF62YTYA3AhSpumtkhsaKQ=="], + + "@modelcontextprotocol/sdk": ["@modelcontextprotocol/sdk@1.29.0", "", { "dependencies": { "@hono/node-server": "^1.19.9", "ajv": "^8.17.1", "ajv-formats": "^3.0.1", "content-type": "^1.0.5", "cors": "^2.8.5", "cross-spawn": "^7.0.5", "eventsource": "^3.0.2", "eventsource-parser": "^3.0.0", "express": "^5.2.1", "express-rate-limit": "^8.2.1", "hono": "^4.11.4", "jose": "^6.1.3", "json-schema-typed": "^8.0.2", "pkce-challenge": "^5.0.0", "raw-body": "^3.0.0", "zod": "^3.25 || ^4.0", "zod-to-json-schema": "^3.25.1" }, "peerDependencies": { "@cfworker/json-schema": "^4.1.1" }, "optionalPeers": ["@cfworker/json-schema"] }, "sha512-zo37mZA9hJWpULgkRpowewez1y6ML5GsXJPY8FI0tBBCd77HEvza4jDqRKOXgHNn867PVGCyTdzqpz0izu5ZjQ=="], + + "@types/bun": ["@types/bun@1.3.11", "", { "dependencies": { "bun-types": "1.3.11" } }, "sha512-5vPne5QvtpjGpsGYXiFyycfpDF2ECyPcTSsFBMa0fraoxiQyMJ3SmuQIGhzPg2WJuWxVBoxWJ2kClYTcw/4fAg=="], + + "@types/node": ["@types/node@25.5.2", "", { "dependencies": { "undici-types": "~7.18.0" } }, "sha512-tO4ZIRKNC+MDWV4qKVZe3Ql/woTnmHDr5JD8UI5hn2pwBrHEwOEMZK7WlNb5RKB6EoJ02gwmQS9OrjuFnZYdpg=="], + + "@types/pg": ["@types/pg@8.20.0", "", { "dependencies": { "@types/node": "*", "pg-protocol": "*", "pg-types": "^2.2.0" } }, "sha512-bEPFOaMAHTEP1EzpvHTbmwR8UsFyHSKsRisLIHVMXnpNefSbGA1bD6CVy+qKjGSqmZqNqBDV2azOBo8TgkcVow=="], + + "@types/prop-types": ["@types/prop-types@15.7.15", "", {}, "sha512-F6bEyamV9jKGAFBEmlQnesRPGOQqS2+Uwi0Em15xenOxHaf2hv6L8YCVn3rPdPJOiJfPiCnLIRyvwVaqMY3MIw=="], + + "@types/react": ["@types/react@18.3.28", "", { "dependencies": { "@types/prop-types": "*", "csstype": "^3.2.2" } }, "sha512-z9VXpC7MWrhfWipitjNdgCauoMLRdIILQsAEV+ZesIzBq/oUlxk0m3ApZuMFCXdnS4U7KrI+l3WRUEGQ8K1QKw=="], + + "accepts": ["accepts@2.0.0", "", { "dependencies": { "mime-types": "^3.0.0", "negotiator": "^1.0.0" } }, "sha512-5cvg6CtKwfgdmVqY1WIiXKc3Q1bkRqGLi+2W/6ao+6Y7gu/RCwRuAhGEzh5B4KlszSuTLgZYuqFqo5bImjNKng=="], + + "ajv": ["ajv@8.18.0", "", { "dependencies": { "fast-deep-equal": "^3.1.3", "fast-uri": "^3.0.1", "json-schema-traverse": "^1.0.0", "require-from-string": "^2.0.2" } }, "sha512-PlXPeEWMXMZ7sPYOHqmDyCJzcfNrUr3fGNKtezX14ykXOEIvyK81d+qydx89KY5O71FKMPaQ2vBfBFI5NHR63A=="], + + "ajv-formats": ["ajv-formats@3.0.1", "", { "dependencies": { "ajv": "^8.0.0" } }, "sha512-8iUql50EUR+uUcdRQ3HDqa6EVyo3docL8g5WJ3FNcWmu62IbkGUue/pEyLBW8VGKKucTPgqeks4fIU1DA4yowQ=="], + + "ansi-escapes": ["ansi-escapes@7.3.0", "", { "dependencies": { "environment": "^1.0.0" } }, "sha512-BvU8nYgGQBxcmMuEeUEmNTvrMVjJNSH7RgW24vXexN4Ven6qCvy4TntnvlnwnMLTVlcRQQdbRY8NKnaIoeWDNg=="], + + "ansi-regex": ["ansi-regex@6.2.2", "", {}, "sha512-Bq3SmSpyFHaWjPk8If9yc6svM8c56dB5BAtW4Qbw5jHTwwXXcTLoRMkpDJp6VL0XzlWaCHTXrkFURMYmD0sLqg=="], + + "ansi-styles": ["ansi-styles@6.2.3", "", {}, "sha512-4Dj6M28JB+oAH8kFkTLUo+a2jwOFkuqb3yucU0CANcRRUbxS0cP0nZYCGjcc3BNXwRIsUVmDGgzawme7zvJHvg=="], + + "auto-bind": ["auto-bind@5.0.1", "", {}, "sha512-ooviqdwwgfIfNmDwo94wlshcdzfO64XV0Cg6oDsDYBJfITDz1EngD2z7DkbvCWn+XIMsIqW27sEVF6qcpJrRcg=="], + + "body-parser": ["body-parser@2.2.2", "", { "dependencies": { "bytes": "^3.1.2", "content-type": "^1.0.5", "debug": "^4.4.3", "http-errors": "^2.0.0", "iconv-lite": "^0.7.0", "on-finished": "^2.4.1", "qs": "^6.14.1", "raw-body": "^3.0.1", "type-is": "^2.0.1" } }, "sha512-oP5VkATKlNwcgvxi0vM0p/D3n2C3EReYVX+DNYs5TjZFn/oQt2j+4sVJtSMr18pdRr8wjTcBl6LoV+FUwzPmNA=="], + + "bun-types": ["bun-types@1.3.11", "", { "dependencies": { "@types/node": "*" } }, "sha512-1KGPpoxQWl9f6wcZh57LvrPIInQMn2TQ7jsgxqpRzg+l0QPOFvJVH7HmvHo/AiPgwXy+/Thf6Ov3EdVn1vOabg=="], + + "bytes": ["bytes@3.1.2", "", {}, "sha512-/Nf7TyzTx6S3yRJObOAV7956r8cr2+Oj8AC5dt8wSP3BQAoeX58NoHyCU8P8zGkNXStjTSi6fzO6F0pBdcYbEg=="], + + "call-bind-apply-helpers": ["call-bind-apply-helpers@1.0.2", "", { "dependencies": { "es-errors": "^1.3.0", "function-bind": "^1.1.2" } }, "sha512-Sp1ablJ0ivDkSzjcaJdxEunN5/XvksFJ2sMBFfq6x0ryhQV/2b/KwFe21cMpmHtPOSij8K99/wSfoEuTObmuMQ=="], + + "call-bound": ["call-bound@1.0.4", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "get-intrinsic": "^1.3.0" } }, "sha512-+ys997U96po4Kx/ABpBCqhA9EuxJaQWDQg7295H4hBphv3IZg0boBKuwYpt4YXp6MZ5AmZQnU/tyMTlRpaSejg=="], + + "chalk": ["chalk@5.6.2", "", {}, "sha512-7NzBL0rN6fMUW+f7A6Io4h40qQlG+xGmtMxfbnH/K7TAtt8JQWVQK+6g0UXKMeVJoyV5EkkNsErQ8pVD3bLHbA=="], + + "cli-boxes": ["cli-boxes@3.0.0", "", {}, "sha512-/lzGpEWL/8PfI0BmBOPRwp0c/wFNX1RdUML3jK/RcSBA9T8mZDdQpqYBKtCFTOfQbwPqWEOpjqW+Fnayc0969g=="], + + "cli-cursor": ["cli-cursor@4.0.0", "", { "dependencies": { "restore-cursor": "^4.0.0" } }, "sha512-VGtlMu3x/4DOtIUwEkRezxUZ2lBacNJCHash0N0WeZDBS+7Ux1dm3XWAgWYxLJFMMdOeXMHXorshEFhbMSGelg=="], + + "cli-truncate": ["cli-truncate@4.0.0", "", { "dependencies": { "slice-ansi": "^5.0.0", "string-width": "^7.0.0" } }, "sha512-nPdaFdQ0h/GEigbPClz11D0v/ZJEwxmeVZGeMo3Z5StPtUTkA9o1lD6QwoirYiSDzbcwn2XcjwmCp68W1IS4TA=="], + + "code-excerpt": ["code-excerpt@4.0.0", "", { "dependencies": { "convert-to-spaces": "^2.0.1" } }, "sha512-xxodCmBen3iy2i0WtAK8FlFNrRzjUqjRsMfho58xT/wvZU1YTM3fCnRjcy1gJPMepaRlgm/0e6w8SpWHpn3/cA=="], + + "commander": ["commander@13.1.0", "", {}, "sha512-/rFeCpNJQbhSZjGVwO9RFV3xPqbnERS8MmIQzCtD/zl6gpJuV/bMLuN92oG3F7d8oDEHHRrujSXNUr8fpjntKw=="], + + "content-disposition": ["content-disposition@1.1.0", "", {}, "sha512-5jRCH9Z/+DRP7rkvY83B+yGIGX96OYdJmzngqnw2SBSxqCFPd0w2km3s5iawpGX8krnwSGmF0FW5Nhr0Hfai3g=="], + + "content-type": ["content-type@1.0.5", "", {}, "sha512-nTjqfcBFEipKdXCv4YDQWCfmcLZKm81ldF0pAopTvyrFGVbcR6P/VAAd5G7N+0tTr8QqiU0tFadD6FK4NtJwOA=="], + + "convert-to-spaces": ["convert-to-spaces@2.0.1", "", {}, "sha512-rcQ1bsQO9799wq24uE5AM2tAILy4gXGIK/njFWcVQkGNZ96edlpY+A7bjwvzjYvLDyzmG1MmMLZhpcsb+klNMQ=="], + + "cookie": ["cookie@0.7.2", "", {}, "sha512-yki5XnKuf750l50uGTllt6kKILY4nQ1eNIQatoXEByZ5dWgnKqbnqmTrBE5B4N7lrMJKQ2ytWMiTO2o0v6Ew/w=="], + + "cookie-signature": ["cookie-signature@1.2.2", "", {}, "sha512-D76uU73ulSXrD1UXF4KE2TMxVVwhsnCgfAyTg9k8P6KGZjlXKrOLe4dJQKI3Bxi5wjesZoFXJWElNWBjPZMbhg=="], + + "cors": ["cors@2.8.6", "", { "dependencies": { "object-assign": "^4", "vary": "^1" } }, "sha512-tJtZBBHA6vjIAaF6EnIaq6laBBP9aq/Y3ouVJjEfoHbRBcHBAHYcMh/w8LDrk2PvIMMq8gmopa5D4V8RmbrxGw=="], + + "cross-spawn": ["cross-spawn@7.0.6", "", { "dependencies": { "path-key": "^3.1.0", "shebang-command": "^2.0.0", "which": "^2.0.1" } }, "sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA=="], + + "csstype": ["csstype@3.2.3", "", {}, "sha512-z1HGKcYy2xA8AGQfwrn0PAy+PB7X/GSj3UVJW9qKyn43xWa+gl5nXmU4qqLMRzWVLFC8KusUX8T/0kCiOYpAIQ=="], + + "debug": ["debug@4.4.3", "", { "dependencies": { "ms": "^2.1.3" } }, "sha512-RGwwWnwQvkVfavKVt22FGLw+xYSdzARwm0ru6DhTVA3umU5hZc28V3kO4stgYryrTlLpuvgI9GiijltAjNbcqA=="], + + "depd": ["depd@2.0.0", "", {}, "sha512-g7nH6P6dyDioJogAAGprGpCtVImJhpPk/roCzdb3fIh61/s/nPsfR6onyMwkCAR/OlC3yBC0lESvUoQEAssIrw=="], + + "dunder-proto": ["dunder-proto@1.0.1", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.1", "es-errors": "^1.3.0", "gopd": "^1.2.0" } }, "sha512-KIN/nDJBQRcXw0MLVhZE9iQHmG68qAVIBg9CqmUYjmQIhgij9U5MFvrqkUL5FbtyyzZuOeOt0zdeRe4UY7ct+A=="], + + "ee-first": ["ee-first@1.1.1", "", {}, "sha512-WMwm9LhRUo+WUaRN+vRuETqG89IgZphVSNkdFgeb6sS/E4OrDIN7t48CAewSHXc6C8lefD8KKfr5vY61brQlow=="], + + "emoji-regex": ["emoji-regex@10.6.0", "", {}, "sha512-toUI84YS5YmxW219erniWD0CIVOo46xGKColeNQRgOzDorgBi1v4D71/OFzgD9GO2UGKIv1C3Sp8DAn0+j5w7A=="], + + "encodeurl": ["encodeurl@2.0.0", "", {}, "sha512-Q0n9HRi4m6JuGIV1eFlmvJB7ZEVxu93IrMyiMsGC0lrMJMWzRgx6WGquyfQgZVb31vhGgXnfmPNNXmxnOkRBrg=="], + + "environment": ["environment@1.1.0", "", {}, "sha512-xUtoPkMggbz0MPyPiIWr1Kp4aeWJjDZ6SMvURhimjdZgsRuDplF5/s9hcgGhyXMhs+6vpnuoiZ2kFiu3FMnS8Q=="], + + "es-define-property": ["es-define-property@1.0.1", "", {}, "sha512-e3nRfgfUZ4rNGL232gUgX06QNyyez04KdjFrF+LTRoOXmrOgFKDg4BCdsjW8EnT69eqdYGmRpJwiPVYNrCaW3g=="], + + "es-errors": ["es-errors@1.3.0", "", {}, "sha512-Zf5H2Kxt2xjTvbJvP2ZWLEICxA6j+hAmMzIlypy4xcBg1vKVnx89Wy0GbS+kf5cwCVFFzdCFh2XSCFNULS6csw=="], + + "es-object-atoms": ["es-object-atoms@1.1.1", "", { "dependencies": { "es-errors": "^1.3.0" } }, "sha512-FGgH2h8zKNim9ljj7dankFPcICIK9Cp5bm+c2gQSYePhpaG5+esrLODihIorn+Pe6FGJzWhXQotPv73jTaldXA=="], + + "es-toolkit": ["es-toolkit@1.45.1", "", {}, "sha512-/jhoOj/Fx+A+IIyDNOvO3TItGmlMKhtX8ISAHKE90c4b/k1tqaqEZ+uUqfpU8DMnW5cgNJv606zS55jGvza0Xw=="], + + "escape-html": ["escape-html@1.0.3", "", {}, "sha512-NiSupZ4OeuGwr68lGIeym/ksIZMJodUGOSCZ/FSnTxcrekbvqrgdUxlJOMpijaKZVjAJrWrGs/6Jy8OMuyj9ow=="], + + "escape-string-regexp": ["escape-string-regexp@2.0.0", "", {}, "sha512-UpzcLCXolUWcNu5HtVMHYdXJjArjsF9C0aNnquZYY4uW/Vu0miy5YoWvbV345HauVvcAUnpRuhMMcqTcGOY2+w=="], + + "etag": ["etag@1.8.1", "", {}, "sha512-aIL5Fx7mawVa300al2BnEE4iNvo1qETxLrPI/o05L7z6go7fCw1J6EQmbK4FmJ2AS7kgVF/KEZWufBfdClMcPg=="], + + "eventsource": ["eventsource@3.0.7", "", { "dependencies": { "eventsource-parser": "^3.0.1" } }, "sha512-CRT1WTyuQoD771GW56XEZFQ/ZoSfWid1alKGDYMmkt2yl8UXrVR4pspqWNEcqKvVIzg6PAltWjxcSSPrboA4iA=="], + + "eventsource-parser": ["eventsource-parser@3.0.6", "", {}, "sha512-Vo1ab+QXPzZ4tCa8SwIHJFaSzy4R6SHf7BY79rFBDf0idraZWAkYrDjDj8uWaSm3S2TK+hJ7/t1CEmZ7jXw+pg=="], + + "express": ["express@5.2.1", "", { "dependencies": { "accepts": "^2.0.0", "body-parser": "^2.2.1", "content-disposition": "^1.0.0", "content-type": "^1.0.5", "cookie": "^0.7.1", "cookie-signature": "^1.2.1", "debug": "^4.4.0", "depd": "^2.0.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "finalhandler": "^2.1.0", "fresh": "^2.0.0", "http-errors": "^2.0.0", "merge-descriptors": "^2.0.0", "mime-types": "^3.0.0", "on-finished": "^2.4.1", "once": "^1.4.0", "parseurl": "^1.3.3", "proxy-addr": "^2.0.7", "qs": "^6.14.0", "range-parser": "^1.2.1", "router": "^2.2.0", "send": "^1.1.0", "serve-static": "^2.2.0", "statuses": "^2.0.1", "type-is": "^2.0.1", "vary": "^1.1.2" } }, "sha512-hIS4idWWai69NezIdRt2xFVofaF4j+6INOpJlVOLDO8zXGpUVEVzIYk12UUi2JzjEzWL3IOAxcTubgz9Po0yXw=="], + + "express-rate-limit": ["express-rate-limit@8.3.2", "", { "dependencies": { "ip-address": "10.1.0" }, "peerDependencies": { "express": ">= 4.11" } }, "sha512-77VmFeJkO0/rvimEDuUC5H30oqUC4EyOhyGccfqoLebB0oiEYfM7nwPrsDsBL1gsTpwfzX8SFy2MT3TDyRq+bg=="], + + "fast-deep-equal": ["fast-deep-equal@3.1.3", "", {}, "sha512-f3qQ9oQy9j2AhBe/H9VC91wLmKBCCU/gDOnKNAYG5hswO7BLKj09Hc5HYNz9cGI++xlpDCIgDaitVs03ATR84Q=="], + + "fast-uri": ["fast-uri@3.1.0", "", {}, "sha512-iPeeDKJSWf4IEOasVVrknXpaBV0IApz/gp7S2bb7Z4Lljbl2MGJRqInZiUrQwV16cpzw/D3S5j5Julj/gT52AA=="], + + "finalhandler": ["finalhandler@2.1.1", "", { "dependencies": { "debug": "^4.4.0", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "on-finished": "^2.4.1", "parseurl": "^1.3.3", "statuses": "^2.0.1" } }, "sha512-S8KoZgRZN+a5rNwqTxlZZePjT/4cnm0ROV70LedRHZ0p8u9fRID0hJUZQpkKLzro8LfmC8sx23bY6tVNxv8pQA=="], + + "forwarded": ["forwarded@0.2.0", "", {}, "sha512-buRG0fpBtRHSTCOASe6hD258tEubFoRLb4ZNA6NxMVHNw2gOcwHo9wyablzMzOA5z9xA9L1KNjk/Nt6MT9aYow=="], + + "fresh": ["fresh@2.0.0", "", {}, "sha512-Rx/WycZ60HOaqLKAi6cHRKKI7zxWbJ31MhntmtwMoaTeF7XFH9hhBp8vITaMidfljRQ6eYWCKkaTK+ykVJHP2A=="], + + "function-bind": ["function-bind@1.1.2", "", {}, "sha512-7XHNxH7qX9xG5mIwxkhumTox/MIRNcOgDrxWsMt2pAr23WHp6MrRlN7FBSFpCpr+oVO0F744iUgR82nJMfG2SA=="], + + "get-east-asian-width": ["get-east-asian-width@1.5.0", "", {}, "sha512-CQ+bEO+Tva/qlmw24dCejulK5pMzVnUOFOijVogd3KQs07HnRIgp8TGipvCCRT06xeYEbpbgwaCxglFyiuIcmA=="], + + "get-intrinsic": ["get-intrinsic@1.3.0", "", { "dependencies": { "call-bind-apply-helpers": "^1.0.2", "es-define-property": "^1.0.1", "es-errors": "^1.3.0", "es-object-atoms": "^1.1.1", "function-bind": "^1.1.2", "get-proto": "^1.0.1", "gopd": "^1.2.0", "has-symbols": "^1.1.0", "hasown": "^2.0.2", "math-intrinsics": "^1.1.0" } }, "sha512-9fSjSaos/fRIVIp+xSJlE6lfwhES7LNtKaCBIamHsjr2na1BiABJPo0mOjjz8GJDURarmCPGqaiVg5mfjb98CQ=="], + + "get-proto": ["get-proto@1.0.1", "", { "dependencies": { "dunder-proto": "^1.0.1", "es-object-atoms": "^1.0.0" } }, "sha512-sTSfBjoXBp89JvIKIefqw7U2CCebsc74kiY6awiGogKtoSGbgjYE/G/+l9sF3MWFPNc9IcoOC4ODfKHfxFmp0g=="], + + "gopd": ["gopd@1.2.0", "", {}, "sha512-ZUKRh6/kUFoAiTAtTYPZJ3hw9wNxx+BIBOijnlG9PnrJsCcSjs1wyyD6vJpaYtgnzDrKYRSqf3OO6Rfa93xsRg=="], + + "has-symbols": ["has-symbols@1.1.0", "", {}, "sha512-1cDNdwJ2Jaohmb3sg4OmKaMBwuC48sYni5HUw2DvsC8LjGTLK9h+eb1X6RyuOHe4hT0ULCW68iomhjUoKUqlPQ=="], + + "hasown": ["hasown@2.0.2", "", { "dependencies": { "function-bind": "^1.1.2" } }, "sha512-0hJU9SCPvmMzIBdZFqNPXWa6dqh7WdH0cII9y+CyS8rG3nL48Bclra9HmKhVVUHyPWNH5Y7xDwAB7bfgSjkUMQ=="], + + "hono": ["hono@4.12.12", "", {}, "sha512-p1JfQMKaceuCbpJKAPKVqyqviZdS0eUxH9v82oWo1kb9xjQ5wA6iP3FNVAPDFlz5/p7d45lO+BpSk1tuSZMF4Q=="], + + "http-errors": ["http-errors@2.0.1", "", { "dependencies": { "depd": "~2.0.0", "inherits": "~2.0.4", "setprototypeof": "~1.2.0", "statuses": "~2.0.2", "toidentifier": "~1.0.1" } }, "sha512-4FbRdAX+bSdmo4AUFuS0WNiPz8NgFt+r8ThgNWmlrjQjt1Q7ZR9+zTlce2859x4KSXrwIsaeTqDoKQmtP8pLmQ=="], + + "iconv-lite": ["iconv-lite@0.7.2", "", { "dependencies": { "safer-buffer": ">= 2.1.2 < 3.0.0" } }, "sha512-im9DjEDQ55s9fL4EYzOAv0yMqmMBSZp6G0VvFyTMPKWxiSBHUj9NW/qqLmXUwXrrM7AvqSlTCfvqRb0cM8yYqw=="], + + "indent-string": ["indent-string@5.0.0", "", {}, "sha512-m6FAo/spmsW2Ab2fU35JTYwtOKa2yAwXSwgjSv1TJzh4Mh7mC3lzAOVLBprb72XsTrgkEIsl7YrFNAiDiRhIGg=="], + + "inherits": ["inherits@2.0.4", "", {}, "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ=="], + + "ink": ["ink@5.2.1", "", { "dependencies": { "@alcalzone/ansi-tokenize": "^0.1.3", "ansi-escapes": "^7.0.0", "ansi-styles": "^6.2.1", "auto-bind": "^5.0.1", "chalk": "^5.3.0", "cli-boxes": "^3.0.0", "cli-cursor": "^4.0.0", "cli-truncate": "^4.0.0", "code-excerpt": "^4.0.0", "es-toolkit": "^1.22.0", "indent-string": "^5.0.0", "is-in-ci": "^1.0.0", "patch-console": "^2.0.0", "react-reconciler": "^0.29.0", "scheduler": "^0.23.0", "signal-exit": "^3.0.7", "slice-ansi": "^7.1.0", "stack-utils": "^2.0.6", "string-width": "^7.2.0", "type-fest": "^4.27.0", "widest-line": "^5.0.0", "wrap-ansi": "^9.0.0", "ws": "^8.18.0", "yoga-layout": "~3.2.1" }, "peerDependencies": { "@types/react": ">=18.0.0", "react": ">=18.0.0", "react-devtools-core": "^4.19.1" }, "optionalPeers": ["@types/react", "react-devtools-core"] }, "sha512-BqcUyWrG9zq5HIwW6JcfFHsIYebJkWWb4fczNah1goUO0vv5vneIlfwuS85twyJ5hYR/y18FlAYUxrO9ChIWVg=="], + + "ip-address": ["ip-address@10.1.0", "", {}, "sha512-XXADHxXmvT9+CRxhXg56LJovE+bmWnEWB78LB83VZTprKTmaC5QfruXocxzTZ2Kl0DNwKuBdlIhjL8LeY8Sf8Q=="], + + "ipaddr.js": ["ipaddr.js@1.9.1", "", {}, "sha512-0KI/607xoxSToH7GjN1FfSbLoU0+btTicjsQSWQlh/hZykN8KpmMf7uYwPW3R+akZ6R/w18ZlXSHBYXiYUPO3g=="], + + "is-fullwidth-code-point": ["is-fullwidth-code-point@4.0.0", "", {}, "sha512-O4L094N2/dZ7xqVdrXhh9r1KODPJpFms8B5sGdJLPy664AgvXsreZUyCQQNItZRDlYug4xStLjNp/sz3HvBowQ=="], + + "is-in-ci": ["is-in-ci@1.0.0", "", { "bin": { "is-in-ci": "cli.js" } }, "sha512-eUuAjybVTHMYWm/U+vBO1sY/JOCgoPCXRxzdju0K+K0BiGW0SChEL1MLC0PoCIR1OlPo5YAp8HuQoUlsWEICwg=="], + + "is-promise": ["is-promise@4.0.0", "", {}, "sha512-hvpoI6korhJMnej285dSg6nu1+e6uxs7zG3BYAm5byqDsgJNWwxzM6z6iZiAgQR4TJ30JmBTOwqZUw3WlyH3AQ=="], + + "isexe": ["isexe@2.0.0", "", {}, "sha512-RHxMLp9lnKHGHRng9QFhRCMbYAcVpn69smSGcq3f36xjgVVWThj4qqLbTLlq7Ssj8B+fIQ1EuCEGI2lKsyQeIw=="], + + "jose": ["jose@6.2.2", "", {}, "sha512-d7kPDd34KO/YnzaDOlikGpOurfF0ByC2sEV4cANCtdqLlTfBlw2p14O/5d/zv40gJPbIQxfES3nSx1/oYNyuZQ=="], + + "js-tokens": ["js-tokens@4.0.0", "", {}, "sha512-RdJUflcE3cUzKiMqQgsCu06FPu9UdIJO0beYbPhHN4k6apgJtifcoCtT9bcxOpYBtpD2kCM6Sbzg4CausW/PKQ=="], + + "json-schema-traverse": ["json-schema-traverse@1.0.0", "", {}, "sha512-NM8/P9n3XjXhIZn1lLhkFaACTOURQXjWhV4BA/RnOv8xvgqtqpAX9IO4mRQxSx1Rlo4tqzeqb0sOlruaOy3dug=="], + + "json-schema-typed": ["json-schema-typed@8.0.2", "", {}, "sha512-fQhoXdcvc3V28x7C7BMs4P5+kNlgUURe2jmUT1T//oBRMDrqy1QPelJimwZGo7Hg9VPV3EQV5Bnq4hbFy2vetA=="], + + "loose-envify": ["loose-envify@1.4.0", "", { "dependencies": { "js-tokens": "^3.0.0 || ^4.0.0" }, "bin": { "loose-envify": "cli.js" } }, "sha512-lyuxPGr/Wfhrlem2CL/UcnUc1zcqKAImBDzukY7Y5F/yQiNdko6+fRLevlw1HgMySw7f611UIY408EtxRSoK3Q=="], + + "math-intrinsics": ["math-intrinsics@1.1.0", "", {}, "sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g=="], + + "media-typer": ["media-typer@1.1.0", "", {}, "sha512-aisnrDP4GNe06UcKFnV5bfMNPBUw4jsLGaWwWfnH3v02GnBuXX2MCVn5RbrWo0j3pczUilYblq7fQ7Nw2t5XKw=="], + + "merge-descriptors": ["merge-descriptors@2.0.0", "", {}, "sha512-Snk314V5ayFLhp3fkUREub6WtjBfPdCPY1Ln8/8munuLuiYhsABgBVWsozAG+MWMbVEvcdcpbi9R7ww22l9Q3g=="], + + "mime-db": ["mime-db@1.54.0", "", {}, "sha512-aU5EJuIN2WDemCcAp2vFBfp/m4EAhWJnUNSSw0ixs7/kXbd6Pg64EmwJkNdFhB8aWt1sH2CTXrLxo/iAGV3oPQ=="], + + "mime-types": ["mime-types@3.0.2", "", { "dependencies": { "mime-db": "^1.54.0" } }, "sha512-Lbgzdk0h4juoQ9fCKXW4by0UJqj+nOOrI9MJ1sSj4nI8aI2eo1qmvQEie4VD1glsS250n15LsWsYtCugiStS5A=="], + + "mimic-fn": ["mimic-fn@2.1.0", "", {}, "sha512-OqbOk5oEQeAZ8WXWydlu9HJjz9WVdEIvamMCcXmuqUYjTknH/sqsWvhQ3vgwKFRR1HpjvNBKQ37nbJgYzGqGcg=="], + + "ms": ["ms@2.1.3", "", {}, "sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA=="], + + "negotiator": ["negotiator@1.0.0", "", {}, "sha512-8Ofs/AUQh8MaEcrlq5xOX0CQ9ypTF5dl78mjlMNfOK08fzpgTHQRQPBxcPlEtIw0yRpws+Zo/3r+5WRby7u3Gg=="], + + "object-assign": ["object-assign@4.1.1", "", {}, "sha512-rJgTQnkUnH1sFw8yT6VSU3zD3sWmu6sZhIseY8VX+GRu3P6F7Fu+JNDoXfklElbLJSnc3FUQHVe4cU5hj+BcUg=="], + + "object-inspect": ["object-inspect@1.13.4", "", {}, "sha512-W67iLl4J2EXEGTbfeHCffrjDfitvLANg0UlX3wFUUSTx92KXRFegMHUVgSqE+wvhAbi4WqjGg9czysTV2Epbew=="], + + "on-finished": ["on-finished@2.4.1", "", { "dependencies": { "ee-first": "1.1.1" } }, "sha512-oVlzkg3ENAhCk2zdv7IJwd/QUD4z2RxRwpkcGY8psCVcCYZNq4wYnVWALHM+brtuJjePWiYF/ClmuDr8Ch5+kg=="], + + "once": ["once@1.4.0", "", { "dependencies": { "wrappy": "1" } }, "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w=="], + + "onetime": ["onetime@5.1.2", "", { "dependencies": { "mimic-fn": "^2.1.0" } }, "sha512-kbpaSSGJTWdAY5KPVeMOKXSrPtr8C8C7wodJbcsd51jRnmD+GZu8Y0VoU6Dm5Z4vWr0Ig/1NKuWRKf7j5aaYSg=="], + + "parseurl": ["parseurl@1.3.3", "", {}, "sha512-CiyeOxFT/JZyN5m0z9PfXw4SCBJ6Sygz1Dpl0wqjlhDEGGBP1GnsUVEL0p63hoG1fcj3fHynXi9NYO4nWOL+qQ=="], + + "patch-console": ["patch-console@2.0.0", "", {}, "sha512-0YNdUceMdaQwoKce1gatDScmMo5pu/tfABfnzEqeG0gtTmd7mh/WcwgUjtAeOU7N8nFFlbQBnFK2gXW5fGvmMA=="], + + "path-key": ["path-key@3.1.1", "", {}, "sha512-ojmeN0qd+y0jszEtoY48r0Peq5dwMEkIlCOu6Q5f41lfkswXuKtYrhgoTpLnyIcHm24Uhqx+5Tqm2InSwLhE6Q=="], + + "path-to-regexp": ["path-to-regexp@8.4.2", "", {}, "sha512-qRcuIdP69NPm4qbACK+aDogI5CBDMi1jKe0ry5rSQJz8JVLsC7jV8XpiJjGRLLol3N+R5ihGYcrPLTno6pAdBA=="], + + "pg": ["pg@8.20.0", "", { "dependencies": { "pg-connection-string": "^2.12.0", "pg-pool": "^3.13.0", "pg-protocol": "^1.13.0", "pg-types": "2.2.0", "pgpass": "1.0.5" }, "optionalDependencies": { "pg-cloudflare": "^1.3.0" }, "peerDependencies": { "pg-native": ">=3.0.1" }, "optionalPeers": ["pg-native"] }, "sha512-ldhMxz2r8fl/6QkXnBD3CR9/xg694oT6DZQ2s6c/RI28OjtSOpxnPrUCGOBJ46RCUxcWdx3p6kw/xnDHjKvaRA=="], + + "pg-cloudflare": ["pg-cloudflare@1.3.0", "", {}, "sha512-6lswVVSztmHiRtD6I8hw4qP/nDm1EJbKMRhf3HCYaqud7frGysPv7FYJ5noZQdhQtN2xJnimfMtvQq21pdbzyQ=="], + + "pg-connection-string": ["pg-connection-string@2.12.0", "", {}, "sha512-U7qg+bpswf3Cs5xLzRqbXbQl85ng0mfSV/J0nnA31MCLgvEaAo7CIhmeyrmJpOr7o+zm0rXK+hNnT5l9RHkCkQ=="], + + "pg-int8": ["pg-int8@1.0.1", "", {}, "sha512-WCtabS6t3c8SkpDBUlb1kjOs7l66xsGdKpIPZsg4wR+B3+u9UAum2odSsF9tnvxg80h4ZxLWMy4pRjOsFIqQpw=="], + + "pg-pool": ["pg-pool@3.13.0", "", { "peerDependencies": { "pg": ">=8.0" } }, "sha512-gB+R+Xud1gLFuRD/QgOIgGOBE2KCQPaPwkzBBGC9oG69pHTkhQeIuejVIk3/cnDyX39av2AxomQiyPT13WKHQA=="], + + "pg-protocol": ["pg-protocol@1.13.0", "", {}, "sha512-zzdvXfS6v89r6v7OcFCHfHlyG/wvry1ALxZo4LqgUoy7W9xhBDMaqOuMiF3qEV45VqsN6rdlcehHrfDtlCPc8w=="], + + "pg-types": ["pg-types@2.2.0", "", { "dependencies": { "pg-int8": "1.0.1", "postgres-array": "~2.0.0", "postgres-bytea": "~1.0.0", "postgres-date": "~1.0.4", "postgres-interval": "^1.1.0" } }, "sha512-qTAAlrEsl8s4OiEQY69wDvcMIdQN6wdz5ojQiOy6YRMuynxenON0O5oCpJI6lshc6scgAY8qvJ2On/p+CXY0GA=="], + + "pgpass": ["pgpass@1.0.5", "", { "dependencies": { "split2": "^4.1.0" } }, "sha512-FdW9r/jQZhSeohs1Z3sI1yxFQNFvMcnmfuj4WBMUTxOrAyLMaTcE1aAMBiTlbMNaXvBCQuVi0R7hd8udDSP7ug=="], + + "pkce-challenge": ["pkce-challenge@5.0.1", "", {}, "sha512-wQ0b/W4Fr01qtpHlqSqspcj3EhBvimsdh0KlHhH8HRZnMsEa0ea2fTULOXOS9ccQr3om+GcGRk4e+isrZWV8qQ=="], + + "postgres-array": ["postgres-array@2.0.0", "", {}, "sha512-VpZrUqU5A69eQyW2c5CA1jtLecCsN2U/bD6VilrFDWq5+5UIEVO7nazS3TEcHf1zuPYO/sqGvUvW62g86RXZuA=="], + + "postgres-bytea": ["postgres-bytea@1.0.1", "", {}, "sha512-5+5HqXnsZPE65IJZSMkZtURARZelel2oXUEO8rH83VS/hxH5vv1uHquPg5wZs8yMAfdv971IU+kcPUczi7NVBQ=="], + + "postgres-date": ["postgres-date@1.0.7", "", {}, "sha512-suDmjLVQg78nMK2UZ454hAG+OAW+HQPZ6n++TNDUX+L0+uUlLywnoxJKDou51Zm+zTCjrCl0Nq6J9C5hP9vK/Q=="], + + "postgres-interval": ["postgres-interval@1.2.0", "", { "dependencies": { "xtend": "^4.0.0" } }, "sha512-9ZhXKM/rw350N1ovuWHbGxnGh/SNJ4cnxHiM0rxE4VN41wsg8P8zWn9hv/buK00RP4WvlOyr/RBDiptyxVbkZQ=="], + + "proxy-addr": ["proxy-addr@2.0.7", "", { "dependencies": { "forwarded": "0.2.0", "ipaddr.js": "1.9.1" } }, "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg=="], + + "qs": ["qs@6.15.0", "", { "dependencies": { "side-channel": "^1.1.0" } }, "sha512-mAZTtNCeetKMH+pSjrb76NAM8V9a05I9aBZOHztWy/UqcJdQYNsf59vrRKWnojAT9Y+GbIvoTBC++CPHqpDBhQ=="], + + "range-parser": ["range-parser@1.2.1", "", {}, "sha512-Hrgsx+orqoygnmhFbKaHE6c296J+HTAQXoxEF6gNupROmmGJRoyzfG3ccAveqCBrwr/2yxQ5BVd/GTl5agOwSg=="], + + "raw-body": ["raw-body@3.0.2", "", { "dependencies": { "bytes": "~3.1.2", "http-errors": "~2.0.1", "iconv-lite": "~0.7.0", "unpipe": "~1.0.0" } }, "sha512-K5zQjDllxWkf7Z5xJdV0/B0WTNqx6vxG70zJE4N0kBs4LovmEYWJzQGxC9bS9RAKu3bgM40lrd5zoLJ12MQ5BA=="], + + "react": ["react@18.3.1", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-wS+hAgJShR0KhEvPJArfuPVN1+Hz1t0Y6n5jLrGQbkb4urgPE/0Rve+1kMB1v/oWgHgm4WIcV+i7F2pTVj+2iQ=="], + + "react-reconciler": ["react-reconciler@0.29.2", "", { "dependencies": { "loose-envify": "^1.1.0", "scheduler": "^0.23.2" }, "peerDependencies": { "react": "^18.3.1" } }, "sha512-zZQqIiYgDCTP/f1N/mAR10nJGrPD2ZR+jDSEsKWJHYC7Cm2wodlwbR3upZRdC3cjIjSlTLNVyO7Iu0Yy7t2AYg=="], + + "require-from-string": ["require-from-string@2.0.2", "", {}, "sha512-Xf0nWe6RseziFMu+Ap9biiUbmplq6S9/p+7w7YXP/JBHhrUDDUhwa+vANyubuqfZWTveU//DYVGsDG7RKL/vEw=="], + + "restore-cursor": ["restore-cursor@4.0.0", "", { "dependencies": { "onetime": "^5.1.0", "signal-exit": "^3.0.2" } }, "sha512-I9fPXU9geO9bHOt9pHHOhOkYerIMsmVaWB0rA2AI9ERh/+x/i7MV5HKBNrg+ljO5eoPVgCcnFuRjJ9uH6I/3eg=="], + + "router": ["router@2.2.0", "", { "dependencies": { "debug": "^4.4.0", "depd": "^2.0.0", "is-promise": "^4.0.0", "parseurl": "^1.3.3", "path-to-regexp": "^8.0.0" } }, "sha512-nLTrUKm2UyiL7rlhapu/Zl45FwNgkZGaCpZbIHajDYgwlJCOzLSk+cIPAnsEqV955GjILJnKbdQC1nVPz+gAYQ=="], + + "safer-buffer": ["safer-buffer@2.1.2", "", {}, "sha512-YZo3K82SD7Riyi0E1EQPojLz7kpepnSQI9IyPbHHg1XXXevb5dJI7tpyN2ADxGcQbHG7vcyRHk0cbwqcQriUtg=="], + + "scheduler": ["scheduler@0.23.2", "", { "dependencies": { "loose-envify": "^1.1.0" } }, "sha512-UOShsPwz7NrMUqhR6t0hWjFduvOzbtv7toDH1/hIrfRNIDBnnBWd0CwJTGvTpngVlmwGCdP9/Zl/tVrDqcuYzQ=="], + + "send": ["send@1.2.1", "", { "dependencies": { "debug": "^4.4.3", "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "etag": "^1.8.1", "fresh": "^2.0.0", "http-errors": "^2.0.1", "mime-types": "^3.0.2", "ms": "^2.1.3", "on-finished": "^2.4.1", "range-parser": "^1.2.1", "statuses": "^2.0.2" } }, "sha512-1gnZf7DFcoIcajTjTwjwuDjzuz4PPcY2StKPlsGAQ1+YH20IRVrBaXSWmdjowTJ6u8Rc01PoYOGHXfP1mYcZNQ=="], + + "serve-static": ["serve-static@2.2.1", "", { "dependencies": { "encodeurl": "^2.0.0", "escape-html": "^1.0.3", "parseurl": "^1.3.3", "send": "^1.2.0" } }, "sha512-xRXBn0pPqQTVQiC8wyQrKs2MOlX24zQ0POGaj0kultvoOCstBQM5yvOhAVSUwOMjQtTvsPWoNCHfPGwaaQJhTw=="], + + "setprototypeof": ["setprototypeof@1.2.0", "", {}, "sha512-E5LDX7Wrp85Kil5bhZv46j8jOeboKq5JMmYM3gVGdGH8xFpPWXUMsNrlODCrkoxMEeNi/XZIwuRvY4XNwYMJpw=="], + + "shebang-command": ["shebang-command@2.0.0", "", { "dependencies": { "shebang-regex": "^3.0.0" } }, "sha512-kHxr2zZpYtdmrN1qDjrrX/Z1rR1kG8Dx+gkpK1G4eXmvXswmcE1hTWBWYUzlraYw1/yZp6YuDY77YtvbN0dmDA=="], + + "shebang-regex": ["shebang-regex@3.0.0", "", {}, "sha512-7++dFhtcx3353uBaq8DDR4NuxBetBzC7ZQOhmTQInHEd6bSrXdiEyzCvG07Z44UYdLShWUyXt5M/yhz8ekcb1A=="], + + "side-channel": ["side-channel@1.1.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3", "side-channel-list": "^1.0.0", "side-channel-map": "^1.0.1", "side-channel-weakmap": "^1.0.2" } }, "sha512-ZX99e6tRweoUXqR+VBrslhda51Nh5MTQwou5tnUDgbtyM0dBgmhEDtWGP/xbKn6hqfPRHujUNwz5fy/wbbhnpw=="], + + "side-channel-list": ["side-channel-list@1.0.0", "", { "dependencies": { "es-errors": "^1.3.0", "object-inspect": "^1.13.3" } }, "sha512-FCLHtRD/gnpCiCHEiJLOwdmFP+wzCmDEkc9y7NsYxeF4u7Btsn1ZuwgwJGxImImHicJArLP4R0yX4c2KCrMrTA=="], + + "side-channel-map": ["side-channel-map@1.0.1", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3" } }, "sha512-VCjCNfgMsby3tTdo02nbjtM/ewra6jPHmpThenkTYh8pG9ucZ/1P8So4u4FGBek/BjpOVsDCMoLA/iuBKIFXRA=="], + + "side-channel-weakmap": ["side-channel-weakmap@1.0.2", "", { "dependencies": { "call-bound": "^1.0.2", "es-errors": "^1.3.0", "get-intrinsic": "^1.2.5", "object-inspect": "^1.13.3", "side-channel-map": "^1.0.1" } }, "sha512-WPS/HvHQTYnHisLo9McqBHOJk2FkHO/tlpvldyrnem4aeQp4hai3gythswg6p01oSoTl58rcpiFAjF2br2Ak2A=="], + + "signal-exit": ["signal-exit@3.0.7", "", {}, "sha512-wnD2ZE+l+SPC/uoS0vXeE9L1+0wuaMqKlfz9AMUo38JsyLSBWSFcHR1Rri62LZc12vLr1gb3jl7iwQhgwpAbGQ=="], + + "slice-ansi": ["slice-ansi@7.1.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^5.0.0" } }, "sha512-iOBWFgUX7caIZiuutICxVgX1SdxwAVFFKwt1EvMYYec/NWO5meOJ6K5uQxhrYBdQJne4KxiqZc+KptFOWFSI9w=="], + + "split2": ["split2@4.2.0", "", {}, "sha512-UcjcJOWknrNkF6PLX83qcHM6KHgVKNkV62Y8a5uYDVv9ydGQVwAHMKqHdJje1VTWpljG0WYpCDhrCdAOYH4TWg=="], + + "stack-utils": ["stack-utils@2.0.6", "", { "dependencies": { "escape-string-regexp": "^2.0.0" } }, "sha512-XlkWvfIm6RmsWtNJx+uqtKLS8eqFbxUg0ZzLXqY0caEy9l7hruX8IpiDnjsLavoBgqCCR71TqWO8MaXYheJ3RQ=="], + + "statuses": ["statuses@2.0.2", "", {}, "sha512-DvEy55V3DB7uknRo+4iOGT5fP1slR8wQohVdknigZPMpMstaKJQWhwiYBACJE3Ul2pTnATihhBYnRhZQHGBiRw=="], + + "string-width": ["string-width@7.2.0", "", { "dependencies": { "emoji-regex": "^10.3.0", "get-east-asian-width": "^1.0.0", "strip-ansi": "^7.1.0" } }, "sha512-tsaTIkKW9b4N+AEj+SVA+WhJzV7/zMhcSu78mLKWSk7cXMOSHsBKFWUs0fWwq8QyK3MgJBQRX6Gbi4kYbdvGkQ=="], + + "strip-ansi": ["strip-ansi@7.2.0", "", { "dependencies": { "ansi-regex": "^6.2.2" } }, "sha512-yDPMNjp4WyfYBkHnjIRLfca1i6KMyGCtsVgoKe/z1+6vukgaENdgGBZt+ZmKPc4gavvEZ5OgHfHdrazhgNyG7w=="], + + "toidentifier": ["toidentifier@1.0.1", "", {}, "sha512-o5sSPKEkg/DIQNmH43V0/uerLrpzVedkUh8tGNvaeXpfpuwjKenlSox/2O/BTlZUtEe+JG7s5YhEz608PlAHRA=="], + + "type-fest": ["type-fest@4.41.0", "", {}, "sha512-TeTSQ6H5YHvpqVwBRcnLDCBnDOHWYu7IvGbHT6N8AOymcr9PJGjc1GTtiWZTYg0NCgYwvnYWEkVChQAr9bjfwA=="], + + "type-is": ["type-is@2.0.1", "", { "dependencies": { "content-type": "^1.0.5", "media-typer": "^1.1.0", "mime-types": "^3.0.0" } }, "sha512-OZs6gsjF4vMp32qrCbiVSkrFmXtG/AZhY3t0iAMrMBiAZyV9oALtXO8hsrHbMXF9x6L3grlFuwW2oAz7cav+Gw=="], + + "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="], + + "undici-types": ["undici-types@7.18.2", "", {}, "sha512-AsuCzffGHJybSaRrmr5eHr81mwJU3kjw6M+uprWvCXiNeN9SOGwQ3Jn8jb8m3Z6izVgknn1R0FTCEAP2QrLY/w=="], + + "unpipe": ["unpipe@1.0.0", "", {}, "sha512-pjy2bYhSsufwWlKwPc+l3cN7+wuJlK6uz0YdJEOlQDbl6jo/YlPi4mb8agUkVC8BF7V8NuzeyPNqRksA3hztKQ=="], + + "vary": ["vary@1.1.2", "", {}, "sha512-BNGbWLfd0eUPabhkXUVm0j8uuvREyTh5ovRa/dyow/BqAbZJyC+5fU+IzQOzmAKzYqYRAISoRhdQr3eIZ/PXqg=="], + + "which": ["which@2.0.2", "", { "dependencies": { "isexe": "^2.0.0" }, "bin": { "node-which": "./bin/node-which" } }, "sha512-BLI3Tl1TW3Pvl70l3yq3Y64i+awpwXqsGBYWkkqMtnbXgrMD+yj7rhW0kuEDxzJaYXGjEW5ogapKNMEKNMjibA=="], + + "widest-line": ["widest-line@5.0.0", "", { "dependencies": { "string-width": "^7.0.0" } }, "sha512-c9bZp7b5YtRj2wOe6dlj32MK+Bx/M/d+9VB2SHM1OtsUHR0aV0tdP6DWh/iMt0kWi1t5g1Iudu6hQRNd1A4PVA=="], + + "wrap-ansi": ["wrap-ansi@9.0.2", "", { "dependencies": { "ansi-styles": "^6.2.1", "string-width": "^7.0.0", "strip-ansi": "^7.1.0" } }, "sha512-42AtmgqjV+X1VpdOfyTGOYRi0/zsoLqtXQckTmqTeybT+BDIbM/Guxo7x3pE2vtpr1ok6xRqM9OpBe+Jyoqyww=="], + + "wrappy": ["wrappy@1.0.2", "", {}, "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ=="], + + "ws": ["ws@8.20.0", "", { "peerDependencies": { "bufferutil": "^4.0.1", "utf-8-validate": ">=5.0.2" }, "optionalPeers": ["bufferutil", "utf-8-validate"] }, "sha512-sAt8BhgNbzCtgGbt2OxmpuryO63ZoDk/sqaB/znQm94T4fCEsy/yV+7CdC1kJhOU9lboAEU7R3kquuycDoibVA=="], + + "xtend": ["xtend@4.0.2", "", {}, "sha512-LKYU1iAXJXUgAXn9URjiu+MWhyUXHsvfp7mcuYm9dSUKK0/CjtrUwFAxD82/mCWbtLsGjFIad0wIsod4zrTAEQ=="], + + "yoga-layout": ["yoga-layout@3.2.1", "", {}, "sha512-0LPOt3AxKqMdFBZA3HBAt/t/8vIKq7VaQYbuA8WxCgung+p9TVyKRYdpvCb80HcdTN2NkbIKbhNwKUfm3tQywQ=="], + + "zod": ["zod@3.25.76", "", {}, "sha512-gzUt/qt81nXsFGKIFcC3YnfEAx5NkunCfnDlvuBSSFS02bcXu4Lmea0AFIUwbLWxWPx3d9p8S5QoaujKcNQxcQ=="], + + "zod-to-json-schema": ["zod-to-json-schema@3.25.2", "", { "peerDependencies": { "zod": "^3.25.28 || ^4" } }, "sha512-O/PgfnpT1xKSDeQYSCfRI5Gy3hPf91mKVDuYLUHZJMiDFptvP41MSnWofm8dnCm0256ZNfZIM7DSzuSMAFnjHA=="], + + "cli-truncate/slice-ansi": ["slice-ansi@5.0.0", "", { "dependencies": { "ansi-styles": "^6.0.0", "is-fullwidth-code-point": "^4.0.0" } }, "sha512-FC+lgizVPfie0kkhqUScwRu1O/lF6NOgJmlCgK+/LYxDCTk8sGelYaHDhFcDN+Sn3Cv+3VSa4Byeo+IMCzpMgQ=="], + + "slice-ansi/is-fullwidth-code-point": ["is-fullwidth-code-point@5.1.0", "", { "dependencies": { "get-east-asian-width": "^1.3.1" } }, "sha512-5XHYaSyiqADb4RnZ1Bdad6cPp8Toise4TzEjcOYDHZkTCbKgiUl7WTUCpNWHuxmDt91wnsZBc9xinNzopv3JMQ=="], + } +} diff --git a/docker-compose.yml b/docker-compose.yml new file mode 100644 index 0000000..701d795 --- /dev/null +++ b/docker-compose.yml @@ -0,0 +1,46 @@ +# Local development stack for @hasna/instructions in cloud (PURE REMOTE) mode. +# docker compose run --rm instructions-migrate # apply schema first +# docker compose up --build instructions-serve +# Auth: mint a key with +# contracts issue-key --app instructions --scopes instructions:* +# using the SAME HASNA_INSTRUCTIONS_API_SIGNING_KEY and HASNA_INSTRUCTIONS_DATABASE_URL. +services: + postgres: + image: postgres:16-alpine + environment: + POSTGRES_USER: instructions + POSTGRES_PASSWORD: instructions + POSTGRES_DB: instructions + ports: + - "5436:5432" + healthcheck: + test: ["CMD-SHELL", "pg_isready -U instructions"] + interval: 5s + timeout: 3s + retries: 10 + + instructions-migrate: + build: . + command: ["bun", "dist/server/index.js", "migrate"] + environment: + HASNA_INSTRUCTIONS_STORAGE_MODE: cloud + HASNA_INSTRUCTIONS_DATABASE_URL: postgres://instructions:instructions@postgres:5432/instructions?sslmode=disable + HASNA_INSTRUCTIONS_API_SIGNING_KEY: dev-signing-secret-change-me + depends_on: + postgres: + condition: service_healthy + + instructions-serve: + build: . + ports: + - "8080:8080" + environment: + PORT: "8080" + HOST: 0.0.0.0 + INSTRUCTIONS_NO_OPEN: "true" + HASNA_INSTRUCTIONS_STORAGE_MODE: cloud + HASNA_INSTRUCTIONS_DATABASE_URL: postgres://instructions:instructions@postgres:5432/instructions?sslmode=disable + HASNA_INSTRUCTIONS_API_SIGNING_KEY: dev-signing-secret-change-me + depends_on: + instructions-migrate: + condition: service_completed_successfully diff --git a/docker/rds-global-bundle.pem b/docker/rds-global-bundle.pem new file mode 100644 index 0000000..99351b7 --- /dev/null +++ b/docker/rds-global-bundle.pem @@ -0,0 +1,2736 @@ +-----BEGIN CERTIFICATE----- +MIID/jCCAuagAwIBAgIQdOCSuA9psBpQd8EI368/0DANBgkqhkiG9w0BAQsFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIHNhLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTE5MTgwNjI2WhgPMjA2MTA1MTkxOTA2MjZaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgc2EtZWFzdC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAN6ftL6w8v3dB2yW +LjCxSP1D7ZsOTeLZOSCz1Zv0Gkd0XLhil5MdHOHBvwH/DrXqFU2oGzCRuAy+aZis +DardJU6ChyIQIciXCO37f0K23edhtpXuruTLLwUwzeEPdcnLPCX+sWEn9Y5FPnVm +pCd6J8edH2IfSGoa9LdErkpuESXdidLym/w0tWG/O2By4TabkNSmpdrCL00cqI+c +prA8Bx1jX8/9sY0gpAovtuFaRN+Ivg3PAnWuhqiSYyQ5nC2qDparOWuDiOhpY56E +EgmTvjwqMMjNtExfYx6Rv2Ndu50TriiNKEZBzEtkekwXInTupmYTvc7U83P/959V +UiQ+WSMCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU4uYHdH0+ +bUeh81Eq2l5/RJbW+vswDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB +AQBhxcExJ+w74bvDknrPZDRgTeMLYgbVJjx2ExH7/Ac5FZZWcpUpFwWMIJJxtewI +AnhryzM3tQYYd4CG9O+Iu0+h/VVfW7e4O3joWVkxNMb820kQSEwvZfA78aItGwOY +WSaFNVRyloVicZRNJSyb1UL9EiJ9ldhxm4LTT0ax+4ontI7zTx6n6h8Sr6r/UOvX +d9T5aUUENWeo6M9jGupHNn3BobtL7BZm2oS8wX8IVYj4tl0q5T89zDi2x0MxbsIV +5ZjwqBQ5JWKv7ASGPb+z286RjPA9R2knF4lJVZrYuNV90rHvI/ECyt/JrDqeljGL +BLl1W/UsvZo6ldLIpoMbbrb5 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEBDCCAuygAwIBAgIQUfVbqapkLYpUqcLajpTJWzANBgkqhkiG9w0BAQsFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIG1lLWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjIwNTA2MjMyMDA5WhgPMjA2MjA1MDcwMDIwMDlaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgbWUtY2VudHJhbC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJIeovu3 +ewI9FVitXMQzvkh34aQ6WyI4NO3YepfJaePiv3cnyFGYHN2S1cR3UQcLWgypP5va +j6bfroqwGbCbZZcb+6cyOB4ceKO9Ws1UkcaGHnNDcy5gXR7aCW2OGTUfinUuhd2d +5bOGgV7JsPbpw0bwJ156+MwfOK40OLCWVbzy8B1kITs4RUPNa/ZJnvIbiMu9rdj4 +8y7GSFJLnKCjlOFUkNI5LcaYvI1+ybuNgphT3nuu5ZirvTswGakGUT/Q0J3dxP0J +pDfg5Sj/2G4gXiaM0LppVOoU5yEwVewhQ250l0eQAqSrwPqAkdTg9ng360zqCFPE +JPPcgI1tdGUgneECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU +/2AJVxWdZxc8eJgdpbwpW7b0f7IwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB +CwUAA4IBAQBYm63jTu2qYKJ94gKnqc+oUgqmb1mTXmgmp/lXDbxonjszJDOXFbri +3CCO7xB2sg9bd5YWY8sGKHaWmENj3FZpCmoefbUx++8D7Mny95Cz8R32rNcwsPTl +ebpd9A/Oaw5ug6M0x/cNr0qzF8Wk9Dx+nFEimp8RYQdKvLDfNFZHjPa1itnTiD8M +TorAqj+VwnUGHOYBsT/0NY12tnwXdD+ATWfpEHdOXV+kTMqFFwDyhfgRVNpTc+os +ygr8SwhnSCpJPB/EYl2S7r+tgAbJOkuwUvGT4pTqrzDQEhwE7swgepnHC87zhf6l +qN6mVpSnQKQLm6Ob5TeCEFgcyElsF5bH +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjSgAwIBAgIRAOxu0I1QuMAhIeszB3fJIlkwCgYIKoZIzj0EAwMwgZYx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h +em9uIFJEUyB1cy13ZXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTI0MjIwNjU5WhgPMjEyMTA1MjQyMzA2NTlaMIGWMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS +RFMgdXMtd2VzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEz4bylRcGqqDWdP7gQIIoTHdBK6FNtKH1 +4SkEIXRXkYDmRvL9Bci1MuGrwuvrka5TDj4b7e+csY0llEzHpKfq6nJPFljoYYP9 +uqHFkv77nOpJJ633KOr8IxmeHW5RXgrZo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G +A1UdDgQWBBQQikVz8wmjd9eDFRXzBIU8OseiGzAOBgNVHQ8BAf8EBAMCAYYwCgYI +KoZIzj0EAwMDaAAwZQIwf06Mcrpw1O0EBLBBrp84m37NYtOkE/0Z0O+C7D41wnXi +EQdn6PXUVgdD23Gj82SrAjEAklhKs+liO1PtN15yeZR1Io98nFve+lLptaLakZcH ++hfFuUtCqMbaI8CdvJlKnPqT +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRALyWMTyCebLZOGcZZQmkmfcwDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI0MjAyODAzWhgPMjEyMTA1MjQyMTI4MDNa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTMgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +wGFiyDyCrGqgdn4fXG12cxKAAfVvhMea1mw5h9CVRoavkPqhzQpAitSOuMB9DeiP +wQyqcsiGl/cTEau4L+AUBG8b9v26RlY48exUYBXj8CieYntOT9iNw5WtdYJa3kF/ +JxgI+HDMzE9cmHDs5DOO3S0uwZVyra/xE1ymfSlpOeUIOTpHRJv97CBUEpaZMUW5 +Sr6GruuOwFVpO5FX3A/jQlcS+UN4GjSRgDUJuqg6RRQldEZGCVCCmodbByvI2fGm +reGpsPJD54KkmAX08nOR8e5hkGoHxq0m2DLD4SrOFmt65vG47qnuwplWJjtk9B3Z +9wDoopwZLBOtlkPIkUllWm1P8EuHC1IKOA+wSP6XdT7cy8S77wgyHzR0ynxv7q/l +vlZtH30wnNqFI0y9FeogD0TGMCHcnGqfBSicJXPy9T4fU6f0r1HwqKwPp2GArwe7 +dnqLTj2D7M9MyVtFjEs6gfGWXmu1y5uDrf+CszurE8Cycoma+OfjjuVQgWOCy7Nd +jJswPxAroTzVfpgoxXza4ShUY10woZu0/J+HmNmqK7lh4NS75q1tz75in8uTZDkV +be7GK+SEusTrRgcf3tlgPjSTWG3veNzFDF2Vn1GLJXmuZfhdlVQDBNXW4MNREExS +dG57kJjICpT+r8X+si+5j51gRzkSnMYs7VHulpxfcwECAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQU4JWOpDBmUBuWKvGPZelw87ezhL8wDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQBRNLMql7itvXSEFQRAnyOjivHz +l5IlWVQjAbOUr6ogZcwvK6YpxNAFW5zQr8F+fdkiypLz1kk5irx9TIpff0BWC9hQ +/odMPO8Gxn8+COlSvc+dLsF2Dax3Hvz0zLeKMo+cYisJOzpdR/eKd0/AmFdkvQoM +AOK9n0yYvVJU2IrSgeJBiiCarpKSeAktEVQ4rvyacQGr+QAPkkjRwm+5LHZKK43W +nNnggRli9N/27qYtc5bgr3AaQEhEXMI4RxPRXCLsod0ehMGWyRRK728a+6PMMJAJ +WHOU0x7LCEMPP/bvpLj3BdvSGqNor4ZtyXEbwREry1uzsgODeRRns5acPwTM6ff+ +CmxO2NZ0OktIUSYRmf6H/ZFlZrIhV8uWaIwEJDz71qvj7buhQ+RFDZ9CNL64C0X6 +mf0zJGEpddjANHaaVky+F4gYMtEy2K2Lcm4JGTdyIzUoIe+atzCnRp0QeIcuWtF+ +s8AjDYCVFNypcMmqbRmNpITSnOoCHSRuVkY3gutVoYyMLbp8Jm9SJnCIlEWTA6Rm +wADOMGZJVn5/XRTRuetVOB3KlQDjs9OO01XN5NzGSZO2KT9ngAUfh9Eqhf1iRWSP +nZlRbQ2NRCuY/oJ5N59mLGxnNJSE7giEKEBRhTQ/XEPIUYAUPD5fca0arKRJwbol +l9Se1Hsq0ZU5f+OZKQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIRAK7vlRrGVEePJpW1VHMXdlIwDQYJKoZIhvcNAQEMBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBhZi1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMTA1MTkxOTI4NDNaGA8yMTIxMDUxOTIwMjg0M1owgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBhZi1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMZiHOQC6x4o +eC7vVOMCGiN5EuLqPYHdceFPm4h5k/ZejXTf7kryk6aoKZKsDIYihkaZwXVS7Y/y +7Ig1F1ABi2jD+CYprj7WxXbhpysmN+CKG7YC3uE4jSvfvUnpzionkQbjJsRJcrPO +cZJM4FVaVp3mlHHtvnM+K3T+ni4a38nAd8xrv1na4+B8ZzZwWZXarfg8lJoGskSn +ou+3rbGQ0r+XlUP03zWujHoNlVK85qUIQvDfTB7n3O4s1XNGvkfv3GNBhYRWJYlB +4p8T+PFN8wG+UOByp1gV7BD64RnpuZ8V3dRAlO6YVAmINyG5UGrPzkIbLtErUNHO +4iSp4UqYvztDqJWWHR/rA84ef+I9RVwwZ8FQbjKq96OTnPrsr63A5mXTC9dXKtbw +XNJPQY//FEdyM3K8sqM0IdCzxCA1MXZ8+QapWVjwyTjUwFvL69HYky9H8eAER59K +5I7u/CWWeCy2R1SYUBINc3xxLr0CGGukcWPEZW2aPo5ibW5kepU1P/pzdMTaTfao +F42jSFXbc7gplLcSqUgWwzBnn35HLTbiZOFBPKf6vRRu8aRX9atgHw/EjCebi2xP +xIYr5Ub8u0QVHIqcnF1/hVzO/Xz0chj3E6VF/yTXnsakm+W1aM2QkZbFGpga+LMy +mFCtdPrELjea2CfxgibaJX1Q4rdEpc8DAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFDSaycEyuspo/NOuzlzblui8KotFMA4GA1UdDwEB/wQEAwIB +hjANBgkqhkiG9w0BAQwFAAOCAgEAbosemjeTRsL9o4v0KadBUNS3V7gdAH+X4vH2 +Ee1Jc91VOGLdd/s1L9UX6bhe37b9WjUD69ur657wDW0RzxMYgQdZ27SUl0tEgGGp +cCmVs1ky3zEN+Hwnhkz+OTmIg1ufq0W2hJgJiluAx2r1ib1GB+YI3Mo3rXSaBYUk +bgQuujYPctf0PA153RkeICE5GI3OaJ7u6j0caYEixBS3PDHt2MJWexITvXGwHWwc +CcrC05RIrTUNOJaetQw8smVKYOfRImEzLLPZ5kf/H3Cbj8BNAFNsa10wgvlPuGOW +XLXqzNXzrG4V3sjQU5YtisDMagwYaN3a6bBf1wFwFIHQoAPIgt8q5zaQ9WI+SBns +Il6rd4zfvjq/BPmt0uI7rVg/cgbaEg/JDL2neuM9CJAzmKxYxLQuHSX2i3Fy4Y1B +cnxnRQETCRZNPGd00ADyxPKVoYBC45/t+yVusArFt+2SVLEGiFBr23eG2CEZu+HS +nDEgIfQ4V3YOTUNa86wvbAss1gbbnT/v1XCnNGClEWCWNCSRjwV2ZmQ/IVTmNHPo +7axTTBBJbKJbKzFndCnuxnDXyytdYRgFU7Ly3sa27WS2KFyFEDebLFRHQEfoYqCu +IupSqBSbXsR3U10OTjc9z6EPo1nuV6bdz+gEDthmxKa1NI+Qb1kvyliXQHL2lfhr +5zT5+Bs= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/zCCA+egAwIBAgIRAOLV6zZcL4IV2xmEneN1GwswDQYJKoZIhvcNAQEMBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyB1cy13ZXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxOTE5MDg1OFoYDzIxMjEwNTE5MjAwODU4WjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIHVzLXdlc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC7koAKGXXlLixN +fVjhuqvz0WxDeTQfhthPK60ekRpftkfE5QtnYGzeovaUAiS58MYVzqnnTACDwcJs +IGTFE6Wd7sB6r8eI/3CwI1pyJfxepubiQNVAQG0zJETOVkoYKe/5KnteKtnEER3X +tCBRdV/rfbxEDG9ZAsYfMl6zzhEWKF88G6xhs2+VZpDqwJNNALvQuzmTx8BNbl5W +RUWGq9CQ9GK9GPF570YPCuURW7kl35skofudE9bhURNz51pNoNtk2Z3aEeRx3ouT +ifFJlzh+xGJRHqBG7nt5NhX8xbg+vw4xHCeq1aAe6aVFJ3Uf9E2HzLB4SfIT9bRp +P7c9c0ySGt+3n+KLSHFf/iQ3E4nft75JdPjeSt0dnyChi1sEKDi0tnWGiXaIg+J+ +r1ZtcHiyYpCB7l29QYMAdD0TjfDwwPayLmq//c20cPmnSzw271VwqjUT0jYdrNAm +gV+JfW9t4ixtE3xF2jaUh/NzL3bAmN5v8+9k/aqPXlU1BgE3uPwMCjrfn7V0I7I1 +WLpHyd9jF3U/Ysci6H6i8YKgaPiOfySimQiDu1idmPld659qerutUSemQWmPD3bE +dcjZolmzS9U0Ujq/jDF1YayN3G3xvry1qWkTci0qMRMu2dZu30Herugh9vsdTYkf +00EqngPbqtIVLDrDjEQLqPcb8QvWFQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBQBqg8Za/L0YMHURGExHfvPyfLbOTAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQEMBQADggIBACAGPMa1QL7P/FIO7jEtMelJ0hQlQepKnGtbKz4r +Xq1bUX1jnLvnAieR9KZmeQVuKi3g3CDU6b0mDgygS+FL1KDDcGRCSPh238Ou8KcG +HIxtt3CMwMHMa9gmdcMlR5fJF9vhR0C56KM2zvyelUY51B/HJqHwGvWuexryXUKa +wq1/iK2/d9mNeOcjDvEIj0RCMI8dFQCJv3PRCTC36XS36Tzr6F47TcTw1c3mgKcs +xpcwt7ezrXMUunzHS4qWAA5OGdzhYlcv+P5GW7iAA7TDNrBF+3W4a/6s9v2nQAnX +UvXd9ul0ob71377UhZbJ6SOMY56+I9cJOOfF5QvaL83Sz29Ij1EKYw/s8TYdVqAq ++dCyQZBkMSnDFLVe3J1KH2SUSfm3O98jdPORQrUlORQVYCHPls19l2F6lCmU7ICK +hRt8EVSpXm4sAIA7zcnR2nU00UH8YmMQLnx5ok9YGhuh3Ehk6QlTQLJux6LYLskd +9YHOLGW/t6knVtV78DgPqDeEx/Wu/5A8R0q7HunpWxr8LCPBK6hksZnOoUhhb8IP +vl46Ve5Tv/FlkyYr1RTVjETmg7lb16a8J0At14iLtpZWmwmuv4agss/1iBVMXfFk ++ZGtx5vytWU5XJmsfKA51KLsMQnhrLxb3X3zC+JRCyJoyc8++F3YEcRi2pkRYE3q +Hing +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/zCCAuegAwIBAgIRAI+asxQA/MB1cGyyrC0MPpkwDQYJKoZIhvcNAQELBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBjYS13ZXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIzMDkxMzIwMjEzNFoYDzIwNjMwOTEzMjEyMTMzWjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGNhLXdlc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDMHvQITTZcfl2O +yfzRIAPKwzzlc8eXWdXef7VUsbezg3lm9RC+vArO4JuAzta/aLw1D94wPSRm9JXX +NkP3obO6Ql80/0doooU6BAPceD0xmEWC4aCFT/5KWsD6Sy2/Rjwq3NKBTwzxLwYK +GqVsBp8AdrzDTmdRETC+Dg2czEo32mTDAA1uMgqrz6xxeTYroj8NTSTp6jfE6C0n +YgzYmVQCEIjHqI49j7k3jfT3P2skCVKGJwQzoZnerFacKzXsDB18uIqU7NaMc2cX +kOd0gRqpyKOzAHU2m5/S4jw4UHdkoI3E7nkayuen8ZPKH2YqWtTXUrXGhSTT34nX +yiFgu+vTAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHzz1NTd +TOm9zAv4d8l6XCFKSdJfMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC +AQEAodBvd0cvXQYhFBef2evnuI9XA+AC/Q9P1nYtbp5MPA4aFhy5v9rjW8wwJX14 +l+ltd2o3tz8PFDBZ1NX2ooiWVlZthQxKn1/xDVKsTXHbYUXItPQ3jI5IscB5IML8 +oCzAbkoLXsSPNOVFP5P4l4cZEMqHGRnBag7hLJZvmvzZSBnz+ioC2jpjVluF8kDX +fQGNjqPECik68CqbSV0SaQ0cgEoYTDjwON5ZLBeS8sxR2abE/gsj4VFYl5w/uEBd +w3Tt9uGfIy+wd2tNj6isGC6PcbPMjA31jd+ifs2yNzigqkcYTTWFtnvh4a8xiecm +GHu2EgH0Jqzz500N7L3uQdPkdg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRALnItUH64VieFPvDUCOG5E0wDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNSBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjQwNTE1MjE1MDQxWhgPMjEyNDA1MTUyMjUwNDFa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTUgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +u2Bc0RjN0vB7EM+h0yts1jSqzDd1v5FcxCDbC7vKPVCq/1pYNTIxQj77HiMcYtvL +Bfi9AQFibU1C9gN62kUmSe0QaNGqQL2g/6YpB4qI8psIsCt3aIigbhwEEpebhIU/ +vhr/pvLKhkQOSLxJVlX0j18hU5RVqOefCdFm9FmjFLge/m1Yzv2aFifRKIzdtkfp +4VZBzh7EzP6lxkU3SAcW9yRu/t4oY274ICnGisv2TR15hHlP0wUP6p5S3ot2q/xJ +57x8nzI3kQyC6a+n+kSzZzITboKWrsx3Jd2PdB4VC84P/YoAC3cwfmacmQVT01c8 +io1eO+BxCtWUNbwCv0Hd10bHI18rVzJhJPb3xg1i1Sc3sbcrADOONsuhxqwffjUe +XdVMdsjX2mYxQ520qnh5DwQkx3JyW6QwI/ueU9xbMuPTwAauXil7B9qx1IDViYUw +BvMDnxYbYHlDezYIc4WoNoA2KflMnNtN2WDiM7tvQKmWI8yYZrNdnqBD0HYR+neP +z69Tqy8i24CDoR9o3s5LxR58SgFPqu9RWu8uL6vfNLL2M8qQ4VueOWSyzRs9b3W5 +GVjA4U1CxlF3EirHEjciq6UEXr5+ZVf79iXGOwBVDzuim1LYfoTBgkMXKxyEzWYT +QCzf6VPW4x7eMQIriLl18YocHrqJQ7+BfMziYjOh0rcCAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUQdyu9F6eLFuxe437iU/GXyFHU1owDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCbbNUJRQ1gy1lKxCoszcyujCI5 +df0EGdadQL6BgaXws/uCFvHepB5lO62InAMTURCREeRtrCNyn1rEKnsqhAW0UokQ +Z+YOHcclgPsXmSQVjIUgnlE45mrPS/9mO8TzhCI3wyiELp6oa67RSiJ1Qcsypa4z +zHDkYdhFW3sxY8i2p2tqdkJz1ZEQd7FIpX+vrBVIkoqtGAn4urLaMq4CTNJCNepR +s4OGaoQVY43q2kcguRPDZVOFK5+GlrC2AzHMSVt5fFSCchgYxBZsS3UIVKm8YJ7v +1h85RwtNCHwwDt1uP43yLp5qfUmsfeaNmZiOk9AawxPCmy6XaSkQcLz+CQhG9T4W +siQMg6tagIUw1e4zFm7GXmeOCPc//ycGNDXgprMQzjK+AT4ed8iK+JnWlheMq5uf +XxQDSfakuAIEgJWPAzebjCo33O2j1PQfzbt1Ahs7f+gFczizfpatYkXcOTmLfG1l +QKj9jVNOIQSJt5PxH+QTDWQtkX/tGp/HS5a3dWusW/TnC3yakGqqfGx3cB/E00gF +geg0LYo1uOBjIYQbkp3Z6NKfcc/nb0ksV7feKm5f3rSO8NnA0Ou8YHb84LYDLYDf +VSR9SwSBhGw31otMTAsJdNTHJwfCcxfGtIvUfAsWUAh6qSo4es/hUV60pj01VWpq +Er+ItMFHuoSTmx18bw== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRANxgyBbnxgTEOpDul2ZnC0UwDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMyBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNjEwMTgxOTA3WhgPMjA2MTA2MTAxOTE5MDda +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTMgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +xnwSDAChrMkfk5TA4Dk8hKzStDlSlONzmd3fTG0Wqr5+x3EmFT6Ksiu/WIwEl9J2 +K98UI7vYyuZfCxUKb1iMPeBdVGqk0zb92GpURd+Iz/+K1ps9ZLeGBkzR8mBmAi1S +OfpwKiTBzIv6E8twhEn4IUpHsdcuX/2Y78uESpJyM8O5CpkG0JaV9FNEbDkJeBUQ +Ao2qqNcH4R0Qcr5pyeqA9Zto1RswgL06BQMI9dTpfwSP5VvkvcNUaLl7Zv5WzLQE +JzORWePvdPzzvWEkY/3FPjxBypuYwssKaERW0fkPDmPtykktP9W/oJolKUFI6pXp +y+Y6p6/AVdnQD2zZjW5FhQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBT+jEKs96LC+/X4BZkUYUkzPfXdqTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBAIGQqgqcQ6XSGkmNebzR6DhadTbfDmbYeN5N0Vuzv+Tdmufb +tMGjdjnYMg4B+IVnTKQb+Ox3pL9gbX6KglGK8HupobmIRtwKVth+gYYz3m0SL/Nk +haWPYzOm0x3tJm8jSdufJcEob4/ATce9JwseLl76pSWdl5A4lLjnhPPKudUDfH+1 +BLNUi3lxpp6GkC8aWUPtupnhZuXddolTLOuA3GwTZySI44NfaFRm+o83N1jp+EwD +6e94M4cTRzjUv6J3MZmSbdtQP/Tk1uz2K4bQZGP0PZC3bVpqiesdE/xr+wbu8uHr +cM1JXH0AmXf1yIkTgyWzmvt0k1/vgcw5ixAqvvE= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEATCCAumgAwIBAgIRAMhw98EQU18mIji+unM2YH8wDQYJKoZIhvcNAQELBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMjA2MDYyMTQyMjJaGA8yMDYyMDYwNjIyNDIyMlowgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIeeRoLfTm+7 +vqm7ZlFSx+1/CGYHyYrOOryM4/Z3dqYVHFMgWTR7V3ziO8RZ6yUanrRcWVX3PZbF +AfX0KFE8OgLsXEZIX8odSrq86+/Th5eZOchB2fDBsUB7GuN2rvFBbM8lTI9ivVOU +lbuTnYyb55nOXN7TpmH2bK+z5c1y9RVC5iQsNAl6IJNvSN8VCqXh31eK5MlKB4DT ++Y3OivCrSGsjM+UR59uZmwuFB1h+icE+U0p9Ct3Mjq3MzSX5tQb6ElTNGlfmyGpW +Kh7GQ5XU1KaKNZXoJ37H53woNSlq56bpVrKI4uv7ATpdpFubOnSLtpsKlpLdR3sy +Ws245200pC8CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUp0ki +6+eWvsnBjQhMxwMW5pwn7DgwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUA +A4IBAQB2V8lv0aqbYQpj/bmVv/83QfE4vOxKCJAHv7DQ35cJsTyBdF+8pBczzi3t +3VNL5IUgW6WkyuUOWnE0eqAFOUVj0yTS1jSAtfl3vOOzGJZmWBbqm9BKEdu1D8O6 +sB8bnomwiab2tNDHPmUslpdDqdabbkWwNWzLJ97oGFZ7KNODMEPXWKWNxg33iHfS +/nlmnrTVI3XgaNK9qLZiUrxu9Yz5gxi/1K+sG9/Dajd32ZxjRwDipOLiZbiXQrsd +qzIMY4GcWf3g1gHL5mCTfk7dG22h/rhPyGV0svaDnsb+hOt6sv1McMN6Y3Ou0mtM +/UaAXojREmJmTSCNvs2aBny3/2sy +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGBDCCA+ygAwIBAgIQID5K+9PRwKbkBpe2il3rBjANBgkqhkiG9w0BAQwFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIG14LWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjQwOTMwMTYxMzU1WhgPMjEyNDA5MzAxNzEzNTVaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgbXgtY2VudHJhbC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAI25WbHf +qmz3amzhuAXMOIrt/UZpWk24hjRYVmuY7ePaz01cDJ7K/hrEzhXDBBitF+KKxPXD +XXJ/KCP/joQL4ZaPiYPdeNQcO09wK31HMWsaJeHVHIuoWmKneK/ojpMtirjrdqo+ +3Hy7NMMhnkIy8KUzXTQX8hVFnDVfbjEhWppBFOtGlS8A8I85LALrj3Mvg8BPBl0Z +JZvPhTzQAu5u5wHaJVgVKflLl1wrpNvVyHx5ryar2bSPwLtu8HEFp1TbgiZ5VD/7 +AUCfa2+fh5BRRVl3fF+7DqKtPXR5a9bJsyiieyhQa43ZDPpLQgurSjO4tBH6Mfhc +x6cJ0OLOWK2ZhuGZGF4pGwH2srGrVzzecFyd2YTV8yuCTpo/lIIW74T+aV/udJXr +AwjjOoToYifg3U2ipNCcy+lEit/LE0BVmNNGhggIioitfgOIqhJD12/9f+jewcnI +pN510DngrY2+jRHYtqbS3rVpG6K5zsE1NPYDoJM6AA1iub/sVZzNU/TIt0TtuvY7 +izkg+o6AtUzlgqGaMM2emH+nkMyYWqteWHLeLEYRQ79laaQRKpuZV+cP5sCHSAYr +Fwww1SqtR5ad+OexNp0Hqmrl1LMucmWXSjbmEYfPYCkPV/hEWI/am/FX7VlkSNGy +S7+k0eCBawj/fQj2xlADIQnfa/qf+17e7bypAgMBAAGjQjBAMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFNtXwWHyvClTO1X0qH9DGxcwsgQtMA4GA1UdDwEB/wQE +AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAjID7uJb3fQzOgjUA24WoBMd784H64geM +IoYIzm0e7f4ZkI/NZoKAA1UPF+kW49A7Y7Un6YHf1WH9Y8EH3zwaDmak3Lzbw9Q6 ++FY9BkynZ3LbGYdo1tdK/7dvRw/+gjMzN70vPmHQINvAt5r+33jwXicsvQtqLTP3 +vYLfR028B94eH73xOUKMoqp0cDNlHoAY413CCYlXUxdPnfQzhaF8EySwa2Ws9HOh +/oDeU4ztaPfnMIH0jx6tf584HzSgW7h0wXLOodtNlI74+wr/42ltFQxRWZd34FaK +R0OOJRBESuWeZUiCYucVn6Vw9jhJ5qVPcGPlSWim15UanTPh0+Ysqb4o5NO8GfWH +wAmLO4MA4BJw1zJSi/7RblwuksdHpQ/sWK+OoGxwhp48KHDTpOJLJ0aJaXQDNF+B +X/9Vl0zo05IQz+0C0L6RgBFiGnJtYW30Um9aHjbpz15Ov0tpajaL3iB7VlSKi/DS +e3CsjQqkh0sUpnU+T31eJiDiHZ5z+Oq4VJtI+gK9dcVP4LjSvlMUcl+scQifXr+X +GlJVyCphLVRtfHUv411ezQGmJFIJRMyfo+SKYWyDAvSrPxs6F6qDr54ShRuWBhrJ +qLJw1abcDEJFlTFsNcWghF4H0iTMg46UAr+RMJBB0uC9ZqY207wT63px7vgDXSCs +Pz5G0lqE904= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjSgAwIBAgIRAMnRxsKLYscJV8Qv5pWbL7swCgYIKoZIzj0EAwMwgZYx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h +em9uIFJEUyBzYS1lYXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTE5MTgxNjAxWhgPMjEyMTA1MTkxOTE2MDFaMIGWMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS +RFMgc2EtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEjFOCZgTNVKxLKhUxffiDEvTLFhrmIqdO +dKqVdgDoELEzIHWDdC+19aDPitbCYtBVHl65ITu/9pn6mMUl5hhUNtfZuc6A+Iw1 +sBe0v0qI3y9Q9HdQYrGgeHDh8M5P7E2ho0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G +A1UdDgQWBBS5L7/8M0TzoBZk39Ps7BkfTB4yJTAOBgNVHQ8BAf8EBAMCAYYwCgYI +KoZIzj0EAwMDaAAwZQIwI43O0NtWKTgnVv9z0LO5UMZYgSve7GvGTwqktZYCMObE +rUI4QerXM9D6JwLy09mqAjEAypfkdLyVWtaElVDUyHFkihAS1I1oUxaaDrynLNQK +Ou/Ay+ns+J+GyvyDUjBpVVW1 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/jCCA+agAwIBAgIQR71Z8lTO5Sj+as2jB7IWXzANBgkqhkiG9w0BAQwFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIHVzLXdlc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTI0MjIwMzIwWhgPMjEyMTA1MjQyMzAzMjBaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgdXMtd2VzdC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAM977bHIs1WJijrS +XQMfUOhmlJjr2v0K0UjPl52sE1TJ76H8umo1yR4T7Whkd9IwBHNGKXCJtJmMr9zp +fB38eLTu+5ydUAXdFuZpRMKBWwPVe37AdJRKqn5beS8HQjd3JXAgGKUNNuE92iqF +qi2fIqFMpnJXWo0FIW6s2Dl2zkORd7tH0DygcRi7lgVxCsw1BJQhFJon3y+IV8/F +bnbUXSNSDUnDW2EhvWSD8L+t4eiXYsozhDAzhBvojpxhPH9OB7vqFYw5qxFx+G0t +lSLX5iWi1jzzc3XyGnB6WInZDVbvnvJ4BGZ+dTRpOCvsoMIn9bz4EQTvu243c7aU +HbS/kvnCASNt+zk7C6lbmaq0AGNztwNj85Opn2enFciWZVnnJ/4OeefUWQxD0EPp +SjEd9Cn2IHzkBZrHCg+lWZJQBKbUVS0lLIMSsLQQ6WvR38jY7D2nxM1A93xWxwpt +ZtQnYRCVXH6zt2OwDAFePInWwxUjR5t/wu3XxPgpSfrmTi3WYtr1wFypAJ811e/P +yBtswWUQ6BNJQvy+KnOEeGfOwmtdDFYR+GOCfvCihzrKJrxOtHIieehR5Iw3cbXG +sm4pDzfMUVvDDz6C2M6PRlJhhClbatHCjik9hxFYEsAlqtVVK9pxaz9i8hOqSFQq +kJSQsgWw+oM/B2CyjcSqkSQEu8RLAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w +HQYDVR0OBBYEFPmrdxpRRgu3IcaB5BTqlprcKdTsMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQwFAAOCAgEAVdlxWjPvVKky3kn8ZizeM4D+EsLw9dWLau2UD/ls +zwDCFoT6euagVeCknrn+YEl7g20CRYT9iaonGoMUPuMR/cdtPL1W/Rf40PSrGf9q +QuxavWiHLEXOQTCtCaVZMokkvjuuLNDXyZnstgECuiZECTwhexUF4oiuhyGk9o01 +QMaiz4HX4lgk0ozALUvEzaNd9gWEwD2qe+rq9cQMTVq3IArUkvTIftZUaVUMzr0O +ed1+zAsNa9nJhURJ/6anJPJjbQgb5qA1asFcp9UaMT1ku36U3gnR1T/BdgG2jX3X +Um0UcaGNVPrH1ukInWW743pxWQb7/2sumEEMVh+jWbB18SAyLI4WIh4lkurdifzS +IuTFp8TEx+MouISFhz/vJDWZ84tqoLVjkEcP6oDypq9lFoEzHDJv3V1CYcIgOusT +k1jm9P7BXdTG7TYzUaTb9USb6bkqkD9EwJAOSs7DI94aE6rsSws2yAHavjAMfuMZ +sDAZvkqS2Qg2Z2+CI6wUZn7mzkJXbZoqRjDvChDXEB1mIhzVXhiNW/CR5WKVDvlj +9v1sdGByh2pbxcLQtVaq/5coM4ANgphoNz3pOYUPWHS+JUrIivBZ+JobjXcxr3SN +9iDzcu5/FVVNbq7+KN/nvPMngT+gduEN5m+EBjm8GukJymFG0m6BENRA0QSDqZ7k +zDY= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRAK5EYG3iHserxMqgg+0EFjgwDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI0MjAyMzE2WhgPMjA2MTA1MjQyMTIzMTZa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTMgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +s1L6TtB84LGraLHVC+rGPhLBW2P0oN/91Rq3AnYwqDOuTom7agANwEjvLq7dSRG/ +sIfZsSV/ABTgArZ5sCmLjHFZAo8Kd45yA9byx20RcYtAG8IZl+q1Cri+s0XefzyO +U6mlfXZkVe6lzjlfXBkrlE/+5ifVbJK4dqOS1t9cWIpgKqv5fbE6Qbq4LVT+5/WM +Vd2BOljuBMGMzdZubqFKFq4mzTuIYfnBm7SmHlZfTdfBYPP1ScNuhpjuzw4n3NCR +EdU6dQv04Q6th4r7eiOCwbWI9LkmVbvBe3ylhH63lApC7MiiPYLlB13xBubVHVhV +q1NHoNTi+zA3MN9HWicRxQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBSuxoqm0/wjNiZLvqv+JlQwsDvTPDAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBAFfTK/j5kv90uIbM8VaFdVbr/6weKTwehafT0pAk1bfLVX+7 +uf8oHgYiyKTTl0DFQicXejghXTeyzwoEkWSR8c6XkhD5vYG3oESqmt/RGvvoxz11 +rHHy7yHYu7RIUc3VQG60c4qxXv/1mWySGwVwJrnuyNT9KZXPevu3jVaWOVHEILaK +HvzQ2YEcWBPmde/zEseO2QeeGF8FL45Q1d66wqIP4nNUd2pCjeTS5SpB0MMx7yi9 +ki1OH1pv8tOuIdimtZ7wkdB8+JSZoaJ81b8sRrydRwJyvB88rftuI3YB4WwGuONT +ZezUPsmaoK69B0RChB0ofDpAaviF9V3xOWvVZfo= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGDzCCA/egAwIBAgIRAI0sMNG2XhaBMRN3zD7ZyoEwDQYJKoZIhvcNAQEMBQAw +gZ8xCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE4MDYGA1UEAwwv +QW1hem9uIFJEUyBQcmV2aWV3IHVzLWVhc3QtMiBSb290IENBIFJTQTQwOTYgRzEx +EDAOBgNVBAcMB1NlYXR0bGUwIBcNMjEwNTE4MjA1NzUwWhgPMjEyMTA1MTgyMTU3 +NTBaMIGfMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNl +cywgSW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExODA2BgNV +BAMML0FtYXpvbiBSRFMgUHJldmlldyB1cy1lYXN0LTIgUm9vdCBDQSBSU0E0MDk2 +IEcxMRAwDgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC +CgKCAgEAh/otSiCu4Uw3hu7OJm0PKgLsLRqBmUS6jihcrkxfN2SHmp2zuRflkweU +BhMkebzL+xnNvC8okzbgPWtUxSmDnIRhE8J7bvSKFlqs/tmEdiI/LMqe/YIKcdsI +20UYmvyLIjtDaJIh598SHHlF9P8DB5jD8snJfhxWY+9AZRN+YVTltgQAAgayxkWp +M1BbvxpOnz4CC00rE0eqkguXIUSuobb1vKqdKIenlYBNxm2AmtgvQfpsBIQ0SB+8 +8Zip8Ef5rtjSw5J3s2Rq0aYvZPfCVIsKYepIboVwXtD7E9J31UkB5onLBQlaHaA6 +XlH4srsMmrew5d2XejQGy/lGZ1nVWNsKO0x/Az2QzY5Kjd6AlXZ8kq6H68hscA5i +OMbNlXzeEQsZH0YkId3+UsEns35AAjZv4qfFoLOu8vDotWhgVNT5DfdbIWZW3ZL8 +qbmra3JnCHuaTwXMnc25QeKgVq7/rG00YB69tCIDwcf1P+tFJWxvaGtV0g2NthtB +a+Xo09eC0L53gfZZ3hZw1pa3SIF5dIZ6RFRUQ+lFOux3Q/I3u+rYstYw7Zxc4Zeo +Y8JiedpQXEAnbw2ECHix/L6mVWgiWCiDzBnNLLdbmXjJRnafNSndSfFtHCnY1SiP +aCrNpzwZIJejoV1zDlWAMO+gyS28EqzuIq3WJK/TFE7acHkdKIcCAwEAAaNCMEAw +DwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUrmV1YASnuudfmqAZP4sKGTvScaEw +DgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQBGpEKeQoPvE85tN/25 +qHFkys9oHDl93DZ62EnOqAUKLd6v0JpCyEiop4nlrJe+4KrBYVBPyKOJDcIqE2Sp +3cvgJXLhY4i46VM3Qxe8yuYF1ElqBpg3jJVj/sCQnYz9dwoAMWIJFaDWOvmU2E7M +MRaKx+sPXFkIjiDA6Bv0m+VHef7aedSYIY7IDltEQHuXoqNacGrYo3I50R+fZs88 +/mB3e/V7967e99D6565yf9Lcjw4oQf2Hy7kl/6P9AuMz0LODnGITwh2TKk/Zo3RU +Vgq25RDrT4xJK6nFHyjUF6+4cOBxVpimmFw/VP1zaXT8DN5r4HyJ9p4YuSK8ha5N +2pJc/exvU8Nv2+vS/efcDZWyuEdZ7eh1IJWQZlOZKIAONfRDRTpeQHJ3zzv3QVYy +t78pYp/eWBHyVIfEE8p2lFKD4279WYe+Uvdb8c4Jm4TJwqkSJV8ifID7Ub80Lsir +lPAU3OCVTBeVRFPXT2zpC4PB4W6KBSuj6OOcEu2y/HgWcoi7Cnjvp0vFTUhDFdus +Wz3ucmJjfVsrkEO6avDKu4SwdbVHsk30TVAwPd6srIdi9U6MOeOQSOSE4EsrrS7l +SVmu2QIDUVFpm8QAHYplkyWIyGkupyl3ashH9mokQhixIU/Pzir0byePxHLHrwLu +1axqeKpI0F5SBUPsaVNYY2uNFg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECDCCAvCgAwIBAgIQCREfzzVyDTMcNME+gWnTCTANBgkqhkiG9w0BAQsFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yMTA1MjQyMDQyMzNaGA8yMDYxMDUyNDIxNDIzM1ow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDL +1MT6br3L/4Pq87DPXtcjlXN3cnbNk2YqRAZHJayStTz8VtsFcGPJOpk14geRVeVk +e9uKFHRbcyr/RM4owrJTj5X4qcEuATYZbo6ou/rW2kYzuWFZpFp7lqm0vasV4Z9F +fChlhwkNks0UbM3G+psCSMNSoF19ERunj7w2c4E62LwujkeYLvKGNepjnaH10TJL +2krpERd+ZQ4jIpObtRcMH++bTrvklc+ei8W9lqrVOJL+89v2piN3Ecdd389uphst +qQdb1BBVXbhUrtuGHgVf7zKqN1SkCoktoWxVuOprVWhSvr7akaWeq0UmlvbEsujU +vADqxGMcJFyCzxx3CkJjAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O +BBYEFFk8UJmlhoxFT3PP12PvhvazHjT4MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG +9w0BAQsFAAOCAQEAfFtr2lGoWVXmWAsIo2NYre7kzL8Xb9Tx7desKxCCz5HOOvIr +8JMB1YK6A7IOvQsLJQ/f1UnKRh3X3mJZjKIywfrMSh0FiDf+rjcEzXxw2dGtUem4 +A+WMvIA3jwxnJ90OQj5rQ8bg3iPtE6eojzo9vWQGw/Vu48Dtw1DJo9210Lq/6hze +hPhNkFh8fMXNT7Q1Wz/TJqJElyAQGNOXhyGpHKeb0jHMMhsy5UNoW5hLeMS5ffao +TBFWEJ1gVfxIU9QRxSh+62m46JIg+dwDlWv8Aww14KgepspRbMqDuaM2cinoejv6 +t3dyOyHHrsOyv3ffZUKtQhQbQr+sUcL89lARsg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/jCCAuagAwIBAgIQSDZkikDRk3Yz12jYvk5noDANBgkqhkiG9w0BAQsFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIGFwLWVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjUwMjAxMDAxMDIxWhgPMjA2NTAyMDEwMTEwMjFaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgYXAtZWFzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAKF7hTKGtJjPxPd5 +3reviptmh3QhN9tmcff4AIzU53BowyCGPgLJvw0JRSm4rgfDZAQ2rqQPbnWP9UBW +dZED3axk2bLWL6fddURHR5ckdb/Lv0NuNG/vdrG7l2V1jBasZNqAEVtASovdEHPX +Razz3DTedOSSKUttdJZtL4XbVLUMkB3YaT8a1UagQnuKO1pRiy9lvRUdP6hlhFW9 +qGduF/ZsTpFfxHp8VhOpAnMhwd4qHik8GLXdB9ajeKko84MU3tQn52GS4zvXWwY9 +dxeC0QjDcK2dG8m/43e01yDAonaVJPI3R849aNtiBA4U+8au0CNva5n6WNI5LQIO +XZmp5D8CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUg6d1N4oJ +YOE1eAtYJexRSiFCpXEwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB +AQAOOBaSlMo+jhgz0ADaFuvFyaI+EVDB9GFT1TLpAmEK0gfNDI/RlY/n7hSKHJj0 +1ZeGfJ+9THD78QBuK7VyYlUkngYDdvEpg45ZEVKWGUtUmrhkikSsa5N8vioE3xg9 +MeSfgP98ykXVQH1kLSTUhLku8aLkwRdK96kSIKHRMUy41A9lK20X9Rc1dSsFJ/qe +TUFGCxwurKwR6geC+cw8aNjXHZlHZGNJPS+gRTizN1WYjEtJkjd5kQeNPgyppX26 +kRB9Vh54WJNIrs8PB9JsX9exu8f8m3hg5FFZONH5iBg0gdEMvbePP7JsjZD5BbjU +5C26Juxnw77pZbi0m7m3cmxL +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/zCCAuegAwIBAgIRAIJLTMpzGNxqHZ4t+c1MlCIwDQYJKoZIhvcNAQELBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBhcC1lYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyNTIxMzAzM1oYDzIwNjEwNTI1MjIzMDMzWjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGFwLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtdHut0ZhJ9Nn2 +MpVafFcwHdoEzx06okmmhjJsNy4l9QYVeh0UUoek0SufRNMRF4d5ibzpgZol0Y92 +/qKWNe0jNxhEj6sXyHsHPeYtNBPuDMzThfbvsLK8z7pBP7vVyGPGuppqW/6m4ZBB +lcc9fsf7xpZ689iSgoyjiT6J5wlVgmCx8hFYc/uvcRtfd8jAHvheug7QJ3zZmIye +V4htOW+fRVWnBjf40Q+7uTv790UAqs0Zboj4Yil+hER0ibG62y1g71XcCyvcVpto +2/XW7Y9NCgMNqQ7fGN3wR1gjtSYPd7DO32LTzYhutyvfbpAZjsAHnoObmoljcgXI +QjfBcCFpAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFJI3aWLg +CS5xqU5WYVaeT5s8lpO0MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC +AQEAUwATpJOcGVOs3hZAgJwznWOoTzOVJKfrqBum7lvkVH1vBwxBl9CahaKj3ZOt +YYp2qJzhDUWludL164DL4ZjS6eRedLRviyy5cRy0581l1MxPWTThs27z+lCC14RL +PJZNVYYdl7Jy9Q5NsQ0RBINUKYlRY6OqGDySWyuMPgno2GPbE8aynMdKP+f6G/uE +YHOf08gFDqTsbyfa70ztgVEJaRooVf5JJq4UQtpDvVswW2reT96qi6tXPKHN5qp3 +3wI0I1Mp4ePmiBKku2dwYzPfrJK/pQlvu0Gu5lKOQ65QdotwLAAoaFqrf9za1yYs +INUkHLWIxDds+4OHNYcerGp5Dw== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtzCCAj2gAwIBAgIQc48r2iRBCPPCj3oRSgZxujAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC03IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTI0MDkxMjE1NTQ0MFoYDzIxMjQwOTEyMTY1NDQwWjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC03IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEVSBo1+i/T9w0C7C1qdnl +DfUXpFa+x4QYZvwLtt6m9L96k5irB7Wlw5168uTBW/ssRbv067PBnQEdZfI3iLKK +xWSpDFZN11tRneyDXag/fj1MCzBQ25WG+BitQdbzzuYuo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBTiqTOsp/NisMSxMzARIGIKFcol4TAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAJlFgjECsVieUHNKE2Cmbj1wujERebHM +YNqCdnO//DeQ6Rh4SJkNaWB9LRmrmsdvIwIwf2iyQNetoO2JWNt7gzdRjO+7dF2+ +/LdagQCVp4R2N1Q6xzttRqZEK0lyAd0t7wlX +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRAIO6ldra1KZvNWJ0TA1ihXEwDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIxMjE0NTA1WhgPMjEyMTA1MjEyMjQ1MDVa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +sDN52Si9pFSyZ1ruh3xAN0nVqEs960o2IK5CPu/ZfshFmzAwnx/MM8EHt/jMeZtj +SM58LADAsNDL01ELpFZATjgZQ6xNAyXRXE7RiTRUvNkK7O3o2qAGbLnJq/UqF7Sw +LRnB8V6hYOv+2EjVnohtGCn9SUFGZtYDjWXsLd4ML4Zpxv0a5LK7oEC7AHzbUR7R +jsjkrXqSv7GE7bvhSOhMkmgxgj1F3J0b0jdQdtyyj109aO0ATUmIvf+Bzadg5AI2 +A9UA+TUcGeebhpHu8AP1Hf56XIlzPpaQv3ZJ4vzoLaVNUC7XKzAl1dlvCl7Klg/C +84qmbD/tjZ6GHtzpLKgg7kQEV7mRoXq8X4wDX2AFPPQl2fv+Kbe+JODqm5ZjGegm +uskABBi8IFv1hYx9jEulZPxC6uD/09W2+niFm3pirnlWS83BwVDTUBzF+CooUIMT +jhWkIIZGDDgMJTzouBHfoSJtS1KpUZi99m2WyVs21MNKHeWAbs+zmI6TO5iiMC+T +uB8spaOiHFO1573Fmeer4sy3YA6qVoqVl6jjTQqOdy3frAMbCkwH22/crV8YA+08 +hLeHXrMK+6XUvU+EtHAM3VzcrLbuYJUI2XJbzTj5g0Eb8I8JWsHvWHR5K7Z7gceR +78AzxQmoGEfV6KABNWKsgoCQnfb1BidDJIe3BsI0A6UCAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUABp0MlB14MSHgAcuNSOhs3MOlUcwDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCv4CIOBSQi/QR9NxdRgVAG/pAh +tFJhV7OWb/wqwsNKFDtg6tTxwaahdCfWpGWId15OUe7G9LoPiKiwM9C92n0ZeHRz +4ewbrQVo7Eu1JI1wf0rnZJISL72hVYKmlvaWaacHhWxvsbKLrB7vt6Cknxa+S993 +Kf8i2Psw8j5886gaxhiUtzMTBwoDWak8ZaK7m3Y6C6hXQk08+3pnIornVSFJ9dlS +PAqt5UPwWmrEfF+0uIDORlT+cvrAwgSp7nUF1q8iasledycZ/BxFgQqzNwnkBDwQ +Z/aM52ArGsTzfMhkZRz9HIEhz1/0mJw8gZtDVQroD8778h8zsx2SrIz7eWQ6uWsD +QEeSWXpcheiUtEfzkDImjr2DLbwbA23c9LoexUD10nwohhoiQQg77LmvBVxeu7WU +E63JqaYUlOLOzEmNJp85zekIgR8UTkO7Gc+5BD7P4noYscI7pPOL5rP7YLg15ZFi +ega+G53NTckRXz4metsd8XFWloDjZJJq4FfD60VuxgXzoMNT9wpFTNSH42PR2s9L +I1vcl3w8yNccs9se2utM2nLsItZ3J0m/+QSRiw9hbrTYTcM9sXki0DtH2kyIOwYf +lOrGJDiYOIrXSQK36H0gQ+8omlrUTvUj4msvkXuQjlfgx6sgp2duOAfnGxE7uHnc +UhnJzzoe6M+LfGHkVQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICuDCCAj2gAwIBAgIQSAG6j2WHtWUUuLGJTPb1nTAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLW5vcnRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMDE2MzgyNloYDzIxMjEwNTIwMTczODI2WjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLW5vcnRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE2eqwU4FOzW8RV1W381Bd +olhDOrqoMqzWli21oDUt7y8OnXM/lmAuOS6sr8Nt61BLVbONdbr+jgCYw75KabrK +ZGg3siqvMOgabIKkKuXO14wtrGyGDt7dnKXg5ERGYOZlo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBS1Acp2WYxOcblv5ikZ3ZIbRCCW+zAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAJL84J08PBprxmsAKPTotBuVI3MyW1r8 +xQ0i8lgCQUf8GcmYjQ0jI4oZyv+TuYJAcwIxAP9Xpzq0Docxb+4N1qVhpiOfWt1O +FnemFiy9m1l+wv6p3riQMPV7mBVpklmijkIv3Q== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRALZLcqCVIJ25maDPE3sbPCIwDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIxMjEzOTM5WhgPMjA2MTA1MjEyMjM5Mzla +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +ypKc+6FfGx6Gl6fQ78WYS29QoKgQiur58oxR3zltWeg5fqh9Z85K5S3UbRSTqWWu +Xcfnkz0/FS07qHX+nWAGU27JiQb4YYqhjZNOAq8q0+ptFHJ6V7lyOqXBq5xOzO8f ++0DlbJSsy7GEtJp7d7QCM3M5KVY9dENVZUKeJwa8PC5StvwPx4jcLeZRJC2rAVDG +SW7NAInbATvr9ssSh03JqjXb+HDyywiqoQ7EVLtmtXWimX+0b3/2vhqcH5jgcKC9 +IGFydrjPbv4kwMrKnm6XlPZ9L0/3FMzanXPGd64LQVy51SI4d5Xymn0Mw2kMX8s6 +Nf05OsWcDzJ1n6/Q1qHSxQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBRmaIc8eNwGP7i6P7AJrNQuK6OpFzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBAIBeHfGwz3S2zwIUIpqEEI5/sMySDeS+3nJR+woWAHeO0C8i +BJdDh+kzzkP0JkWpr/4NWz84/IdYo1lqASd1Kopz9aT1+iROXaWr43CtbzjXb7/X +Zv7eZZFC8/lS5SROq42pPWl4ekbR0w8XGQElmHYcWS41LBfKeHCUwv83ATF0XQ6I +4t+9YSqZHzj4vvedrvcRInzmwWJaal9s7Z6GuwTGmnMsN3LkhZ+/GD6oW3pU/Pyh +EtWqffjsLhfcdCs3gG8x9BbkcJPH5aPAVkPn4wc8wuXg6xxb9YGsQuY930GWTYRf +schbgjsuqznW4HHakq4WNhs1UdTSTKkRdZz7FUQ= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEDzCCAvegAwIBAgIRAM2zAbhyckaqRim63b+Tib8wDQYJKoZIhvcNAQELBQAw +gZ8xCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE4MDYGA1UEAwwv +QW1hem9uIFJEUyBQcmV2aWV3IHVzLWVhc3QtMiBSb290IENBIFJTQTIwNDggRzEx +EDAOBgNVBAcMB1NlYXR0bGUwIBcNMjEwNTE4MjA0OTQ1WhgPMjA2MTA1MTgyMTQ5 +NDVaMIGfMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNl +cywgSW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExODA2BgNV +BAMML0FtYXpvbiBSRFMgUHJldmlldyB1cy1lYXN0LTIgUm9vdCBDQSBSU0EyMDQ4 +IEcxMRAwDgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB +CgKCAQEA1ybjQMH1MkbvfKsWJaCTXeCSN1SG5UYid+Twe+TjuSqaXWonyp4WRR5z +tlkqq+L2MWUeQQAX3S17ivo/t84mpZ3Rla0cx39SJtP3BiA2BwfUKRjhPwOjmk7j +3zrcJjV5k1vSeLNOfFFSlwyDiVyLAE61lO6onBx+cRjelu0egMGq6WyFVidTdCmT +Q9Zw3W6LTrnPvPmEyjHy2yCHzH3E50KSd/5k4MliV4QTujnxYexI2eR8F8YQC4m3 +DYjXt/MicbqA366SOoJA50JbgpuVv62+LSBu56FpzY12wubmDZsdn4lsfYKiWxUy +uc83a2fRXsJZ1d3whxrl20VFtLFHFQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBRC0ytKmDYbfz0Bz0Psd4lRQV3aNTAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQELBQADggEBAGv8qZu4uaeoF6zsbumauz6ea6tdcWt+hGFuwGrb +tRbI85ucAmVSX06x59DJClsb4MPhL1XmqO3RxVMIVVfRwRHWOsZQPnXm8OYQ2sny +rYuFln1COOz1U/KflZjgJmxbn8x4lYiTPZRLarG0V/OsCmnLkQLPtEl/spMu8Un7 +r3K8SkbWN80gg17Q8EV5mnFwycUx9xsTAaFItuG0en9bGsMgMmy+ZsDmTRbL+lcX +Fq8r4LT4QjrFz0shrzCwuuM4GmcYtBSxlacl+HxYEtAs5k10tmzRf6OYlY33tGf6 +1tkYvKryxDPF/EDgGp/LiBwx6ixYMBfISoYASt4V/ylAlHA= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtTCCAjqgAwIBAgIRAK9BSZU6nIe6jqfODmuVctYwCgYIKoZIzj0EAwMwgZkx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h +em9uIFJEUyBjYS1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTIxMjIxMzA5WhgPMjEyMTA1MjEyMzEzMDlaMIGZMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv +biBSRFMgY2EtY2VudHJhbC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEUkEERcgxneT5H+P+fERcbGmf +bVx+M7rNWtgWUr6w+OBENebQA9ozTkeSg4c4M+qdYSObFqjxITdYxT1z/nHz1gyx +OKAhLjWu+nkbRefqy3RwXaWT680uUaAP6ccnkZOMo0IwQDAPBgNVHRMBAf8EBTAD +AQH/MB0GA1UdDgQWBBSN6fxlg0s5Wny08uRBYZcQ3TUoyzAOBgNVHQ8BAf8EBAMC +AYYwCgYIKoZIzj0EAwMDaQAwZgIxAORaz+MBVoFBTmZ93j2G2vYTwA6T5hWzBWrx +CrI54pKn5g6At56DBrkjrwZF5T1enAIxAJe/LZ9xpDkAdxDgGJFN8gZYLRWc0NRy +Rb4hihy5vj9L+w9uKc9VfEBIFuhT7Z3ljg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIQB/57HSuaqUkLaasdjxUdPjANBgkqhkiG9w0BAQsFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxOTE3NDAzNFoYDzIwNjEwNTE5MTg0MDM0WjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtbkaoVsUS76o +TgLFmcnaB8cswBk1M3Bf4IVRcwWT3a1HeJSnaJUqWHCJ+u3ip/zGVOYl0gN1MgBb +MuQRIJiB95zGVcIa6HZtx00VezDTr3jgGWRHmRjNVCCHGmxOZWvJjsIE1xavT/1j +QYV/ph4EZEIZ/qPq7e3rHohJaHDe23Z7QM9kbyqp2hANG2JtU/iUhCxqgqUHNozV +Zd0l5K6KnltZQoBhhekKgyiHqdTrH8fWajYl5seD71bs0Axowb+Oh0rwmrws3Db2 +Dh+oc2PwREnjHeca9/1C6J2vhY+V0LGaJmnnIuOANrslx2+bgMlyhf9j0Bv8AwSi +dSWsobOhNQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQb7vJT +VciLN72yJGhaRKLn6Krn2TAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +ggEBAAxEj8N9GslReAQnNOBpGl8SLgCMTejQ6AW/bapQvzxrZrfVOZOYwp/5oV0f +9S1jcGysDM+DrmfUJNzWxq2Y586R94WtpH4UpJDGqZp+FuOVJL313te4609kopzO +lDdmd+8z61+0Au93wB1rMiEfnIMkOEyt7D2eTFJfJRKNmnPrd8RjimRDlFgcLWJA +3E8wca67Lz/G0eAeLhRHIXv429y8RRXDtKNNz0wA2RwURWIxyPjn1fHjA9SPDkeW +E1Bq7gZj+tBnrqz+ra3yjZ2blss6Ds3/uRY6NYqseFTZWmQWT7FolZEnT9vMUitW +I0VynUbShVpGf6946e0vgaaKw20= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/jCCAuagAwIBAgIQGyUVTaVjYJvWhroVEiHPpDANBgkqhkiG9w0BAQsFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIHVzLXdlc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTE5MTkwNDA2WhgPMjA2MTA1MTkyMDA0MDZaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgdXMtd2VzdC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBANhyXpJ0t4nigRDZ +EwNtFOem1rM1k8k5XmziHKDvDk831p7QsX9ZOxl/BT59Pu/P+6W6SvasIyKls1sW +FJIjFF+6xRQcpoE5L5evMgN/JXahpKGeQJPOX9UEXVW5B8yi+/dyUitFT7YK5LZA +MqWBN/LtHVPa8UmE88RCDLiKkqiv229tmwZtWT7nlMTTCqiAHMFcryZHx0pf9VPh +x/iPV8p2gBJnuPwcz7z1kRKNmJ8/cWaY+9w4q7AYlAMaq/rzEqDaN2XXevdpsYAK +TMMj2kji4x1oZO50+VPNfBl5ZgJc92qz1ocF95SAwMfOUsP8AIRZkf0CILJYlgzk +/6u6qZECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUm5jfcS9o ++LwL517HpB6hG+PmpBswDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB +AQAcQ6lsqxi63MtpGk9XK8mCxGRLCad51+MF6gcNz6i6PAqhPOoKCoFqdj4cEQTF +F8dCfa3pvfJhxV6RIh+t5FCk/y6bWT8Ls/fYKVo6FhHj57bcemWsw/Z0XnROdVfK +Yqbc7zvjCPmwPHEqYBhjU34NcY4UF9yPmlLOL8uO1JKXa3CAR0htIoW4Pbmo6sA4 +6P0co/clW+3zzsQ92yUCjYmRNeSbdXbPfz3K/RtFfZ8jMtriRGuO7KNxp8MqrUho +HK8O0mlSUxGXBZMNicfo7qY8FD21GIPH9w5fp5oiAl7lqFzt3E3sCLD3IiVJmxbf +fUwpGd1XZBBSdIxysRLM6j48 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrTCCAjOgAwIBAgIQU+PAILXGkpoTcpF200VD/jAKBggqhkjOPQQDAzCBljEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6 +b24gUkRTIGFwLWVhc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTAgFw0yMTA1MjUyMTQ1MTFaGA8yMTIxMDUyNTIyNDUxMVowgZYxCzAJBgNV +BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD +VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE +UyBhcC1lYXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAT3tFKE8Kw1sGQAvNLlLhd8OcGhlc7MiW/s +NXm3pOiCT4vZpawKvHBzD76Kcv+ZZzHRxQEmG1/muDzZGlKR32h8AAj+NNO2Wy3d +CKTtYMiVF6Z2zjtuSkZQdjuQbe4eQ7qjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFAiSQOp16Vv0Ohpvqcbd2j5RmhYNMA4GA1UdDwEB/wQEAwIBhjAKBggq +hkjOPQQDAwNoADBlAjBVsi+5Ape0kOhMt/WFkANkslD4qXA5uqhrfAtH29Xzz2NV +tR7akiA771OaIGB/6xsCMQCZt2egCtbX7J0WkuZ2KivTh66jecJr5DHvAP4X2xtS +F/5pS+AUhcKTEGjI9jDH3ew= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICuDCCAj2gAwIBAgIQT5mGlavQzFHsB7hV6Mmy6TAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyNDIwNTAxNVoYDzIxMjEwNTI0MjE1MDE1WjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEcm4BBBjYK7clwm0HJRWS +flt3iYwoJbIXiXn9c1y3E+Vb7bmuyKhS4eO8mwO4GefUcXObRfoHY2TZLhMJLVBQ +7MN2xDc0RtZNj07BbGD3VAIFRTDX0mH9UNYd0JQM3t/Oo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBRrd5ITedfAwrGo4FA9UaDaGFK3rjAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAPBNqmVv1IIA3EZyQ6XuVf4gj79/DMO8 +bkicNS1EcBpUqbSuU4Zwt2BYc8c/t7KVOQIxAOHoWkoKZPiKyCxfMtJpCZySUG+n +sXgB/LOyWE5BJcXUfm+T1ckeNoWeUUMOLmnJjg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRAJcDeinvdNrDQBeJ8+t38WQwDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNCBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjIwNTI1MTY0OTE2WhgPMjA2MjA1MjUxNzQ5MTZa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTQgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +k8DBNkr9tMoIM0NHoFiO7cQfSX0cOMhEuk/CHt0fFx95IBytx7GHCnNzpM27O5z6 +x6iRhfNnx+B6CrGyCzOjxvPizneY+h+9zfvNz9jj7L1I2uYMuiNyOKR6FkHR46CT +1CiArfVLLPaTqgD/rQjS0GL2sLHS/0dmYipzynnZcs613XT0rAWdYDYgxDq7r/Yi +Xge5AkWQFkMUq3nOYDLCyGGfQqWKkwv6lZUHLCDKf+Y0Uvsrj8YGCI1O8mF0qPCQ +lmlfaDvbuBu1AV+aabmkvyFj3b8KRIlNLEtQ4N8KGYR2Jdb82S4YUGIOAt4wuuFt +1B7AUDLk3V/u+HTWiwfoLQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBSNpcjz6ArWBtAA+Gz6kyyZxrrgdDAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBAGJEd7UgOzHYIcQRSF7nSYyjLROyalaIV9AX4WXW/Cqlul1c +MblP5etDZm7A/thliZIWAuyqv2bNicmS3xKvNy6/QYi1YgxZyy/qwJ3NdFl067W0 +t8nGo29B+EVK94IPjzFHWShuoktIgp+dmpijB7wkTIk8SmIoe9yuY4+hzgqk+bo4 +ms2SOXSN1DoQ75Xv+YmztbnZM8MuWhL1T7hA4AMorzTQLJ9Pof8SpSdMHeDsHp0R +01jogNFkwy25nw7cL62nufSuH2fPYGWXyNDg+y42wKsKWYXLRgUQuDVEJ2OmTFMB +T0Vf7VuNijfIA9hkN2d3K53m/9z5WjGPSdOjGhg= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/jCCAuagAwIBAgIQRiwspKyrO0xoxDgSkqLZczANBgkqhkiG9w0BAQsFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIHVzLXdlc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTI0MjE1OTAwWhgPMjA2MTA1MjQyMjU5MDBaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgdXMtd2VzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL53Jk3GsKiu+4bx +jDfsevWbwPCNJ3H08Zp7GWhvI3Tgi39opfHYv2ku2BKFjK8N2L6RvNPSR8yplv5j +Y0tK0U+XVNl8o0ibhqRDhbTuh6KL8CFINWYzAajuxFS+CF0U6c1Q3tXLBdALxA7l +FlXJ71QrP06W31kRe7kvgrvO7qWU3/OzUf9qYw4LSiR1/VkvvRCTqcVNw09clw/M +Jbw6FSgweN65M9j7zPbjGAXSHkXyxH1Erin2fa+B9PE4ZDgX9cp2C1DHewYJQL/g +SepwwcudVNRN1ibKH7kpMrgPnaNIVNx5sXVsTjk6q2ZqYw3SVHegltJpLy/cZReP +mlivF2kCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUmTcQd6o1 +CuS65MjBrMwQ9JJjmBwwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB +AQAKSDSIzl956wVddPThf2VAzI8syw9ngSwsEHZvxVGHBvu5gg618rDyguVCYX9L +4Kw/xJrk6S3qxOS2ZDyBcOpsrBskgahDFIunzoRP3a18ARQVq55LVgfwSDQiunch +Bd05cnFGLoiLkR5rrkgYaP2ftn3gRBRaf0y0S3JXZ2XB3sMZxGxavYq9mfiEcwB0 +LMTMQ1NYzahIeG6Jm3LqRqR8HkzP/Ztq4dT2AtSLvFebbNMiWqeqT7OcYp94HTYT +zqrtaVdUg9bwyAUCDgy0GV9RHDIdNAOInU/4LEETovrtuBU7Z1q4tcHXvN6Hd1H8 +gMb0mCG5I393qW5hFsA/diFb +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRAIgSQsm7XtddDiXpo3j09qYwDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNyBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjQwOTEyMTU1NDM2WhgPMjEyNDA5MTIxNjU0MzZa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTcgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +jLfyuFmUeGd3WSDotJVQ+XjY20Yt75KWDFjXNLNZ7+/97RshOjZ0M3dZ+CcKmIQz +37vjb80kk0p+jeuaLxprWjc5kLJjaFZNPA8mxM/UmARvMvBRrO4uRRRQvYFyXqi+ +Frsl46t/+nyarL09ICx/1reZIzsOsI9BcDM0CK1hqQSwrIjOK2mXuHVfrufXjLnR +wZA2rOonQJJAXgOo1RvD11xmOUUIglP2ljAZZskxL+zU8d5k9Ed4HkGsOY3ywbP0 +/E+Fd33Gli3EF01wAbIaZL0vuW2rW4oxjh8QW7O7Sfnsr9fdNU2Tye1jSCxle5e3 +2Sfq+0Iw5TiT0KYTmcpcKzvljd1wwHdiNKeo7ZCVIer/lGl62PoAb2NWeLepk0IO +IwTZ+Dq76hs9XZJbYxWhXpVcT31b9e3++jROMPz7Mzi/wMg+RBWXgjDuuj1Z16sF +MFfK6QEmD8SOKL3GAKn7PBQxZea+j6iF7G1nGz1/Wfvzz7I8DocnAmQZabKzEnpR +LTEU2LZ86pkeLkM3uI9jm/VWeV4xLv/dC7trDkTUSHpJ4J5/ItMecdAlhCEJ2qM2 +x46OUbGYsf9gvacLkqQoS/XFL8R4bxR01URlHU+98yfODBCehulmnKOz3dQOth2c +sF9v2spYG2gmY3jg7N8suvPbzYKWmL7pVCQtqVOZPkkCAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUy2Eg468T4F9w7gg9AxeZBj+gjKYwDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCGLMyGrhwhqoDRtJ6gGx1SkJd4 +uxG3R4VFKS23JhDJKoDISjcCrVQu5Z3xSj157HmDnc/TEHgW/t1y472QOagzN2RD +9xgFBGfU1sHxKX79WBSf93L3alM+oE1tS+drDlBPV4gzxvCc+zvUYQKWjz/W6q9f +bdrk16J2/yOyli3XpEqf1o4c9FVnAbi9c3zdugfARskwypo2LHDuo8z+u/Ab7j1y +NZ8HtLg/hwVjfSoPLD8guYSZHXYn6ed7AmOUUJjlauWUfCCvU/F+Dk51JMLlVVK+ +y9ZgHXa8YDsGsCmpdgfC3MLSEVkx87mxj1rkFLI03q9i6L2BOWQtgd6NmvYd7pJx +cqx6bmSh43CscGDEngIB50XWqXd4QlVKmPPgDnd55szfnNQzzG9q8I9KTEv+B/Ck +apl2XxVAEUdb26Wi7RH+9Wms6HQeU4i7cDuWpm+EfZZmdjwvA4bs3Ox07SkenHqu +Ti6RJf1PiHoE9SHiFUiBnd++YsNByjGqn4Vxla1MlVdkaUMlvvc3/9oky4KfcRdQ +AK7L9cQqf7g6G4Ne5PNvosG3KaS009xSN1AAalTqS9eqrDYR2yZSixmUYqP57Jm5 +5ERI+pZi2aKpl0ONC7vKIyH+gxjsRPct4DKoxZnt4/KJYhINOlQz8i/j0jfqftmg +G1bYpbRRbfWoGHjGJA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRAPQAvihfjBg/JDbj6U64K98wDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIwMTYyODQxWhgPMjA2MTA1MjAxNzI4NDFa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +vJ9lgyksCxkBlY40qOzI1TCj/Q0FVGuPL/Z1Mw2YN0l+41BDv0FHApjTUkIKOeIP +nwDwpXTa3NjYbk3cOZ/fpH2rYJ++Fte6PNDGPgKppVCUh6x3jiVZ1L7wOgnTdK1Q +Trw8440IDS5eLykRHvz8OmwvYDl0iIrt832V0QyOlHTGt6ZJ/aTQKl12Fy3QBLv7 +stClPzvHTrgWqVU6uidSYoDtzHbU7Vda7YH0wD9IUoMBf7Tu0rqcE4uH47s2XYkc +SdLEoOg/Ngs7Y9B1y1GCyj3Ux7hnyvCoRTw014QyNB7dTatFMDvYlrRDGG14KeiU +UL7Vo/+EejWI31eXNLw84wIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBQkgTWFsNg6wA3HbbihDQ4vpt1E2zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBAGz1Asiw7hn5WYUj8RpOCzpE0h/oBZcnxP8wulzZ5Xd0YxWO +0jYUcUk3tTQy1QvoY+Q5aCjg6vFv+oFBAxkib/SmZzp4xLisZIGlzpJQuAgRkwWA +6BVMgRS+AaOMQ6wKPgz1x4v6T0cIELZEPq3piGxvvqkcLZKdCaeC3wCS6sxuafzZ +4qA3zMwWuLOzRftgX2hQto7d/2YkRXga7jSvQl3id/EI+xrYoH6zIWgjdU1AUaNq +NGT7DIo47vVMfnd9HFZNhREsd4GJE83I+JhTqIxiKPNxrKgESzyADmNPt0gXDnHo +tbV1pMZz5HpJtjnP/qVZhEK5oB0tqlKPv9yx074= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICuTCCAj6gAwIBAgIRAKp1Rn3aL/g/6oiHVIXtCq8wCgYIKoZIzj0EAwMwgZsx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h +em9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMTA1MjQyMDMyMTdaGA8yMTIxMDUyNDIxMzIxN1owgZsx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h +em9uIFJEUyBhcC1ub3J0aGVhc3QtMyBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABGTYWPILeBJXfcL3Dz4z +EWMUq78xB1HpjBwHoTURYfcMd5r96BTVG6yaUBWnAVCMeeD6yTG9a1eVGNhG14Hk +ZAEjgLiNB7RRbEG5JZ/XV7W/vODh09WCst2y9SLKsdgeAaNCMEAwDwYDVR0TAQH/ +BAUwAwEB/zAdBgNVHQ4EFgQUoE0qZHmDCDB+Bnm8GUa/evpfPwgwDgYDVR0PAQH/ +BAQDAgGGMAoGCCqGSM49BAMDA2kAMGYCMQCnil5MMwhY3qoXv0xvcKZGxGPaBV15 +0CCssCKn0oVtdJQfJQ3Jrf3RSaEyijXIJsoCMQC35iJi4cWoNX3N/qfgnHohW52O +B5dg0DYMqy5cNZ40+UcAanRMyqNQ6P7fy3umGco= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtzCCAj2gAwIBAgIQPXnDTPegvJrI98qz8WxrMjAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIEJldGEgdXMtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxODIxNDAxMloYDzIxMjEwNTE4MjI0MDEyWjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIEJldGEgdXMtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEI0sR7gwutK5AB46hM761 +gcLTGBIYlURSEoM1jcBwy56CL+3CJKZwLLyJ7qoOKfWbu5GsVLUTWS8MV6Nw33cx +2KQD2svb694wi+Px2f4n9+XHkEFQw8BbiodDD7RZA70fo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBTQSioOvnVLEMXwNSDg+zgln/vAkjAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAMwu1hqm5Bc98uE/E0B5iMYbBQ4kpMxO +tP8FTfz5UR37HUn26nXE0puj6S/Ffj4oJgIwXI7s2c26tFQeqzq6u3lrNJHp5jC9 +Uxlo/hEJOLoDj5jnpxo8dMAtCNoQPaHdfL0P +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/jCCA+agAwIBAgIQEM1pS+bWfBJeu/6j1yIIFzANBgkqhkiG9w0BAQwFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIGNhLXdlc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjMwOTE5MjIwMTM5WhgPMjEyMzA5MTkyMzAxMzlaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgY2Etd2VzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK2Pyp8p5z6HnlGB +daOj78gZ3ABufxnBFiu5NdFiGoMrS+eY//xxr2iKbnynJAzjmn5A6VKMNxtbuYIZ +WKAzDb/HrWlIYD2w7ZVBXpylfPhiz3jLNsl03WdPNnEruCcivhY2QMewEVtzjPU0 +ofdbZlO2KpF3biv1gjPuIuE7AUyQAbWnWTlrzETAVWLboJJRRqxASSkFUHNLXod7 +ow02FwlAhcnCp9gSe1SKRDrpvvEvYQBAFB7owfnoQzOGDdd87RGyYfyuW8aFI2Z0 +LHNvsA0dTafO4Rh986c72kDL7ijICQdr5OTgZR2OnuESLk1DSK4xYJ4fA6jb5dJ5 ++xsI6tCPykWCW98aO/pha35OsrVNifL/5cH5pdv/ecgQGdffJB+Vdj6f/ZMwR6s/ +Rm37cQ9l3tU8eu/qpzsFjLq1ZUzDaVDWgMW9t49+q/zjhdmbPOabZDao7nHXrVRw +rwPHWCmEY4OmH6ikEKQW3AChFjOdSg4me/J0Jr5l5jKggLPHWbNLRO8qTTK6N8qk +ui3aJDi+XQfsTPARXIw4UFErArNImTsoZVyqfX7I4shp0qZbEhP6kRAbfPljw5kW +Yat7ZlXqDanjsreqbLTaOU10P0rC0/4Ctv5cLSKCrzRLWtpXxhKa2wJTQ74G6fAZ +1oUA79qg3F8nyM+ZzDsfNI854+PNAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w +HQYDVR0OBBYEFLRWiDabEQZNkzEPUCr1ZVJV6xpwMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQwFAAOCAgEATkVVzkkGBjEtLGDtERi+fSpIV0MxwAsA4PAeBBmb +myxo90jz6kWkKM1Wm4BkZM8/mq5VbxPef1kxHfb5CHksCL6SgG5KujfIvht+KT2a +MRJB+III3CbcTy0HtwCX5AlPIbXWydhQFoJTW/OkpecUWoyFM6SqYeYZx1itJpxl +sXshLjYOvw+QgvxRsDxqUfkcaC/N2yhu/30Zo2P8msJfAFry2UmA/TBrWOQKVQxl +Ee/yWgp4U/bC/GZnjWnWDTwkRFGQtI4wjxbVuX6V4FTLCT7kIoHBhG+zOSduJRn3 +Axej7gkEXEVc/PAnwp/kSJ/b0/JONLWdjGUFkyiMn1yJlhJ2sg39vepBN5r6yVYU +nJWoZAuupRpoIKfmC3/cZanXqYbYl4yxzX/PMB4kAACfdxGxLawjnnBjSzaWokXs +YVh2TjWpUMwLOi0RB2mtPUjHdDLKtjOTZ1zHZnR/wVp9BmVI1BXYnz5PAqU5XqeD +EmanyaAuFCeyol1EtbQhgtysThQ+vwYAXMm2iKzJxq0hik8wyG8X55FhnGEOGV3u +xxq7odd3/8BXkc3dGdBPQtH+k5glaQyPnAsLVAIUvyzTmy58saL+nJnQY4mmRrwV +1jJA7nnkaklI/L5fvfCg0W+TMinCOAGd+GQ4hK2SAsJLtcqiBgPf2wJHO8wiwUh9 +Luw= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjWgAwIBAgIQGKVv+5VuzEZEBzJ+bVfx2zAKBggqhkjOPQQDAzCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGFwLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTE5MTc1MDU5WhgPMjEyMTA1MTkxODUwNTlaMIGXMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS +RFMgYXAtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs +ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMqdLJ0tZF/DGFZTKZDrGRJZID8ivC2I +JRCYTWweZKCKSCAzoiuGGHzJhr5RlLHQf/QgmFcgXsdmO2n3CggzhA4tOD9Ip7Lk +P05eHd2UPInyPCHRgmGjGb0Z+RdQ6zkitKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUC1yhRgVqU5bR8cGzOUCIxRpl4EYwDgYDVR0PAQH/BAQDAgGGMAoG +CCqGSM49BAMDA2cAMGQCMG0c/zLGECRPzGKJvYCkpFTCUvdP4J74YP0v/dPvKojL +t/BrR1Tg4xlfhaib7hPc7wIwFvgqHes20CubQnZmswbTKLUrgSUW4/lcKFpouFd2 +t2/ewfi/0VhkeUW+IiHhOMdU +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRAOXxJuyXVkbfhZCkS/dOpfEwDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI1MjE1OTEwWhgPMjEyMTA1MjUyMjU5MTBa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +xiP4RDYm4tIS12hGgn1csfO8onQDmK5SZDswUpl0HIKXOUVVWkHNlINkVxbdqpqH +FhbyZmNN6F/EWopotMDKe1B+NLrjNQf4zefv2vyKvPHJXhxoKmfyuTd5Wk8k1F7I +lNwLQzznB+ElhrLIDJl9Ro8t31YBBNFRGAGEnxyACFGcdkjlsa52UwfYrwreEg2l +gW5AzqHgjFfj9QRLydeU/n4bHm0F1adMsV7P3rVwilcUlqsENDwXnWyPEyv3sw6F +wNemLEs1129mB77fwvySb+lLNGsnzr8w4wdioZ74co+T9z2ca+eUiP+EQccVw1Is +D4Fh57IjPa6Wuc4mwiUYKkKY63+38aCfEWb0Qoi+zW+mE9nek6MOQ914cN12u5LX +dBoYopphRO5YmubSN4xcBy405nIdSdbrAVWwxXnVVyjqjknmNeqQsPZaxAhdoKhV +AqxNr8AUAdOAO6Sz3MslmcLlDXFihrEEOeUbpg/m1mSUUHGbu966ajTG1FuEHHwS +7WB52yxoJo/tHvt9nAWnh3uH5BHmS8zn6s6CGweWKbX5yICnZ1QFR1e4pogxX39v +XD6YcNOO+Vn+HY4nXmjgSYVC7l+eeP8eduMg1xJujzjrbmrXU+d+cBObgdTOAlpa +JFHaGwYw1osAwPCo9cZ2f04yitBfj9aPFia8ASKldakCAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUqKS+ltlior0SyZKYAkJ/efv55towDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQAdElvp8bW4B+Cv+1WSN87dg6TN +wGyIjJ14/QYURgyrZiYpUmZpj+/pJmprSWXu4KNyqHftmaidu7cdjL5nCAvAfnY5 +/6eDDbX4j8Gt9fb/6H9y0O0dn3mUPSEKG0crR+JRFAtPhn/2FNvst2P82yguWLv0 +pHjHVUVcq+HqDMtUIJsTPYjSh9Iy77Q6TOZKln9dyDOWJpCSkiUWQtMAKbCSlvzd +zTs/ahqpT+zLfGR1SR+T3snZHgQnbnemmz/XtlKl52NxccARwfcEEKaCRQyGq/pR +0PVZasyJS9JY4JfQs4YOdeOt4UMZ8BmW1+BQWGSkkb0QIRl8CszoKofucAlqdPcO +IT/ZaMVhI580LFGWiQIizWFskX6lqbCyHqJB3LDl8gJISB5vNTHOHpvpMOMs5PYt +cRl5Mrksx5MKMqG7y5R734nMlZxQIHjL5FOoOxTBp9KeWIL/Ib89T2QDaLw1SQ+w +ihqWBJ4ZdrIMWYpP3WqM+MXWk7WAem+xsFJdR+MDgOOuobVQTy5dGBlPks/6gpjm +rO9TjfQ36ppJ3b7LdKUPeRfnYmlR5RU4oyYJ//uLbClI443RZAgxaCXX/nyc12lr +eVLUMNF2abLX4/VF63m2/Z9ACgMRfqGshPssn1NN33OonrotQoj4S3N9ZrjvzKt8 +iHcaqd60QKpfiH2A3A== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrTCCAjOgAwIBAgIQOsXM3iPpLzFtjuRCpLsrlDAKBggqhkjOPQQDAzCBljEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6 +b24gUkRTIGFwLWVhc3QtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTAgFw0yNTAyMDEwMDEwMzFaGA8yMTI1MDIwMTAxMTAzMVowgZYxCzAJBgNV +BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD +VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE +UyBhcC1lYXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQ+7GUElCbaFRRjg6gT4QTBuontLCF4sLso +/sHZ60qQI8SVEsDTF7C3zebh+VlNtPhgF1Le61HW86KlDQYf49pVN2guXBrdf3qb +RQCwSHSKs4S2bMyRMZ6xjwoGOrEKFEKjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFKc0lLMy1OaSxQ+rtD7tyY3bFlv5MA4GA1UdDwEB/wQEAwIBhjAKBggq +hkjOPQQDAwNoADBlAjEA5Rhu3YN+PyIHg3NXSw1DbowJIHNZgnieTD4BPkZLy4rs +8le5S3JjQQGyh+bsJf7RAjBPUMBF4CJDLE5nmetgXLlOl3oXwd/gHTls7YDr+R18 +cTBI0+RV4Z6yT5p1OF9AcnA= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICuDCCAj2gAwIBAgIQPaVGRuu86nh/ylZVCLB0MzAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLW5vcnRoZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyNTIyMDMxNloYDzIxMjEwNTI1MjMwMzE2WjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLW5vcnRoZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEexNURoB9KE93MEtEAlJG +obz4LS/pD2hc8Gczix1WhVvpJ8bN5zCDXaKdnDMCebetyRQsmQ2LYlfmCwpZwSDu +0zowB11Pt3I5Avu2EEcuKTlKIDMBeZ1WWuOd3Tf7MEAMo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBSaYbZPBvFLikSAjpa8mRJvyArMxzAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaQAwZgIxAOEJkuh3Zjb7Ih/zuNRd1RBqmIYcnyw0 +nwUZczKXry+9XebYj3VQxSRNadrarPWVqgIxAMg1dyGoDAYjY/L/9YElyMnvHltO +PwpJShmqHvCLc/mXMgjjYb/akK7yGthvW6j/uQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCDCCA/CgAwIBAgIQChu3v5W1Doil3v6pgRIcVzANBgkqhkiG9w0BAQwFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIEJldGEgdXMtZWFzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yMTA1MTgyMTM0MTVaGA8yMTIxMDUxODIyMzQxNVow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBCZXRhIHVzLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC1 +FUGQ5tf3OwpDR6hGBxhUcrkwKZhaXP+1St1lSOQvjG8wXT3RkKzRGMvb7Ee0kzqI +mzKKe4ASIhtV3UUWdlNmP0EA3XKnif6N79MismTeGkDj75Yzp5A6tSvqByCgxIjK +JqpJrch3Dszoyn8+XhwDxMZtkUa5nQVdJgPzJ6ltsQ8E4SWLyLtTu0S63jJDkqYY +S7cQblk7y7fel+Vn+LS5dGTdRRhMvSzEnb6mkVBaVzRyVX90FNUED06e8q+gU8Ob +htvQlf9/kRzHwRAdls2YBhH40ZeyhpUC7vdtPwlmIyvW5CZ/QiG0yglixnL6xahL +pbmTuTSA/Oqz4UGQZv2WzHe1lD2gRHhtFX2poQZeNQX8wO9IcUhrH5XurW/G9Xwl +Sat9CMPERQn4KC3HSkat4ir2xaEUrjfg6c4XsGyh2Pk/LZ0gLKum0dyWYpWP4JmM +RQNjrInXPbMhzQObozCyFT7jYegS/3cppdyy+K1K7434wzQGLU1gYXDKFnXwkX8R +bRKgx2pHNbH5lUddjnNt75+e8m83ygSq/ZNBUz2Ur6W2s0pl6aBjwaDES4VfWYlI +jokcmrGvJNDfQWygb1k00eF2bzNeNCHwgWsuo3HSxVgc/WGsbcGrTlDKfz+g3ich +bXUeUidPhRiv5UQIVCLIHpHuin3bj9lQO/0t6p+tAQIDAQABo0IwQDAPBgNVHRMB +Af8EBTADAQH/MB0GA1UdDgQWBBSFmMBgm5IsRv3hLrvDPIhcPweXYTAOBgNVHQ8B +Af8EBAMCAYYwDQYJKoZIhvcNAQEMBQADggIBAAa2EuozymOsQDJlEi7TqnyA2OhT +GXPfYqCyMJVkfrqNgcnsNpCAiNEiZbb+8sIPXnT8Ay8hrwJYEObJ5b7MHXpLuyft +z0Pu1oFLKnQxKjNxrIsCvaB4CRRdYjm1q7EqGhMGv76se9stOxkOqO9it31w/LoU +ENDk7GLsSqsV1OzYLhaH8t+MaNP6rZTSNuPrHwbV3CtBFl2TAZ7iKgKOhdFz1Hh9 +Pez0lG+oKi4mHZ7ajov6PD0W7njn5KqzCAkJR6OYmlNVPjir+c/vUtEs0j+owsMl +g7KE5g4ZpTRShyh5BjCFRK2tv0tkqafzNtxrKC5XNpEkqqVTCnLcKG+OplIEadtr +C7UWf4HyhCiR+xIyxFyR05p3uY/QQU/5uza7GlK0J+U1sBUytx7BZ+Fo8KQfPPqV +CqDCaYUksoJcnJE/KeoksyqNQys7sDGJhkd0NeUGDrFLKHSLhIwAMbEWnqGxvhli +E7sP2E5rI/I9Y9zTbLIiI8pfeZlFF8DBdoP/Hzg8pqsiE/yiXSFTKByDwKzGwNqz +F0VoFdIZcIbLdDbzlQitgGpJtvEL7HseB0WH7B2PMMD8KPJlYvPveO3/6OLzCsav ++CAkvk47NQViKMsUTKOA0JDCW+u981YRozxa3K081snhSiSe83zIPBz1ikldXxO9 +6YYLNPRrj3mi9T/f +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjSgAwIBAgIRAMkvdFnVDb0mWWFiXqnKH68wCgYIKoZIzj0EAwMwgZYx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h +em9uIFJEUyB1cy13ZXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTE5MTkxMzI0WhgPMjEyMTA1MTkyMDEzMjRaMIGWMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS +RFMgdXMtd2VzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEy86DB+9th/0A5VcWqMSWDxIUblWTt/R0 +ao6Z2l3vf2YDF2wt1A2NIOGpfQ5+WAOJO/IQmnV9LhYo+kacB8sOnXdQa6biZZkR +IyouUfikVQAKWEJnh1Cuo5YMM4E2sUt5o0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G +A1UdDgQWBBQ8u3OnecANmG8OoT7KLWDuFzZwBTAOBgNVHQ8BAf8EBAMCAYYwCgYI +KoZIzj0EAwMDaAAwZQIwQ817qkb7mWJFnieRAN+m9W3E0FLVKaV3zC5aYJUk2fcZ +TaUx3oLp3jPLGvY5+wgeAjEA6wAicAki4ZiDfxvAIuYiIe1OS/7H5RA++R8BH6qG +iRzUBM/FItFpnkus7u/eTkvo +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrzCCAjWgAwIBAgIQS/+Ryfgb/IOVEa1pWoe8oTAKBggqhkjOPQQDAzCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGFwLXNvdXRoLTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjIwNjA2MjE1NDQyWhgPMjEyMjA2MDYyMjU0NDJaMIGXMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS +RFMgYXAtc291dGgtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs +ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDsX6fhdUWBQpYTdseBD/P3s96Dtw2Iw +OrXKNToCnmX5nMkUGdRn9qKNiz1pw3EPzaPxShbYwQ7LYP09ENK/JN4QQjxMihxC +jLFxS85nhBQQQGRCWikDAe38mD8fSvREQKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUIh1xZiseQYFjPYKJmGbruAgRH+AwDgYDVR0PAQH/BAQDAgGGMAoG +CCqGSM49BAMDA2gAMGUCMFudS4zLy+UUGrtgNLtRMcu/DZ9BUzV4NdHxo0bkG44O +thnjl4+wTKI6VbyAbj2rkgIxAOHps8NMITU5DpyiMnKTxV8ubb/WGHrLl0BjB8Lw +ETVJk5DNuZvsIIcm7ykk6iL4Tw== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGBDCCA+ygAwIBAgIQDcEmNIAVrDpUw5cH5ynutDANBgkqhkiG9w0BAQwFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIG1lLWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjIwNTA3MDA0MDIzWhgPMjEyMjA1MDcwMTQwMjNaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgbWUtY2VudHJhbC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKvADk8t +Fl9bFlU5sajLPPDSOUpPAkKs6iPlz+27o1GJC88THcOvf3x0nVAcu9WYe9Qaas+4 +j4a0vv51agqyODRD/SNi2HnqW7DbtLPAm6KBHe4twl28ItB/JD5g7u1oPAHFoXMS +cH1CZEAs5RtlZGzJhcBXLFsHNv/7+SCLyZ7+2XFh9OrtgU4wMzkHoRNndhfwV5bu +17bPTwuH+VxH37zXf1mQ/KjhuJos0C9dL0FpjYBAuyZTAWhZKs8dpSe4DI544z4w +gkwUB4bC2nA1TBzsywEAHyNuZ/xRjNpWvx0ToWAA2iFJqC3VO3iKcnBplMvaUuMt +jwzVSNBnKcoabXCZL2XDLt4YTZR8FSwz05IvsmwcPB7uNTBXq3T9sjejW8QQK3vT +tzyfLq4jKmQE7PoS6cqYm+hEPm2hDaC/WP9bp3FdEJxZlPH26fq1b7BWYWhQ9pBA +Nv9zTnzdR1xohTyOJBUFQ81ybEzabqXqVXUIANqIOaNcTB09/sLJ7+zuMhp3mwBu +LtjfJv8PLuT1r63bU3seROhKA98b5KfzjvbvPSg3vws78JQyoYGbqNyDfyjVjg3U +v//AdVuPie6PNtdrW3upZY4Qti5IjP9e3kimaJ+KAtTgMRG56W0WxD3SP7+YGGbG +KhntDOkKsN39hLpn9UOafTIqFu7kIaueEy/NAgMBAAGjQjBAMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFHAems86dTwdZbLe8AaPy3kfIUVoMA4GA1UdDwEB/wQE +AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAOBHpp0ICx81kmeoBcZTrMdJs2gnhcd85 +FoSCjXx9H5XE5rmN/lQcxxOgj8hr3uPuLdLHu+i6THAyzjrl2NA1FWiqpfeECGmy +0jm7iZsYORgGQYp/VKnDrwnKNSqlZvOuRr0kfUexwFlr34Y4VmupvEOK/RdGsd3S ++3hiemcHse9ST/sJLHx962AWMkN86UHPscJEe4+eT3f2Wyzg6La8ARwdWZSNS+WH +ZfybrncMmuiXuUdHv9XspPsqhKgtHhcYeXOGUtrwQPLe3+VJZ0LVxhlTWr9951GZ +GfmWwTV/9VsyKVaCFIXeQ6L+gjcKyEzYF8wpMtQlSc7FFqwgC4bKxvMBSaRy88Nr +lV2+tJD/fr8zGUeBK44Emon0HKDBWGX+/Hq1ZIv0Da0S+j6LbA4fusWxtGfuGha+ +luhHgVInCpALIOamiBEdGhILkoTtx7JrYppt3/Raqg9gUNCOOYlCvGhqX7DXeEfL +DGabooiY2FNWot6h04JE9nqGj5QqT8D6t/TL1nzxhRPzbcSDIHUd/b5R+a0bAA+7 +YTU6JqzEVCWKEIEynYmqikgLMGB/OzWsgyEL6822QW6hJAQ78XpbNeCzrICF4+GC +7KShLnwuWoWpAb26268lvOEvCTFM47VC6jNQl97md+2SA9Ma81C9wflid2M83Wle +cuLMVcQZceE= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIQAhAteLRCvizAElaWORFU2zANBgkqhkiG9w0BAQsFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIG1lLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMDE3MDkxNloYDzIwNjEwNTIwMTgwOTE2WjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIG1lLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA+qg7JAcOVKjh +N83SACnBFZPyB63EusfDr/0V9ZdL8lKcmZX9sv/CqoBo3N0EvBqHQqUUX6JvFb7F +XrMUZ740kr28gSRALfXTFgNODjXeDsCtEkKRTkac/UM8xXHn+hR7UFRPHS3e0GzI +iLiwQWDkr0Op74W8aM0CfaVKvh2bp4BI1jJbdDnQ9OKXpOxNHGUf0ZGb7TkNPkgI +b2CBAc8J5o3H9lfw4uiyvl6Fz5JoP+A+zPELAioYBXDrbE7wJeqQDJrETWqR9VEK +BXURCkVnHeaJy123MpAX2ozf4pqk0V0LOEOZRS29I+USF5DcWr7QIXR/w2I8ws1Q +7ys+qbE+kQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQFJ16n +1EcCMOIhoZs/F9sR+Jy++zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +ggEBAOc5nXbT3XTDEZsxX2iD15YrQvmL5m13B3ImZWpx/pqmObsgx3/dg75rF2nQ +qS+Vl+f/HLh516pj2BPP/yWCq12TRYigGav8UH0qdT3CAClYy2o+zAzUJHm84oiB +ud+6pFVGkbqpsY+QMpJUbZWu52KViBpJMYsUEy+9cnPSFRVuRAHjYynSiLk2ZEjb +Wkdc4x0nOZR5tP0FgrX0Ve2KcjFwVQJVZLgOUqmFYQ/G0TIIGTNh9tcmR7yp+xJR +A2tbPV2Z6m9Yxx4E8lLEPNuoeouJ/GR4CkMEmF8cLwM310t174o3lKKUXJ4Vs2HO +Wj2uN6R9oI+jGLMSswTzCNV1vgc= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtjCCAj2gAwIBAgIQM+ObZzo0HZj7HpGdeMmx/zAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC01IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTI0MDUxNTIxNTA0NloYDzIxMjQwNTE1MjI1MDQ2WjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC01IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEhSrJY/MXuQyTqK1dnLK6 +uWUx/KxsGCMCBXKthi0spP90CjfOYYxDcGD7zgUtk+LCEK2vneuewAPhlUgqXzaZ +PYDzk2WUznIPiIBvVo32U4vUnV/vSWqzhSKevsOakiPso0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBRw/PJZ4fwnZo25vVSB80KtyKWqmTAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDZwAwZAIwLNcaZNOvCLTumHlJydm+9lB6bcxnaLmb +esoToveXQABKl84kGNI1gaDKOvvLsPbWAjBIqfDMb83RXw7q2C501W5hzsbZ1ZQs +8+tffIuCrMMGWDLqoUksWJHiocLOfe9gwm4= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICuDCCAj6gAwIBAgIRAOocLeZWjYkG/EbHmscuy8gwCgYIKoZIzj0EAwMwgZsx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h +em9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMTA1MjEyMTUwMDFaGA8yMTIxMDUyMTIyNTAwMVowgZsx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE0MDIGA1UEAwwrQW1h +em9uIFJEUyBhcC1zb3V0aGVhc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABCEr3jq1KtRncnZfK5cq +btY0nW6ZG3FMbh7XwBIR6Ca0f8llGZ4vJEC1pXgiM/4Dh045B9ZIzNrR54rYOIfa +2NcYZ7mk06DjIQML64hbAxbQzOAuNzLPx268MrlL2uW2XaNCMEAwDwYDVR0TAQH/ +BAUwAwEB/zAdBgNVHQ4EFgQUln75pChychwN4RfHl+tOinMrfVowDgYDVR0PAQH/ +BAQDAgGGMAoGCCqGSM49BAMDA2gAMGUCMGiyPINRU1mwZ4Crw01vpuPvxZxb2IOr +yX3RNlOIu4We1H+5dQk5tIvH8KGYFbWEpAIxAO9NZ6/j9osMhLgZ0yj0WVjb+uZx +YlZR9fyFisY/jNfX7QhSk+nrc3SFLRUNtpXrng== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEBTCCAu2gAwIBAgIRAKiaRZatN8eiz9p0s0lu0rQwDQYJKoZIhvcNAQELBQAw +gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq +QW1hem9uIFJEUyBjYS1jZW50cmFsLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYD +VQQHDAdTZWF0dGxlMCAXDTIxMDUyMTIyMDIzNVoYDzIwNjEwNTIxMjMwMjM1WjCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGNhLWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV +BAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCygVMf +qB865IR9qYRBRFHn4eAqGJOCFx+UbraQZmjr/mnRqSkY+nhbM7Pn/DWOrRnxoh+w +q5F9ZxdZ5D5T1v6kljVwxyfFgHItyyyIL0YS7e2h7cRRscCM+75kMedAP7icb4YN +LfWBqfKHbHIOqvvQK8T6+Emu/QlG2B5LvuErrop9K0KinhITekpVIO4HCN61cuOe +CADBKF/5uUJHwS9pWw3uUbpGUwsLBuhJzCY/OpJlDqC8Y9aToi2Ivl5u3/Q/sKjr +6AZb9lx4q3J2z7tJDrm5MHYwV74elGSXoeoG8nODUqjgklIWAPrt6lQ3WJpO2kug +8RhCdSbWkcXHfX95AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FOIxhqTPkKVqKBZvMWtKewKWDvDBMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0B +AQsFAAOCAQEAqoItII89lOl4TKvg0I1EinxafZLXIheLcdGCxpjRxlZ9QMQUN3yb +y/8uFKBL0otbQgJEoGhxm4h0tp54g28M6TN1U0332dwkjYxUNwvzrMaV5Na55I2Z +1hq4GB3NMXW+PvdtsgVOZbEN+zOyOZ5MvJHEQVkT3YRnf6avsdntltcRzHJ16pJc +Y8rR7yWwPXh1lPaPkxddrCtwayyGxNbNmRybjR48uHRhwu7v2WuAMdChL8H8bp89 +TQLMrMHgSbZfee9hKhO4Zebelf1/cslRSrhkG0ESq6G5MUINj6lMg2g6F0F7Xz2v +ncD/vuRN5P+vT8th/oZ0Q2Gc68Pun0cn/g== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/zCCAuegAwIBAgIRAJYlnmkGRj4ju/2jBQsnXJYwDQYJKoZIhvcNAQELBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyB1cy1lYXN0LTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMTIzMDQ0NFoYDzIwNjEwNTIyMDAwNDQ0WjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIHVzLWVhc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQC74V3eigv+pCj5 +nqDBqplY0Jp16pTeNB06IKbzb4MOTvNde6QjsZxrE1xUmprT8LxQqN9tI3aDYEYk +b9v4F99WtQVgCv3Y34tYKX9NwWQgwS1vQwnIR8zOFBYqsAsHEkeJuSqAB12AYUSd +Zv2RVFjiFmYJho2X30IrSLQfS/IE3KV7fCyMMm154+/K1Z2IJlcissydEAwgsUHw +edrE6CxJVkkJ3EvIgG4ugK/suxd8eEMztaQYJwSdN8TdfT59LFuSPl7zmF3fIBdJ +//WexcQmGabaJ7Xnx+6o2HTfkP8Zzzzaq8fvjAcvA7gyFH5EP26G2ZqMG+0y4pTx +SPVTrQEXAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFIWWuNEF +sUMOC82XlfJeqazzrkPDMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC +AQEAgClmxcJaQTGpEZmjElL8G2Zc8lGc+ylGjiNlSIw8X25/bcLRptbDA90nuP+q +zXAMhEf0ccbdpwxG/P5a8JipmHgqQLHfpkvaXx+0CuP++3k+chAJ3Gk5XtY587jX ++MJfrPgjFt7vmMaKmynndf+NaIJAYczjhJj6xjPWmGrjM3MlTa9XesmelMwP3jep +bApIWAvCYVjGndbK9byyMq1nyj0TUzB8oJZQooaR3MMjHTmADuVBylWzkRMxbKPl +4Nlsk4Ef1JvIWBCzsMt+X17nuKfEatRfp3c9tbpGlAE/DSP0W2/Lnayxr4RpE9ds +ICF35uSis/7ZlsftODUe8wtpkQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECDCCAvCgAwIBAgIQTcWg4evi5wHEIHLNrHCqQjANBgkqhkiG9w0BAQsFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIGFwLXNvdXRoZWFzdC03IFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yNDA5MTIxNTU0MzFaGA8yMDY0MDkxMjE2NTQzMVow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNyBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCS +X21nYtSipOhpdF6QfLE4BTwbtrXCR3EBhOHB1MfwwjNh25uex3X/gHW/sUTgC/oe +Oboi+3I/HN6a5MneTcVVps8AL8rJGym0ShSIYza/3MyT+PtfqDNmYfmF8VRIhNSR +CoYW93F/BoZF7bFk4ljOrBSrRbfb1qmEtkTPNGBRnJ0jh05Fwq5a5XnkGcOGNDyH +kGt9ZaUm+cJmzAa1omHspCjgg6854CNs4k5ovT2vaZ/0yAogdSpkB9INLM0ZMqJ+ +QoKAyN6hdISjwEEZrl+0OKymc2jR+NpQcd3378bDIfg3iYvuvTp84kKpZ4gRaukm +mSUg/PQqmGdBlAivOiknAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O +BBYEFDsAilCg2DzFiZheGlKVb74AubP2MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG +9w0BAQsFAAOCAQEACUGKd2GVv87xnVnPajqbi7GkMd+XGwyG1P8Nkon9rfUgwgHR +dHDsO6jIKf3ZEzNcMgMyV5sXs2944WRhGkYxQ62wbkEaqtjNExmlmUiS3vvrGOfg +BmRhJvAOM5HbNMqmi5BC4GlhHWQKhRbStwhvbVYnARBVfR/Wz4Qb4fizaXbuNWAo +V0XBQc+67lto2eBQ84KQXTp60FdwSBzltbM7sZmp6dMNgnfPNUrdxurVboF+VsxS +3aUJnmEi6TJAGL2SXLermB6HiTgxtxOJUiefu4Ipv0JEg41OzbKWsJXTaSH0QDb1 +nSeMyoXqF3ixcAhQbw/7NrzMMlf3NmMaVlohVA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjOgAwIBAgIQS7vMpOTVq2Jw457NdZ2ffjAKBggqhkjOPQQDAzCBljEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6 +b24gUkRTIGNhLXdlc3QtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTAgFw0yMzA5MTkyMjExNDNaGA8yMTIzMDkxOTIzMTE0M1owgZYxCzAJBgNV +BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD +VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE +UyBjYS13ZXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAARdgGSs/F2lpWKqS1ZpcmatFED1JurmNbXG +Sqhv1A/geHrKCS15MPwjtnfZiujYKY4fNkCCUseoGDwkC4281nwkokvnfWR1/cXy +LxfACoXNxsI4b+37CezSUBl48/5p1/OjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFFhLokGBuJGwKJhZcYSYKyZIitJtMA4GA1UdDwEB/wQEAwIBhjAKBggq +hkjOPQQDAwNpADBmAjEA8aQQlzJRHbqFsRY4O3u/cN0T8dzjcqnYn4NV1w+jvhzt +QPJLB+ggGyQhoFR6G2UrAjEA0be8OP5MWXD8d01KKbo5Dpy6TwukF5qoJmkFJKS3 +bKfEMvFWxXoV06HNZFWdI80u +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/zCCA+egAwIBAgIRAPvvd+MCcp8E36lHziv0xhMwDQYJKoZIhvcNAQEMBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyB1cy1lYXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMTIzMTEwNloYDzIxMjEwNTIyMDAxMTA2WjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIHVzLWVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDbvwekKIKGcV/s +lDU96a71ZdN2pTYkev1X2e2/ICb765fw/i1jP9MwCzs8/xHBEQBJSxdfO4hPeNx3 +ENi0zbM+TrMKliS1kFVe1trTTEaHYjF8BMK9yTY0VgSpWiGxGwg4tshezIA5lpu8 +sF6XMRxosCEVCxD/44CFqGZTzZaREIvvFPDTXKJ6yOYnuEkhH3OcoOajHN2GEMMQ +ShuyRFDQvYkqOC/Q5icqFbKg7eGwfl4PmimdV7gOVsxSlw2s/0EeeIILXtHx22z3 +8QBhX25Lrq2rMuaGcD3IOMBeBo2d//YuEtd9J+LGXL9AeOXHAwpvInywJKAtXTMq +Wsy3LjhuANFrzMlzjR2YdjkGVzeQVx3dKUzJ2//Qf7IXPSPaEGmcgbxuatxjnvfT +H85oeKr3udKnXm0Kh7CLXeqJB5ITsvxI+Qq2iXtYCc+goHNR01QJwtGDSzuIMj3K +f+YMrqBXZgYBwU2J/kCNTH31nfw96WTbOfNGwLwmVRDgguzFa+QzmQsJW4FTDMwc +7cIjwdElQQVA+Gqa67uWmyDKAnoTkudmgAP+OTBkhnmc6NJuZDcy6f/iWUdl0X0u +/tsfgXXR6ZovnHonM13ANiN7VmEVqFlEMa0VVmc09m+2FYjjlk8F9sC7Rc4wt214 +7u5YvCiCsFZwx44baP5viyRZgkJVpQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBQgCZCsc34nVTRbWsniXBPjnUTQ2DAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQEMBQADggIBAAQas3x1G6OpsIvQeMS9BbiHG3+kU9P/ba6Rrg+E +lUz8TmL04Bcd+I+R0IyMBww4NznT+K60cFdk+1iSmT8Q55bpqRekyhcdWda1Qu0r +JiTi7zz+3w2v66akofOnGevDpo/ilXGvCUJiLOBnHIF0izUqzvfczaMZGJT6xzKq +PcEVRyAN1IHHf5KnGzUlVFv9SGy47xJ9I1vTk24JU0LWkSLzMMoxiUudVmHSqJtN +u0h+n/x3Q6XguZi1/C1KOntH56ewRh8n5AF7c+9LJJSRM9wunb0Dzl7BEy21Xe9q +03xRYjf5wn8eDELB8FZPa1PrNKXIOLYM9egdctbKEcpSsse060+tkyBrl507+SJT +04lvJ4tcKjZFqxn+bUkDQvXYj0D3WK+iJ7a8kZJPRvz8BDHfIqancY8Tgw+69SUn +WqIb+HNZqFuRs16WFSzlMksqzXv6wcDSyI7aZOmCGGEcYW9NHk8EuOnOQ+1UMT9C +Qb1GJcipjRzry3M4KN/t5vN3hIetB+/PhmgTO4gKhBETTEyPC3HC1QbdVfRndB6e +U/NF2U/t8U2GvD26TTFLK4pScW7gyw4FQyXWs8g8FS8f+R2yWajhtS9++VDJQKom +fAUISoCH+PlPRJpu/nHd1Zrddeiiis53rBaLbXu2J1Q3VqjWOmtj0HjxJJxWnYmz +Pqj2 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIRAI/U4z6+GF8/znpHM8Dq8G0wDQYJKoZIhvcNAQEMBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMjA2MDYyMTQ4MThaGA8yMTIyMDYwNjIyNDgxOFowgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBhcC1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAK5WqMvyq888 +3uuOtEj1FcP6iZhqO5kJurdJF59Otp2WCg+zv6I+QwaAspEWHQsKD405XfFsTGKV +SKTCwoMxwBniuChSmyhlagQGKSnRY9+znOWq0v7hgmJRwp6FqclTbubmr+K6lzPy +hs86mEp68O5TcOTYWUlPZDqfKwfNTbtCl5YDRr8Gxb5buHmkp6gUSgDkRsXiZ5VV +b3GBmXRqbnwo5ZRNAzQeM6ylXCn4jKs310lQGUrFbrJqlyxUdfxzqdlaIRn2X+HY +xRSYbHox3LVNPpJxYSBRvpQVFSy9xbX8d1v6OM8+xluB31cbLBtm08KqPFuqx+cO +I2H5F0CYqYzhyOSKJsiOEJT6/uH4ewryskZzncx9ae62SC+bB5n3aJLmOSTkKLFY +YS5IsmDT2m3iMgzsJNUKVoCx2zihAzgBanFFBsG+Xmoq0aKseZUI6vd2qpd5tUST +/wS1sNk0Ph7teWB2ACgbFE6etnJ6stwjHFZOj/iTYhlnR2zDRU8akunFdGb6CB4/ +hMxGJxaqXSJeGtHm7FpadlUTf+2ESbYcVW+ui/F8sdBJseQdKZf3VdZZMgM0bcaX +NE47cauDTy72WdU9YJX/YXKYMLDE0iFHTnGpfVGsuWGPYhlwZ3dFIO07mWnCRM6X +u5JXRB1oy5n5HRluMsmpSN/R92MeBxKFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFNtH0F0xfijSLHEyIkRGD9gW6NazMA4GA1UdDwEB/wQEAwIB +hjANBgkqhkiG9w0BAQwFAAOCAgEACo+5jFeY3ygxoDDzL3xpfe5M0U1WxdKk+az4 +/OfjZvkoma7WfChi3IIMtwtKLYC2/seKWA4KjlB3rlTsCVNPnK6D+gAnybcfTKk/ +IRSPk92zagwQkSUWtAk80HpVfWJzpkSU16ejiajhedzOBRtg6BwsbSqLCDXb8hXr +eXWC1S9ZceGc+LcKRHewGWPu31JDhHE9bNcl9BFSAS0lYVZqxIRWxivZ+45j5uQv +wPrC8ggqsdU3K8quV6dblUQzzA8gKbXJpCzXZihkPrYpQHTH0szvXvgebh+CNUAG +rUxm8+yTS0NFI3U+RLbcLFVzSvjMOnEwCX0SPj5XZRYYXs5ajtQCoZhTUkkwpDV8 +RxXk8qGKiXwUxDO8GRvmvM82IOiXz5w2jy/h7b7soyIgdYiUydMq4Ja4ogB/xPZa +gf4y0o+bremO15HFf1MkaU2UxPK5FFVUds05pKvpSIaQWbF5lw4LHHj4ZtVup7zF +CLjPWs4Hs/oUkxLMqQDw0FBwlqa4uot8ItT8uq5BFpz196ZZ+4WXw5PVzfSxZibI +C/nwcj0AS6qharXOs8yPnPFLPSZ7BbmWzFDgo3tpglRqo3LbSPsiZR+sLeivqydr +0w4RK1btRda5Ws88uZMmW7+2aufposMKcbAdrApDEAVzHijbB/nolS5nsnFPHZoA +KDPtFEk= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtzCCAj2gAwIBAgIQVZ5Y/KqjR4XLou8MCD5pOjAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC00IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIyMDUyNTE2NTgzM1oYDzIxMjIwNTI1MTc1ODMzWjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC00IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEbo473OmpD5vkckdJajXg +brhmNFyoSa0WCY1njuZC2zMFp3zP6rX4I1r3imrYnJd9pFH/aSiV/r6L5ACE5RPx +4qdg5SQ7JJUaZc3DWsTOiOed7BCZSzM+KTYK/2QzDMApo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBTmogc06+1knsej1ltKUOdWFvwgsjAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAIs7TlLMbGTWNXpGiKf9DxaM07d/iDHe +F/Vv/wyWSTGdobxBL6iArQNVXz0Gr4dvPAIwd0rsoa6R0x5mtvhdRPtM37FYrbHJ +pbV+OMusQqcSLseunLBoCHenvJW0QOCQ8EDY +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGBTCCA+2gAwIBAgIRAO9dVdiLTEGO8kjUFExJmgowDQYJKoZIhvcNAQEMBQAw +gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq +QW1hem9uIFJEUyBpbC1jZW50cmFsLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYD +VQQHDAdTZWF0dGxlMCAXDTIyMTIwMjIwMjYwOFoYDzIxMjIxMjAyMjEyNjA4WjCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGlsLWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV +BAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDkVHmJ +bUc8CNDGBcgPmXHSHj5dS1PDnnpk3doCu6pahyYXW8tqAOmOqsDuNz48exY7YVy4 +u9I9OPBeTYB9ZUKwxq+1ZNLsr1cwVz5DdOyDREVFOjlU4rvw0eTgzhP5yw/d+Ai/ ++WmPebZG0irwPKN2f60W/KJ45UNtR+30MT8ugfnPuSHWjjV+dqCOCp/mj8nOCckn +k8GoREwjuTFJMKInpQUC0BaVVX6LiIdgtoLY4wdx00EqNBuROoRTAvrked0jvm7J +UI39CSYxhNZJ9F6LdESZXjI4u2apfNQeSoy6WptxFHr+kh2yss1B2KT6lbwGjwWm +l9HODk9kbBNSy2NeewAms36q+p8wSLPavL28IRfK0UaBAiN1hr2a/2RDGCwOJmw6 +5erRC5IIX5kCStyXPEGhVPp18EvMuBd37eLIxjZBBO8AIDf4Ue8QmxSeZH0cT204 +3/Bd6XR6+Up9iMTxkHr1URcL1AR8Zd62lg/lbEfxePNMK9mQGxKP8eTMG5AjtW9G +TatEoRclgE0wZQalXHmKpBNshyYdGqQZhzL1MxCxWzfHNgZkTKIsdzxrjnP7RiBR +jdRH0YhXn6Y906QfLwMCaufwfQ5J8+nj/tu7nG138kSxsu6VUkhnQJhUcUsxuHD/ +NnBx0KGVEldtZiZf7ccgtRVp1lA0OrVtq3ZLMQIDAQABo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBQ2WC3p8rWeE2N0S4Om01KsNLpk/jAOBgNVHQ8BAf8E +BAMCAYYwDQYJKoZIhvcNAQEMBQADggIBAFFEVDt45Obr6Ax9E4RMgsKjj4QjMFB9 +wHev1jL7hezl/ULrHuWxjIusaIZEIcKfn+v2aWtqOq13P3ht7jV5KsV29CmFuCdQ +q3PWiAXVs+hnMskTOmGMDnptqd6/UuSIha8mlOKKAvnmRQJvfX9hIfb/b/mVyKWD +uvTTmcy3cOTJY5ZIWGyzuvmcqA0YNcb7rkJt/iaLq4RX3/ofq4y4w36hefbcvj++ +pXHOmXk3dAej3y6SMBOUcGMyCJcCluRPNYKDTLn+fitcPxPC3JG7fI5bxQ0D6Hpa +qbyGBQu96sfahQyMc+//H8EYlo4b0vPeS5RFFXJS/VBf0AyNT4vVc7H17Q6KjeNp +wEARqsIa7UalHx9MnxrQ/LSTTxiC8qmDkIFuQtw8iQMN0SoL5S0eCZNRD31awgaY +y1PvY8JMN549ugIUjOXnown/OxharLW1evWUraU5rArq3JfeFpPXl4K/u10T5SCL +iJRoxFilGPMFE3hvnmbi5rEy8wRUn7TpLb4I4s/CB/lT2qZTPqvQHwxKCnMm9BKF +NHb4rLL5dCvUi5NJ6fQ/exOoGdOVSfT7jqFeq2TtNunERSz9vpriweliB6iIe1Al +Thj8aEs1GqA764rLVGA+vUe18NhjJm9EemrdIzjSQFy/NdbN/DMaHqEzJogWloAI +izQWYnCS19TJ +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICvTCCAkOgAwIBAgIQCIY7E/bFvFN2lK9Kckb0dTAKBggqhkjOPQQDAzCBnjEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTcwNQYDVQQDDC5BbWF6 +b24gUkRTIFByZXZpZXcgdXMtZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYD +VQQHDAdTZWF0dGxlMCAXDTIxMDUxODIxMDUxMFoYDzIxMjEwNTE4MjIwNTEwWjCB +njELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTcwNQYDVQQDDC5B +bWF6b24gUkRTIFByZXZpZXcgdXMtZWFzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEMI0hzf1JCEOI +Eue4+DmcNnSs2i2UaJxHMrNGGfU7b42a7vwP53F7045ffHPBGP4jb9q02/bStZzd +VHqfcgqkSRI7beBKjD2mfz82hF/wJSITTgCLs+NRpS6zKMFOFHUNo0IwQDAPBgNV +HRMBAf8EBTADAQH/MB0GA1UdDgQWBBS8uF/6hk5mPLH4qaWv9NVZaMmyTjAOBgNV +HQ8BAf8EBAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIxAO7Pu9wzLyM0X7Q08uLIL+vL +qaxe3UFuzFTWjM16MLJHbzLf1i9IDFKz+Q4hXCSiJwIwClMBsqT49BPUxVsJnjGr +EbyEk6aOOVfY1p2yQL649zh3M4h8okLnwf+bYIb1YpeU +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIQY+JhwFEQTe36qyRlUlF8ozANBgkqhkiG9w0BAQsFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIGFmLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxOTE5MjQxNloYDzIwNjEwNTE5MjAyNDE2WjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIGFmLXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnIye77j6ev40 +8wRPyN2OdKFSUfI9jB20Or2RLO+RDoL43+USXdrze0Wv4HMRLqaen9BcmCfaKMp0 +E4SFo47bXK/O17r6G8eyq1sqnHE+v288mWtYH9lAlSamNFRF6YwA7zncmE/iKL8J +0vePHMHP/B6svw8LULZCk+nZk3tgxQn2+r0B4FOz+RmpkoVddfqqUPMbKUxhM2wf +fO7F6bJaUXDNMBPhCn/3ayKCjYr49ErmnpYV2ZVs1i34S+LFq39J7kyv6zAgbHv9 ++/MtRMoRB1CjpqW0jIOZkHBdYcd1o9p1zFn591Do1wPkmMsWdjIYj+6e7UXcHvOB +2+ScIRAcnwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBQGtq2W +YSyMMxpdQ3IZvcGE+nyZqTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +ggEBAEgoP3ixJsKSD5FN8dQ01RNHERl/IFbA7TRXfwC+L1yFocKnQh4Mp/msPRSV ++OeHIvemPW/wtZDJzLTOFJ6eTolGekHK1GRTQ6ZqsWiU2fmiOP8ks4oSpI+tQ9Lw +VrfZqTiEcS5wEIqyfUAZZfKDo7W1xp+dQWzfczSBuZJZwI5iaha7+ILM0r8Ckden +TVTapc5pLSoO15v0ziRuQ2bT3V3nwu/U0MRK44z+VWOJdSiKxdnOYDs8hFNnKhfe +klbTZF7kW7WbiNYB43OaAQBJ6BALZsIskEaqfeZT8FD71uN928TcEQyBDXdZpRN+ +iGQZDGhht0r0URGMDSs9waJtTfA= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtDCCAjqgAwIBAgIRANtElQUxBpw5GPpq+Tqajs4wCgYIKoZIzj0EAwMwgZkx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h +em9uIFJEUyBteC1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjQwOTMwMTYxNDAwWhgPMjEyNDA5MzAxNzEzNTlaMIGZMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv +biBSRFMgbXgtY2VudHJhbC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEB5xlumRhIemjIWjxWQHqDYG7 +I24vWwUWZjcxcqpDHv6ThnJRsN4TCbWiSfjCOTeW9ZMQiMm6xlxug1nXkDGAyuHL +ze0PqtP0rUPi25wmp3F6L4vq96az41xtGa4wc/xSo0IwQDAPBgNVHRMBAf8EBTAD +AQH/MB0GA1UdDgQWBBSEfpD78dOGnSCKk9cYr2mAc4j9cTAOBgNVHQ8BAf8EBAMC +AYYwCgYIKoZIzj0EAwMDaAAwZQIxANNu+hmW2xOajUvFzdVV4fO0Slj6BRklQfjO +hSF/1NvfZK9pF/QDIyknmK5KS+bY+QIwZCxY71nDC4n4Jw1l0gF+krPg3gNS2KKF +FdrlaY1qdiyvyG6t6tp84q9XmGJ1rOhJ +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECDCCAvCgAwIBAgIQEbIZbn8kcnd/sTnZkdoDkzANBgkqhkiG9w0BAQsFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIGFwLXNvdXRoZWFzdC01IFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yNDA1MTUyMTUwMzdaGA8yMDY0MDUxNTIyNTAzN1ow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNSBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCK +c15oRFUw/MiZQ/qkfOlrcc/PC9TdxGjUqdZyQGqBWrFauIbsK7U0qTeTibt7t7cL +hBWmqb3eefU8e+JZwJ20/cFfWINEjp9xLKV5pzfcRH+BJF3Sa4iLeLSi8CEp5qvf +k70ADs2kye17q29G01NfCG9T2oMEEJQof1nKcfwjayjx7uyBPHtR0a2SC88QlSl9 +9a009S0pUoISV3Zu/U+B6vUlBnGuIt+EsEFH0r19w/VRSO5mg9ylxh0/X5HXeBK5 +UxpNpXI9rPNd/AMTrv7FTyWsqkeSRS2lyT/8wyatApcCdPLyJDx7wZLY8/wARz7p +zi/uEKlhrrSDhDq2I7JFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O +BBYEFAHKs1jyaNzThRo5XHN/dNJDtVNHMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG +9w0BAQsFAAOCAQEAVAdR60a4czTpyu3JHj6oNVQUTt1D1jD/y1fZcc5a77fa2Qc6 +ZZEVBadpXAwkUQDbVRu/h6OrPhWKbQNLlTS1xzGuGeVbXSczvj37UB11WQfFN3M9 +Dpe5LTL0MCPO+elHzXrBhjhi9euCHXHDdvv4AZl7tfWuOrBdeBThXIehKniJmAjt +vq2mIHHThw2Wr+E65WerOVU+jepsG//1EkgrKfcGoS646jQXXKabW3cn0ymEV1/M +DhFbV05Jfvu969qcA3+TH1FaN/lAbwuSLFZ4HLFFjq7RVl/X//lyXl1q/coUdQXC +awfL88gOd/cYz0n5xm/S+gJUtOcz/dR6kV36NQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/jCCA+agAwIBAgIQXY/dmS+72lZPranO2JM9jjANBgkqhkiG9w0BAQwFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIGFwLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTI1MjEzNDUxWhgPMjEyMTA1MjUyMjM0NTFaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgYXAtZWFzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMyW9kBJjD/hx8e8 +b5E1sF42bp8TXsz1htSYE3Tl3T1Aq379DfEhB+xa/ASDZxt7/vwa81BkNo4M6HYq +okYIXeE7cu5SnSgjWXqcERhgPevtAwgmhdE3yREe8oz2DyOi2qKKZqah+1gpPaIQ +fK0uAqoeQlyHosye3KZZKkDHBatjBsQ5kf8lhuf7wVulEZVRHY2bP2X7N98PfbpL +QdH7mWXzDtJJ0LiwFwds47BrkgK1pkHx2p1mTo+HMkfX0P6Fq1atkVC2RHHtbB/X +iYyH7paaHBzviFrhr679zNqwXIOKlbf74w3mS11P76rFn9rS1BAH2Qm6eY5S/Fxe +HEKXm4kjPN63Zy0p3yE5EjPt54yPkvumOnT+RqDGJ2HCI9k8Ehcbve0ogfdRKNqQ +VHWYTy8V33ndQRHZlx/CuU1yN61TH4WSoMly1+q1ihTX9sApmlQ14B2pJi/9DnKW +cwECrPy1jAowC2UJ45RtC8UC05CbP9yrIy/7Noj8gQDiDOepm+6w1g6aNlWoiuQS +kyI6nzz1983GcnOHya73ga7otXo0Qfg9jPghlYiMomrgshlSLDHZG0Ib/3hb8cnR +1OcN9FpzNmVK2Ll1SmTMLrIhuCkyNYX9O/bOknbcf706XeESxGduSkHEjIw/k1+2 +Atteoq5dT6cwjnJ9hyhiueVlVkiDAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w +HQYDVR0OBBYEFLUI+DD7RJs+0nRnjcwIVWzzYSsFMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQwFAAOCAgEAb1mcCHv4qMQetLGTBH9IxsB2YUUhr5dda0D2BcHr +UtDbfd0VQs4tux6h/6iKwHPx0Ew8fuuYj99WknG0ffgJfNc5/fMspxR/pc1jpdyU +5zMQ+B9wi0lOZPO9uH7/pr+d2odcNEy8zAwqdv/ihsTwLmGP54is9fVbsgzNW1cm +HKAVL2t/Ope+3QnRiRilKCN1lzhav4HHdLlN401TcWRWKbEuxF/FgxSO2Hmx86pj +e726lweCTMmnq/cTsPOVY0WMjs0or3eHDVlyLgVeV5ldyN+ptg3Oit60T05SRa58 +AJPTaVKIcGQ/gKkKZConpu7GDofT67P/ox0YNY57LRbhsx9r5UY4ROgz7WMQ1yoS +Y+19xizm+mBm2PyjMUbfwZUyCxsdKMwVdOq5/UmTmdms+TR8+m1uBHPOTQ2vKR0s +Pd/THSzPuu+d3dbzRyDSLQbHFFneG760CUlD/ZmzFlQjJ89/HmAmz8IyENq+Sjhx +Jgzy+FjVZb8aRUoYLlnffpUpej1n87Ynlr1GrvC4GsRpNpOHlwuf6WD4W0qUTsC/ +C9JO+fBzUj/aWlJzNcLEW6pte1SB+EdkR2sZvWH+F88TxemeDrV0jKJw5R89CDf8 +ZQNfkxJYjhns+YeV0moYjqQdc7tq4i04uggEQEtVzEhRLU5PE83nlh/K2NZZm8Kj +dIA= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/zCCAuegAwIBAgIRAPVSMfFitmM5PhmbaOFoGfUwDQYJKoZIhvcNAQELBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyB1cy1lYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyNTIyMzQ1N1oYDzIwNjEwNTI1MjMzNDU3WjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIHVzLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDu9H7TBeGoDzMr +dxN6H8COntJX4IR6dbyhnj5qMD4xl/IWvp50lt0VpmMd+z2PNZzx8RazeGC5IniV +5nrLg0AKWRQ2A/lGGXbUrGXCSe09brMQCxWBSIYe1WZZ1iU1IJ/6Bp4D2YEHpXrW +bPkOq5x3YPcsoitgm1Xh8ygz6vb7PsvJvPbvRMnkDg5IqEThapPjmKb8ZJWyEFEE +QRrkCIRueB1EqQtJw0fvP4PKDlCJAKBEs/y049FoOqYpT3pRy0WKqPhWve+hScMd +6obq8kxTFy1IHACjHc51nrGII5Bt76/MpTWhnJIJrCnq1/Uc3Qs8IVeb+sLaFC8K +DI69Sw6bAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFE7PCopt +lyOgtXX0Y1lObBUxuKaCMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC +AQEAFj+bX8gLmMNefr5jRJfHjrL3iuZCjf7YEZgn89pS4z8408mjj9z6Q5D1H7yS +jNETVV8QaJip1qyhh5gRzRaArgGAYvi2/r0zPsy+Tgf7v1KGL5Lh8NT8iCEGGXwF +g3Ir+Nl3e+9XUp0eyyzBIjHtjLBm6yy8rGk9p6OtFDQnKF5OxwbAgip42CD75r/q +p421maEDDvvRFR4D+99JZxgAYDBGqRRceUoe16qDzbMvlz0A9paCZFclxeftAxv6 +QlR5rItMz/XdzpBJUpYhdzM0gCzAzdQuVO5tjJxmXhkSMcDP+8Q+Uv6FA9k2VpUV +E/O5jgpqUJJ2Hc/5rs9VkAPXeA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrzCCAjWgAwIBAgIQW0yuFCle3uj4vWiGU0SaGzAKBggqhkjOPQQDAzCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGFmLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTE5MTkzNTE2WhgPMjEyMTA1MTkyMDM1MTZaMIGXMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS +RFMgYWYtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs +ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABDPiKNZSaXs3Un/J/v+LTsFDANHpi7en +oL2qh0u0DoqNzEBTbBjvO23bLN3k599zh6CY3HKW0r2k1yaIdbWqt4upMCRCcUFi +I4iedAmubgzh56wJdoMZztjXZRwDthTkJKNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUWbYkcrvVSnAWPR5PJhIzppcAnZIwDgYDVR0PAQH/BAQDAgGGMAoG +CCqGSM49BAMDA2gAMGUCMCESGqpat93CjrSEjE7z+Hbvz0psZTHwqaxuiH64GKUm +mYynIiwpKHyBrzjKBmeDoQIxANGrjIo6/b8Jl6sdIZQI18V0pAyLfLiZjlHVOnhM +MOTVgr82ZuPoEHTX78MxeMnYlw== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRAIbsx8XOl0sgTNiCN4O+18QwDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTI1MjE1NDU4WhgPMjA2MTA1MjUyMjU0NTha +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +tROxwXWCgn5R9gI/2Ivjzaxc0g95ysBjoJsnhPdJEHQb7w3y2kWrVWU3Y9fOitgb +CEsnEC3PrhRnzNVW0fPsK6kbvOeCmjvY30rdbxbc8h+bjXfGmIOgAkmoULEr6Hc7 +G1Q/+tvv4lEwIs7bEaf+abSZxRJbZ0MBxhbHn7UHHDiMZYvzK+SV1MGCxx7JVhrm +xWu3GC1zZCsGDhB9YqY9eR6PmjbqA5wy8vqbC57dZZa1QVtWIQn3JaRXn+faIzHx +nLMN5CEWihsdmHBXhnRboXprE/OS4MFv1UrQF/XM/h5RBeCywpHePpC+Oe1T3LNC +iP8KzRFrjC1MX/WXJnmOVQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBS33XbXAUMs1znyZo4B0+B3D68WFTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBADuadd2EmlpueY2VlrIIPC30QkoA1EOSoCmZgN6124apkoY1 +HiV4r+QNPljN4WP8gmcARnNkS7ZeR4fvWi8xPh5AxQCpiaBMw4gcbTMCuKDV68Pw +P2dZCTMspvR3CDfM35oXCufdtFnxyU6PAyINUqF/wyTHguO3owRFPz64+sk3r2pT +WHmJjG9E7V+KOh0s6REgD17Gqn6C5ijLchSrPUHB0wOIkeLJZndHxN/76h7+zhMt +fFeNxPWHY2MfpcaLjz4UREzZPSB2U9k+y3pW1omCIcl6MQU9itGx/LpQE+H3ZeX2 +M2bdYd5L+ow+bdbGtsVKOuN+R9Dm17YpswF+vyQ= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIRAKlQ+3JX9yHXyjP/Ja6kZhkwDQYJKoZIhvcNAQEMBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBhcC1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMTA1MTkxNzQ1MjBaGA8yMTIxMDUxOTE4NDUyMFowgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBhcC1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAKtahBrpUjQ6 +H2mni05BAKU6Z5USPZeSKmBBJN3YgD17rJ93ikJxSgzJ+CupGy5rvYQ0xznJyiV0 +91QeQN4P+G2MjGQR0RGeUuZcfcZitJro7iAg3UBvw8WIGkcDUg+MGVpRv/B7ry88 +7E4OxKb8CPNoa+a9j6ABjOaaxaI22Bb7j3OJ+JyMICs6CU2bgkJaj3VUV9FCNUOc +h9PxD4jzT9yyGYm/sK9BAT1WOTPG8XQUkpcFqy/IerZDfiQkf1koiSd4s5VhBkUn +aQHOdri/stldT7a+HJFVyz2AXDGPDj+UBMOuLq0K6GAT6ThpkXCb2RIf4mdTy7ox +N5BaJ+ih+Ro3ZwPkok60egnt/RN98jgbm+WstgjJWuLqSNInnMUgkuqjyBWwePqX +Kib+wdpyx/LOzhKPEFpeMIvHQ3A0sjlulIjnh+j+itezD+dp0UNxMERlW4Bn/IlS +sYQVNfYutWkRPRLErXOZXtlxxkI98JWQtLjvGzQr+jywxTiw644FSLWdhKa6DtfU +2JWBHqQPJicMElfZpmfaHZjtXuCZNdZQXWg7onZYohe281ZrdFPOqC4rUq7gYamL +T+ZB+2P+YCPOLJ60bj/XSvcB7mesAdg8P0DNddPhHUFWx2dFqOs1HxIVB4FZVA9U +Ppbv4a484yxjTgG7zFZNqXHKTqze6rBBAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFCEAqjighncv/UnWzBjqu1Ka2Yb4MA4GA1UdDwEB/wQEAwIB +hjANBgkqhkiG9w0BAQwFAAOCAgEAYyvumblckIXlohzi3QiShkZhqFzZultbFIu9 +GhA5CDar1IFMhJ9vJpO9nUK/camKs1VQRs8ZsBbXa0GFUM2p8y2cgUfLwFULAiC/ +sWETyW5lcX/xc4Pyf6dONhqFJt/ovVBxNZtcmMEWv/1D6Tf0nLeEb0P2i/pnSRR4 +Oq99LVFjossXtyvtaq06OSiUUZ1zLPvV6AQINg8dWeBOWRcQYhYcEcC2wQ06KShZ +0ahuu7ar5Gym3vuLK6nH+eQrkUievVomN/LpASrYhK32joQ5ypIJej3sICIgJUEP +UoeswJ+Z16f3ECoL1OSnq4A0riiLj1ZGmVHNhM6m/gotKaHNMxsK9zsbqmuU6IT/ +P6cR0S+vdigQG8ZNFf5vEyVNXhl8KcaJn6lMD/gMB2rY0qpaeTg4gPfU5wcg8S4Y +C9V//tw3hv0f2n+8kGNmqZrylOQDQWSSo8j8M2SRSXiwOHDoTASd1fyBEIqBAwzn +LvXVg8wQd1WlmM3b0Vrsbzltyh6y4SuKSkmgufYYvC07NknQO5vqvZcNoYbLNea3 +76NkFaMHUekSbwVejZgG5HGwbaYBgNdJEdpbWlA3X4yGRVxknQSUyt4dZRnw/HrX +k8x6/wvtw7wht0/DOqz1li7baSsMazqxx+jDdSr1h9xML416Q4loFCLgqQhil8Jq +Em4Hy3A= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEBDCCAuygAwIBAgIQFn6AJ+uxaPDpNVx7174CpjANBgkqhkiG9w0BAQsFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGlsLWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjIxMjAyMjAxNDA4WhgPMjA2MjEyMDIyMTE0MDhaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgaWwtY2VudHJhbC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL2xGTSJ +fXorki/dkkTqdLyv4U1neeFYEyUCPN/HJ7ZloNwhj8RBrHYhZ4qtvUAvN+rs8fUm +L0wmaL69ye61S+CSfDzNwBDGwOzUm/cc1NEJOHCm8XA0unBNBvpJTjsFk2LQ+rz8 +oU0lVV4mjnfGektrTDeADonO1adJvUTYmF6v1wMnykSkp8AnW9EG/6nwcAJuAJ7d +BfaLThm6lfxPdsBNG81DLKi2me2TLQ4yl+vgRKJi2fJWwA77NaDqQuD5upRIcQwt +5noJt2kFFmeiro98ZMMRaDTHAHhJfWkwkw5f2QNIww7T4r85IwbQCgJVRo4m4ZTC +W/1eiEccU2407mECAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU +DNhVvGHzKXv0Yh6asK0apP9jJlUwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB +CwUAA4IBAQCoEVTUY/rF9Zrlpb1Y1hptEguw0i2pCLakcmv3YNj6thsubbGeGx8Z +RjUA/gPKirpoae2HU1y64WEu7akwr6pdTRtXXjbe9NReT6OW/0xAwceSXCOiStqS +cMsWWTGg6BA3uHqad5clqITjDZr1baQ8X8en4SXRBxXyhJXbOkB60HOQeFR9CNeh +pJdrWLeNYXwU0Z59juqdVMGwvDAYdugWUhW2rhafVUXszfRA5c8Izc+E31kq90aY +LmxFXUHUfG0eQOmxmg+Z/nG7yLUdHIFA3id8MRh22hye3KvRdQ7ZVGFni0hG2vQQ +Q01AvD/rhzyjg0czzJKLK9U/RttwdMaV +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGBTCCA+2gAwIBAgIRAJfKe4Zh4aWNt3bv6ZjQwogwDQYJKoZIhvcNAQEMBQAw +gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq +QW1hem9uIFJEUyBjYS1jZW50cmFsLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYD +VQQHDAdTZWF0dGxlMCAXDTIxMDUyMTIyMDg1M1oYDzIxMjEwNTIxMjMwODUzWjCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGNhLWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV +BAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCpgUH6 +Crzd8cOw9prAh2rkQqAOx2vtuI7xX4tmBG4I/um28eBjyVmgwQ1fpq0Zg2nCKS54 +Nn0pCmT7f3h6Bvopxn0J45AzXEtajFqXf92NQ3iPth95GVfAJSD7gk2LWMhpmID9 +JGQyoGuDPg+hYyr292X6d0madzEktVVGO4mKTF989qEg+tY8+oN0U2fRTrqa2tZp +iYsmg350ynNopvntsJAfpCO/srwpsqHHLNFZ9jvhTU8uW90wgaKO9i31j/mHggCE ++CAOaJCM3g+L8DPl/2QKsb6UkBgaaIwKyRgKSj1IlgrK+OdCBCOgM9jjId4Tqo2j +ZIrrPBGl6fbn1+etZX+2/tf6tegz+yV0HHQRAcKCpaH8AXF44bny9andslBoNjGx +H6R/3ib4FhPrnBMElzZ5i4+eM/cuPC2huZMBXb/jKgRC/QN1Wm3/nah5FWq+yn+N +tiAF10Ga0BYzVhHDEwZzN7gn38bcY5yi/CjDUNpY0OzEe2+dpaBKPlXTaFfn9Nba +CBmXPRF0lLGGtPeTAgjcju+NEcVa82Ht1pqxyu2sDtbu3J5bxp4RKtj+ShwN8nut +Tkf5Ea9rSmHEY13fzgibZlQhXaiFSKA2ASUwgJP19Putm0XKlBCNSGCoECemewxL ++7Y8FszS4Uu4eaIwvXVqUEE2yf+4ex0hqQ1acQIDAQABo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBSeUnXIRxNbYsZLtKomIz4Y1nOZEzAOBgNVHQ8BAf8E +BAMCAYYwDQYJKoZIhvcNAQEMBQADggIBAIpRvxVS0dzoosBh/qw65ghPUGSbP2D4 +dm6oYCv5g/zJr4fR7NzEbHOXX5aOQnHbQL4M/7veuOCLNPOW1uXwywMg6gY+dbKe +YtPVA1as8G9sUyadeXyGh2uXGsziMFXyaESwiAXZyiYyKChS3+g26/7jwECFo5vC +XGhWpIO7Hp35Yglp8AnwnEAo/PnuXgyt2nvyTSrxlEYa0jus6GZEZd77pa82U1JH +qFhIgmKPWWdvELA3+ra1nKnvpWM/xX0pnMznMej5B3RT3Y+k61+kWghJE81Ix78T ++tG4jSotgbaL53BhtQWBD1yzbbilqsGE1/DXPXzHVf9yD73fwh2tGWSaVInKYinr +a4tcrB3KDN/PFq0/w5/21lpZjVFyu/eiPj6DmWDuHW73XnRwZpHo/2OFkei5R7cT +rn/YdDD6c1dYtSw5YNnS6hdCQ3sOiB/xbPRN9VWJa6se79uZ9NLz6RMOr73DNnb2 +bhIR9Gf7XAA5lYKqQk+A+stoKbIT0F65RnkxrXi/6vSiXfCh/bV6B41cf7MY/6YW +ehserSdjhQamv35rTFdM+foJwUKz1QN9n9KZhPxeRmwqPitAV79PloksOnX25ElN +SlyxdndIoA1wia1HRd26EFm2pqfZ2vtD2EjU3wD42CXX4H8fKVDna30nNFSYF0yn +jGKc3k6UNxpg +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/jCCA+agAwIBAgIQaRHaEqqacXN20e8zZJtmDDANBgkqhkiG9w0BAQwFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIHVzLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTI1MjIzODM1WhgPMjEyMTA1MjUyMzM4MzVaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgdXMtZWFzdC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAInfBCaHuvj6Rb5c +L5Wmn1jv2PHtEGMHm+7Z8dYosdwouG8VG2A+BCYCZfij9lIGszrTXkY4O7vnXgru +JUNdxh0Q3M83p4X+bg+gODUs3jf+Z3Oeq7nTOk/2UYvQLcxP4FEXILxDInbQFcIx +yen1ESHggGrjEodgn6nbKQNRfIhjhW+TKYaewfsVWH7EF2pfj+cjbJ6njjgZ0/M9 +VZifJFBgat6XUTOf3jwHwkCBh7T6rDpgy19A61laImJCQhdTnHKvzTpxcxiLRh69 +ZObypR7W04OAUmFS88V7IotlPmCL8xf7kwxG+gQfvx31+A9IDMsiTqJ1Cc4fYEKg +bL+Vo+2Ii4W2esCTGVYmHm73drznfeKwL+kmIC/Bq+DrZ+veTqKFYwSkpHRyJCEe +U4Zym6POqQ/4LBSKwDUhWLJIlq99bjKX+hNTJykB+Lbcx0ScOP4IAZQoxmDxGWxN +S+lQj+Cx2pwU3S/7+OxlRndZAX/FKgk7xSMkg88HykUZaZ/ozIiqJqSnGpgXCtED +oQ4OJw5ozAr+/wudOawaMwUWQl5asD8fuy/hl5S1nv9XxIc842QJOtJFxhyeMIXt +LVECVw/dPekhMjS3Zo3wwRgYbnKG7YXXT5WMxJEnHu8+cYpMiRClzq2BEP6/MtI2 +AZQQUFu2yFjRGL2OZA6IYjxnXYiRAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w +HQYDVR0OBBYEFADCcQCPX2HmkqQcmuHfiQ2jjqnrMA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQwFAAOCAgEASXkGQ2eUmudIKPeOIF7RBryCoPmMOsqP0+1qxF8l +pGkwmrgNDGpmd9s0ArfIVBTc1jmpgB3oiRW9c6n2OmwBKL4UPuQ8O3KwSP0iD2sZ +KMXoMEyphCEzW1I2GRvYDugL3Z9MWrnHkoaoH2l8YyTYvszTvdgxBPpM2x4pSkp+ +76d4/eRpJ5mVuQ93nC+YG0wXCxSq63hX4kyZgPxgCdAA+qgFfKIGyNqUIqWgeyTP +n5OgKaboYk2141Rf2hGMD3/hsGm0rrJh7g3C0ZirPws3eeJfulvAOIy2IZzqHUSY +jkFzraz6LEH3IlArT3jUPvWKqvh2lJWnnp56aqxBR7qHH5voD49UpJWY1K0BjGnS +OHcurpp0Yt/BIs4VZeWdCZwI7JaSeDcPMaMDBvND3Ia5Fga0thgYQTG6dE+N5fgF +z+hRaujXO2nb0LmddVyvE8prYlWRMuYFv+Co8hcMdJ0lEZlfVNu0jbm9/GmwAZ+l +9umeYO9yz/uC7edC8XJBglMAKUmVK9wNtOckUWAcCfnPWYLbYa/PqtXBYcxrso5j +iaS/A7iEW51uteHBGrViCy1afGG+hiUWwFlesli+Rq4dNstX3h6h2baWABaAxEVJ +y1RnTQSz6mROT1VmZSgSVO37rgIyY0Hf0872ogcTS+FfvXgBxCxsNWEbiQ/XXva4 +0Ws= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEBDCCAuygAwIBAgIQHK008RFz9XJfPKvg2ONLCjANBgkqhkiG9w0BAQsFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIG14LWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjQwOTMwMTYxMzUwWhgPMjA2NDA5MzAxNzEzNTBaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgbXgtY2VudHJhbC0xIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAIbH+1jM +u1AF7AnEnUU64au5HHnWlQZ5PJCRXmiG4q8NGooNG5A6Qd8lIboWnH6DKAfl3AL+ +ihAsLl9biZ/A/wvoNtW/EizjeYXmiuuCyY/Vo/yv78TW7YNspLYbhc35Lt5V+Hi1 +jnKgNf5IAPG4yIXuIYT+9pD6uCcHuoyzsI8f45oUX3o9PJKaBFWccsgIao1cmZhe +9ButRjAPPtEXyHhLoBgObn5D4G/RWyqXZg0xYTUHHAq6a61UPW8oQ1eqc0aqH+o8 +ZCekjwvgiqTRbUpcWm12KviLgZT1J+9noB7ZX5uY9N5FbOsuG92kkFwgS7cEqEXs +AUCm/EdPZyj6dyUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU +e8h4FODoLdxY0tZkQY5RRjCEQsUwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB +CwUAA4IBAQA7iEZTjpddHEaTQR3jbR98g8zO5aXKO9gfDmeD1Yuov50rV22gpYgU +Pz2TtFT2ftDmtqKZevzXCS0sE2a1SxP8jTUGTnRlGdMmeKGKfERneit26AQ6A3VW +qTB5Sv11oqTs2bgrM0Zd//DRWboqRuctjTl+AWCmFqTLTxYHefaDW6zHkVL/2jcP +V8MniRMzHKtDKURpl1R9lG3/HvC54XP63pJpmMRwE4b6LUuuwr6AIKKRMCLFIrGh +8g2OMeOMnXawUxQubTLqqT8yMrZwBD2W6yJnHtECJsBVj1rd3EZ/Cq64JbolFk7/ +fVTZlb5aHfj8sie/qmmiP+T45facauKY +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtDCCAjqgAwIBAgIRAMyaTlVLN0ndGp4ffwKAfoMwCgYIKoZIzj0EAwMwgZkx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h +em9uIFJEUyBtZS1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjIwNTA3MDA0NDM3WhgPMjEyMjA1MDcwMTQ0MzdaMIGZMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv +biBSRFMgbWUtY2VudHJhbC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE19nCV1nsI6CohSor13+B25cr +zg+IHdi9Y3L7ziQnHWI6yjBazvnKD+oC71aRRlR8b5YXsYGUQxWzPLHN7EGPcSGv +bzA9SLG1KQYCJaQ0m9Eg/iGrwKWOgylbhVw0bCxoo0IwQDAPBgNVHRMBAf8EBTAD +AQH/MB0GA1UdDgQWBBS4KsknsJXM9+QPEkBdZxUPaLr11zAOBgNVHQ8BAf8EBAMC +AYYwCgYIKoZIzj0EAwMDaAAwZQIxAJaRgrYIEfXQMZQQDxMTYS0azpyWSseQooXo +L3nYq4OHGBgYyQ9gVjvRYWU85PXbfgIwdi82DtANQFkCu+j+BU0JBY/uRKPEeYzo +JG92igKIcXPqCoxIJ7lJbbzmuf73gQu5 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIRAJwCobx0Os8F7ihbJngxrR8wDQYJKoZIhvcNAQEMBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBtZS1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMTA1MjAxNzE1MzNaGA8yMTIxMDUyMDE4MTUzM1owgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBtZS1zb3V0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANukKwlm+ZaI +Y5MkWGbEVLApEyLmlrHLEg8PfiiEa9ts7jssQcin3bzEPdTqGr5jo91ONoZ3ccWq +xJgg1W3bLu5CAO2CqIOXTXHRyCO/u0Ch1FGgWB8xETPSi3UHt/Vn1ltdO6DYdbDU +mYgwzYrvLBdRCwxsb9o+BuYQHVFzUYonqk/y9ujz3gotzFq7r55UwDTA1ita3vb4 +eDKjIb4b1M4Wr81M23WHonpje+9qkkrAkdQcHrkgvSCV046xsq/6NctzwCUUNsgF +7Q1a8ut5qJEYpz5ta8vI1rqFqAMBqCbFjRYlmAoTTpFPOmzAVxV+YoqTrW5A16su +/2SXlMYfJ/n/ad/QfBNPPAAQMpyOr2RCL/YiL/PFZPs7NxYjnZHNWxMLSPgFyI+/ +t2klnn5jR76KJK2qimmaXedB90EtFsMRUU1e4NxH9gDuyrihKPJ3aVnZ35mSipvR +/1KB8t8gtFXp/VQaz2sg8+uxPMKB81O37fL4zz6Mg5K8+aq3ejBiyHucpFGnsnVB +3kQWeD36ONkybngmgWoyPceuSWm1hQ0Z7VRAQX+KlxxSaHmSaIk1XxZu9h9riQHx +fMuev6KXjRn/CjCoUTn+7eFrt0dT5GryQEIZP+nA0oq0LKxogigHNZlwAT4flrqb +JUfZJrqgoce5HjZSXl10APbtPjJi0fW9AgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFEfV+LztI29OVDRm0tqClP3NrmEWMA4GA1UdDwEB/wQEAwIB +hjANBgkqhkiG9w0BAQwFAAOCAgEAvSNe+0wuk53KhWlRlRf2x/97H2Q76X3anzF0 +5fOSVm022ldALzXMzqOfdnoKIhAu2oVKiHHKs7mMas+T6TL+Mkphx0CYEVxFE3PG +061q3CqJU+wMm9W9xsB79oB2XG47r1fIEywZZ3GaRsatAbjcNOT8uBaATPQAfJFN +zjFe4XyN+rA4cFrYNvfHTeu5ftrYmvks7JlRaJgEGWsz+qXux7uvaEEVPqEumd2H +uYeaRNOZ2V23R009X5lbgBFx9tq5VDTnKhQiTQ2SeT0rc1W3Dz5ik6SbQQNP3nSR +0Ywy7r/sZ3fcDyfFiqnrVY4Ympfvb4YW2PZ6OsQJbzH6xjdnTG2HtzEU30ngxdp1 +WUEF4zt6rjJCp7QBUqXgdlHvJqYu6949qtWjEPiFN9uSsRV2i1YDjJqN52dLjAPn +AipJKo8x1PHTwUzuITqnB9BdP+5TlTl8biJfkEf/+08eWDTLlDHr2VrZLOLompTh +bS5OrhDmqA2Q+O+EWrTIhMflwwlCpR9QYM/Xwvlbad9H0FUHbJsCVNaru3wGOgWo +tt3dNSK9Lqnv/Ej9K9v6CRr36in4ylJKivhJ5B9E7ABHg7EpBJ1xi7O5eNDkNoJG ++pFyphJq3AkBR2U4ni2tUaTAtSW2tks7IaiDV+UMtqZyGabT5ISQfWLLtLHSWn2F +Tspdjbg= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECTCCAvGgAwIBAgIRAJZFh4s9aZGzKaTMLrSb4acwDQYJKoZIhvcNAQELBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBCZXRhIHVzLWVhc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTE4MjEyODQxWhgPMjA2MTA1MTgyMjI4NDFa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgQmV0YSB1cy1lYXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA +17i2yoU6diep+WrqxIn2CrDEO2NdJVwWTSckx4WMZlLpkQDoymSmkNHjq9ADIApD +A31Cx+843apL7wub8QkFZD0Tk7/ThdHWJOzcAM3ov98QBPQfOC1W5zYIIRP2F+vQ +TRETHQnLcW3rLv0NMk5oQvIKpJoC9ett6aeVrzu+4cU4DZVWYlJUoC/ljWzCluau +8blfW0Vwin6OB7s0HCG5/wijQWJBU5SrP/KAIPeQi1GqG5efbqAXDr/ple0Ipwyo +Xjjl73LenGUgqpANlC9EAT4i7FkJcllLPeK3NcOHjuUG0AccLv1lGsHAxZLgjk/x +z9ZcnVV9UFWZiyJTKxeKPwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1Ud +DgQWBBRWyMuZUo4gxCR3Luf9/bd2AqZ7CjAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZI +hvcNAQELBQADggEBAIqN2DlIKlvDFPO0QUZQVFbsi/tLdYM98/vvzBpttlTGVMyD +gJuQeHVz+MnhGIwoCGOlGU3OOUoIlLAut0+WG74qYczn43oA2gbMd7HoD7oL/IGg +njorBwJVcuuLv2G//SqM3nxGcLRtkRnQ+lvqPxMz9+0fKFUn6QcIDuF0QSfthLs2 +WSiGEPKO9c9RSXdRQ4pXA7c3hXng8P4A2ZmdciPne5Nu4I4qLDGZYRrRLRkNTrOi +TyS6r2HNGUfgF7eOSeKt3NWL+mNChcYj71/Vycf5edeczpUgfnWy9WbPrK1svKyl +aAs2xg+X6O8qB+Mnj2dNBzm+lZIS3sIlm+nO9sg= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjSgAwIBAgIRAPAlEk8VJPmEzVRRaWvTh2AwCgYIKoZIzj0EAwMwgZYx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h +em9uIFJEUyB1cy1lYXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTI1MjI0MTU1WhgPMjEyMTA1MjUyMzQxNTVaMIGWMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS +RFMgdXMtZWFzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEx5xjrup8II4HOJw15NTnS3H5yMrQGlbj +EDA5MMGnE9DmHp5dACIxmPXPMe/99nO7wNdl7G71OYPCgEvWm0FhdvVUeTb3LVnV +BnaXt32Ek7/oxGk1T+Df03C+W0vmuJ+wo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G +A1UdDgQWBBTGXmqBWN/1tkSea4pNw0oHrjk2UDAOBgNVHQ8BAf8EBAMCAYYwCgYI +KoZIzj0EAwMDaAAwZQIxAIqqZWCSrIkZ7zsv/FygtAusW6yvlL935YAWYPVXU30m +jkMFLM+/RJ9GMvnO8jHfCgIwB+whlkcItzE9CRQ6CsMo/d5cEHDUu/QW6jSIh9BR +OGh9pTYPVkUbBiKPA7lVVhre +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/zCCA+egAwIBAgIRAJGY9kZITwfSRaAS/bSBOw8wDQYJKoZIhvcNAQEMBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBzYS1lYXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxOTE4MTEyMFoYDzIxMjEwNTE5MTkxMTIwWjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIHNhLWVhc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDe2vlDp6Eo4WQi +Wi32YJOgdXHhxTFrLjB9SRy22DYoMaWfginJIwJcSR8yse8ZDQuoNhERB9LRggAE +eng23mhrfvtL1yQkMlZfBu4vG1nOb22XiPFzk7X2wqz/WigdYNBCqa1kK3jrLqPx +YUy7jk2oZle4GLVRTNGuMfcid6S2hs3UCdXfkJuM2z2wc3WUlvHoVNk37v2/jzR/ +hSCHZv5YHAtzL/kLb/e64QkqxKll5QmKhyI6d7vt6Lr1C0zb+DmwxUoJhseAS0hI +dRk5DklMb4Aqpj6KN0ss0HAYqYERGRIQM7KKA4+hxDMUkJmt8KqWKZkAlCZgflzl +m8NZ31o2cvBzf6g+VFHx+6iVrSkohVQydkCxx7NJ743iPKsh8BytSM4qU7xx4OnD +H2yNXcypu+D5bZnVZr4Pywq0w0WqbTM2bpYthG9IC4JeVUvZ2mDc01lqOlbMeyfT +og5BRPLDXdZK8lapo7se2teh64cIfXtCmM2lDSwm1wnH2iSK+AWZVIM3iE45WSGc +vZ+drHfVgjJJ5u1YrMCWNL5C2utFbyF9Obw9ZAwm61MSbPQL9JwznhNlCh7F2ANW +ZHWQPNcOAJqzE4uVcJB1ZeVl28ORYY1668lx+s9yYeMXk3QQdj4xmdnvoBFggqRB +ZR6Z0D7ZohADXe024RzEo1TukrQgKQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBT7Vs4Y5uG/9aXnYGNMEs6ycPUT3jAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQEMBQADggIBACN4Htp2PvGcQA0/sAS+qUVWWJoAXSsu8Pgc6Gar +7tKVlNJ/4W/a6pUV2Xo/Tz3msg4yiE8sMESp2k+USosD5n9Alai5s5qpWDQjrqrh +76AGyF2nzve4kIN19GArYhm4Mz/EKEG1QHYvBDGgXi3kNvL/a2Zbybp+3LevG+q7 +xtx4Sz9yIyMzuT/6Y7ijtiMZ9XbuxGf5wab8UtwT3Xq1UradJy0KCkzRJAz/Wy/X +HbTkEvKSaYKExH6sLo0jqdIjV/d2Io31gt4e0Ly1ER2wPyFa+pc/swu7HCzrN+iz +A2ZM4+KX9nBvFyfkHLix4rALg+WTYJa/dIsObXkdZ3z8qPf5A9PXlULiaa1mcP4+ +rokw74IyLEYooQ8iSOjxumXhnkTS69MAdGzXYE5gnHokABtGD+BB5qLhtLt4fqAp +8AyHpQWMyV42M9SJLzQ+iOz7kAgJOBOaVtJI3FV/iAg/eqWVm3yLuUTWDxSHrKuL +N19+pSjF6TNvUSFXwEa2LJkfDqIOCE32iOuy85QY//3NsgrSQF6UkSPa95eJrSGI +3hTRYYh3Up2GhBGl1KUy7/o0k3KRZTk4s38fylY8bZ3TakUOH5iIGoHyFVVcp361 +Pyy25SzFSmNalWoQd9wZVc/Cps2ldxhcttM+WLkFNzprd0VJa8qTz8vYtHP0ouDN +nWS0 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtDCCAjmgAwIBAgIQKKqVZvk6NsLET+uYv5myCzAKBggqhkjOPQQDAzCBmTEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTIwMAYDVQQDDClBbWF6 +b24gUkRTIGlsLWNlbnRyYWwtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwH +U2VhdHRsZTAgFw0yMjEyMDIyMDMyMjBaGA8yMTIyMTIwMjIxMzIyMFowgZkxCzAJ +BgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMw +EQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1hem9u +IFJEUyBpbC1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAASYwfvj8BmvLAP6UkNQ4X4dXBB/ +webBO7swW+8HnFN2DAu+Cn/lpcDpu+dys1JmkVX435lrCH3oZjol0kCDIM1lF4Cv ++78yoY1Jr/YMat22E4iz4AZd9q0NToS7+ZA0r2yjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFO/8Py16qPr7J2GWpvxlTMB+op7XMA4GA1UdDwEB/wQEAwIB +hjAKBggqhkjOPQQDAwNpADBmAjEAwk+rg788+u8JL6sdix7l57WTo8E/M+o3TO5x +uRuPdShrBFm4ArGR2PPs4zCQuKgqAjEAi0TA3PVqAxKpoz+Ps8/054p9WTgDfBFZ +i/lm2yTaPs0xjY6FNWoy7fsVw5oEKxOn +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRAOY7gfcBZgR2tqfBzMbFQCUwDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNCBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjIwNTI1MTY1NDU5WhgPMjEyMjA1MjUxNzU0NTla +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTQgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +lfxER43FuLRdL08bddF0YhbCP+XXKj1A/TFMXmd2My8XDei8rPXFYyyjMig9+xZw +uAsIxLwz8uiA26CKA8bCZKg5VG2kTeOJAfvBJaLv1CZefs3Z4Uf1Sjvm6MF2yqEj +GoORfyfL9HiZFTDuF/hcjWoKYCfMuG6M/wO8IbdICrX3n+BiYQJu/pFO660Mg3h/ +8YBBWYDbHoCiH/vkqqJugQ5BM3OI5nsElW51P1icEEqti4AZ7JmtSv9t7fIFBVyR +oaEyOgpp0sm193F/cDJQdssvjoOnaubsSYm1ep3awZAUyGN/X8MBrPY95d0hLhfH +Ehc5Icyg+hsosBljlAyksmt4hFQ9iBnWIz/ZTfGMck+6p3HVL9RDgvluez+rWv59 +8q7omUGsiPApy5PDdwI/Wt/KtC34/2sjslIJfvgifdAtkRPkhff1WEwER00ADrN9 +eGGInaCpJfb1Rq8cV2n00jxg7DcEd65VR3dmIRb0bL+jWK62ni/WdEyomAOMfmGj +aWf78S/4rasHllWJ+QwnaUYY3u6N8Cgio0/ep4i34FxMXqMV3V0/qXdfhyabi/LM +wCxNo1Dwt+s6OtPJbwO92JL+829QAxydfmaMTeHBsgMPkG7RwAekeuatKGHNsc2Z +x2Q4C2wVvOGAhcHwxfM8JfZs3nDSZJndtVVnFlUY0UECAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUpnG7mWazy6k97/tb5iduRB3RXgQwDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQCDLqq1Wwa9Tkuv7vxBnIeVvvFF +ecTn+P+wJxl9Qa2ortzqTHZsBDyJO62d04AgBwiDXkJ9a+bthgG0H1J7Xee8xqv1 +xyX2yKj24ygHjspLotKP4eDMdDi5TYq+gdkbPmm9Q69B1+W6e049JVGXvWG8/7kU +igxeuCYwtCCdUPRLf6D8y+1XMGgVv3/DSOHWvTg3MJ1wJ3n3+eve3rjGdRYWZeJu +k21HLSZYzVrCtUsh2YAeLnUbSxVuT2Xr4JehYe9zW5HEQ8Je/OUfnCy9vzoN/ITw +osAH+EBJQey7RxEDqMwCaRefH0yeHFcnOll0OXg/urnQmwbEYzQ1uutJaBPsjU0J +Qf06sMxI7GiB5nPE+CnI2sM6A9AW9kvwexGXpNJiLxF8dvPQthpOKGcYu6BFvRmt +6ctfXd9b7JJoVqMWuf5cCY6ihpk1e9JTlAqu4Eb/7JNyGiGCR40iSLvV28un9wiE +plrdYxwcNYq851BEu3r3AyYWw/UW1AKJ5tM+/Gtok+AphMC9ywT66o/Kfu44mOWm +L3nSLSWEcgfUVgrikpnyGbUnGtgCmHiMlUtNVexcE7OtCIZoVAlCGKNu7tyuJf10 +Qlk8oIIzfSIlcbHpOYoN79FkLoDNc2er4Gd+7w1oPQmdAB0jBJnA6t0OUBPKdDdE +Ufff2jrbfbzECn1ELg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCDCCA/CgAwIBAgIQIuO1A8LOnmc7zZ/vMm3TrDANBgkqhkiG9w0BAQwFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIGFwLXNvdXRoZWFzdC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yMTA1MjQyMDQ2MThaGA8yMTIxMDUyNDIxNDYxOFow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDq +qRHKbG8ZK6/GkGm2cenznEF06yHwI1gD5sdsHjTgekDZ2Dl9RwtDmUH2zFuIQwGj +SeC7E2iKwrJRA5wYzL9/Vk8NOILEKQOP8OIKUHbc7q8rEtjs401KcU6pFBBEdO9G +CTiRhogq+8mhC13AM/UriZJbKhwgM2UaDOzAneGMhQAGjH8z83NsNcPxpYVE7tqM +sch5yLtIJLkJRusrmQQTeHUev16YNqyUa+LuFclFL0FzFCimkcxUhXlbfEKXbssS +yPzjiv8wokGyo7+gA0SueceMO2UjfGfute3HlXZDcNvBbkSY+ver41jPydyRD6Qq +oEkh0tyIbPoa3oU74kwipJtz6KBEA3u3iq61OUR0ENhR2NeP7CSKrC24SnQJZ/92 +qxusrbyV/0w+U4m62ug/o4hWNK1lUcc2AqiBOvCSJ7qpdteTFxcEIzDwYfERDx6a +d9+3IPvzMb0ZCxBIIUFMxLTF7yAxI9s6KZBBXSZ6tDcCCYIgEysEPRWMRAcG+ye/ +fZVn9Vnzsj4/2wchC2eQrYpb1QvG4eMXA4M5tFHKi+/8cOPiUzJRgwS222J8YuDj +yEBval874OzXk8H8Mj0JXJ/jH66WuxcBbh5K7Rp5oJn7yju9yqX6qubY8gVeMZ1i +u4oXCopefDqa35JplQNUXbWwSebi0qJ4EK0V8F9Q+QIDAQABo0IwQDAPBgNVHRMB +Af8EBTADAQH/MB0GA1UdDgQWBBT4ysqCxaPe7y+g1KUIAenqu8PAgzAOBgNVHQ8B +Af8EBAMCAYYwDQYJKoZIhvcNAQEMBQADggIBALU8WN35KAjPZEX65tobtCDQFkIO +uJjv0alD7qLB0i9eY80C+kD87HKqdMDJv50a5fZdqOta8BrHutgFtDm+xo5F/1M3 +u5/Vva5lV4xy5DqPajcF4Mw52czYBmeiLRTnyPJsU93EQIC2Bp4Egvb6LI4cMOgm +4pY2hL8DojOC5PXt4B1/7c1DNcJX3CMzHDm4SMwiv2MAxSuC/cbHXcWMk+qXdrVx ++ayLUSh8acaAOy3KLs1MVExJ6j9iFIGsDVsO4vr4ZNsYQiyHjp+L8ops6YVBO5AT +k/pI+axHIVsO5qiD4cFWvkGqmZ0gsVtgGUchZaacboyFsVmo6QPrl28l6LwxkIEv +GGJYvIBW8sfqtGRspjfX5TlNy5IgW/VOwGBdHHsvg/xpRo31PR3HOFw7uPBi7cAr +FiZRLJut7af98EB2UvovZnOh7uIEGPeecQWeOTQfJeWet2FqTzFYd0NUMgqPuJx1 +vLKferP+ajAZLJvVnW1J7Vccx/pm0rMiUJEf0LRb/6XFxx7T2RGjJTi0EzXODTYI +gnLfBBjnolQqw+emf4pJ4pAtly0Gq1KoxTG2QN+wTd4lsCMjnelklFDjejwnl7Uy +vtxzRBAu/hi/AqDkDFf94m6j+edIrjbi9/JDFtQ9EDlyeqPgw0qwi2fwtJyMD45V +fejbXelUSJSzDIdY +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/zCCA+egAwIBAgIRALKta9z9tKpZhJN2aJJe8ekwDQYJKoZIhvcNAQEMBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBhcC1lYXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTI1MDIwMTAwMTAyNloYDzIxMjUwMjAxMDExMDI2WjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGFwLWVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCg3M+MSjABBW+N +IIlr+XMnQoMYy40snt+HM7GFCSTC/NvYxbaMa5DuEy2gPXvtioO0bQrc0tw4VsHv +seudmrO0I2OBzEqvB6y0c7DWcAmDVQyccoth35ueXpxowhl6JqHPyKTB3TXXU30F +zku4HujjEoOzveIa8kfRnwkNySMXlKic6aBPcefoxjECrdlmJJHR6k/kFzAerWht +kPUmgMCjYH4gu+JLf8caEvPwmGrzWcUFEzcaF880O2bP+4dpcklfU6Vu5/8DzJyU +BVpBLaMoD3yvee4No5YSa0FvAGFUy50TWC2ycMDCcn7R0NCHBgQmwlalwEor8rr/ +ntnRhor/do98VZlTJmTS4WmYH3BZHVJar2kBDbb8mtxXrZzaXn92r20QvehD1QEA +8OFllftP7UVcLCWUL0CTsW6jzciTfSgYJNkWN/RCXZFaaGRZp+kHJ9m2eWAJqICH +oug9KFDgBCW68GJiZM+Xs86Vt/sNfu1u9JMAgeDvSeMpaHJRw3EJuS7fP8x7Tj8u +RUY+TbLnsSFYDzPMiup0CZjS1aqQn3jQMp8AWlP59mUbGq5OKNZ/HTDGKNFcvo9X +hkxdE305j+K1lcfNmaS7ACI8PyLgkIS8KAEK+H5ib4Z/+lF5Z8hvNxK//DmlXlWb +YfmQVckZfM4R8ny8DiQQRfAZ1LszwQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBT5hL3+jgVmIfysNjG07vfdRLyP0zAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQEMBQADggIBAHjQevQPydKkUu2mT2wmwi9ukD07gt6r1vdTHqjs +qbfqnH/BMGkaLsu5ECgcTyesueVVYQxDsRSPQr/EQh/knx5qAbJtV0IwiwXHFcat +JZ4lCh8Acuh1Lk2GbDzkJjkNh4QuriN5RCF6a8wqcjceuulKAo/oLxfI563M7bBQ +qs+NV5wqyeHsjVhK8xdgnGqxAyDQVOwVtaiZYmdGF0GwRAibYNs7JsPa1ZdDnPhI +rpAzOSE5W1gHSLC/NcQe2pHmgjNcr8KfxjVC6WgZ1IqiVNxGVjNBooT0lk4oi1w/ +TrWjTC3EhiwoU6ta/o2qBYQ+YVl9uleeIAhfqV+r4xgKfWWVvldA/VAyZBZzUwOF +JuD0TeiEjF6jllV49PxkI+P9oxa+JzUErrD0oQVEljkCCY7liGc2hWVUCWi7m+9D +BNunnlSwW9YOfnj1YX4tMD/62DJKH49wNh+sQb4PR9LKk5xwJQXBcPxMqgm+9BzY +Jb63ZG3l9Y4sQSnDUPCc64I7S7rhxpuaSypS6IB343F6UQTKTaiKLFkuhs3p6kd3 +rOzKVzieh3ejrpolg/8KZXBSahp2PBkFtFBIA7r5iy19LT7qhmK1KrZUuC/8CPrC +HtnCzGNHi9Xgho/LIvFkGtDYyKEQlj/mNoWOjqqsphEYZOsG1qyIhY+9HG3XTLQE +7BP7 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRAN7Y9G9i4I+ZaslPobE7VL4wDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1ub3J0aGVhc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjEwNTIwMTYzMzIzWhgPMjEyMTA1MjAxNzMzMjNa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtbm9ydGhlYXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +4BEPCiIfiK66Q/qa8k+eqf1Q3qsa6Xuu/fPkpuStXVBShhtXd3eqrM0iT4Xxs420 +Va0vSB3oZ7l86P9zYfa60n6PzRxdYFckYX330aI7L/oFIdaodB/C9szvROI0oLG+ +6RwmIF2zcprH0cTby8MiM7G3v9ykpq27g4WhDC1if2j8giOQL3oHpUaByekZNIHF +dIllsI3RkXmR3xmmxoOxJM1B9MZi7e1CvuVtTGOnSGpNCQiqofehTGwxCN2wFSK8 +xysaWlw48G0VzZs7cbxoXMH9QbMpb4tpk0d+T8JfAPu6uWO9UwCLWWydf0CkmA/+ +D50/xd1t33X9P4FEaPSg5lYbHXzSLWn7oLbrN2UqMLaQrkoEBg/VGvzmfN0mbflw ++T87bJ/VEOVNlG+gepyCTf89qIQVWOjuYMox4sK0PjzZGsYEuYiq1+OUT3vk/e5K +ag1fCcq2Isy4/iwB2xcXrsQ6ljwdk1fc+EmOnjGKrhuOHJY3S+RFv4ToQBsVyYhC +XGaC3EkqIX0xaCpDimxYhFjWhpDXAjG/zJ+hRLDAMCMhl/LPGRk/D1kzSbPmdjpl +lEMK5695PeBvEBTQdBQdOiYgOU3vWU6tzwwHfiM2/wgvess/q0FDAHfJhppbgbb9 +3vgsIUcsvoC5o29JvMsUxsDRvsAfEmMSDGkJoA/X6GECAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUgEWm1mZCbGD6ytbwk2UU1aLaOUUwDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQBb4+ABTGBGwxK1U/q4g8JDqTQM +1Wh8Oz8yAk4XtPJMAmCctxbd81cRnSnePWw/hxViLVtkZ/GsemvXfqAQyOn1coN7 +QeYSw+ZOlu0j2jEJVynmgsR7nIRqE7QkCyZAU+d2FTJUfmee+IiBiGyFGgxz9n7A +JhBZ/eahBbiuoOik/APW2JWLh0xp0W0GznfJ8lAlaQTyDa8iDXmVtbJg9P9qzkvl +FgPXQttzEOyooF8Pb2LCZO4kUz+1sbU7tHdr2YE+SXxt6D3SBv+Yf0FlvyWLiqVk +GDEOlPPTDSjAWgKnqST8UJ0RDcZK/v1ixs7ayqQJU0GUQm1I7LGTErWXHMnCuHKe +UKYuiSZwmTcJ06NgdhcCnGZgPq13ryMDqxPeltQc3n5eO7f1cL9ERYLDLOzm6A9P +oQ3MfcVOsbHgGHZWaPSeNrQRN9xefqBXH0ZPasgcH9WJdsLlEjVUXoultaHOKx3b +UCCb+d3EfqF6pRT488ippOL6bk7zNubwhRa/+y4wjZtwe3kAX78ACJVcjPobH9jZ +ErySads5zdQeaoee5wRKdp3TOfvuCe4bwLRdhOLCHWzEcXzY3g/6+ppLvNom8o+h +Bh5X26G6KSfr9tqhQ3O9IcbARjnuPbvtJnoPY0gz3EHHGPhy0RNW8i2gl3nUp0ah +PtjwbKW0hYAhIttT0Q== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtzCCAj2gAwIBAgIQQRBQTs6Y3H1DDbpHGta3lzAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC0zIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDYxMTAwMTI0M1oYDzIxMjEwNjExMDExMjQzWjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC0zIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEs0942Xj4m/gKA+WA6F5h +AHYuek9eGpzTRoLJddM4rEV1T3eSueytMVKOSlS3Ub9IhyQrH2D8EHsLYk9ktnGR +pATk0kCYTqFbB7onNo070lmMJmGT/Q7NgwC8cySChFxbo0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBQ20iKBKiNkcbIZRu0y1uoF1yJTEzAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIwYv0wTSrpQTaPaarfLN8Xcqrqu3hzl07n +FrESIoRw6Cx77ZscFi2/MV6AFyjCV/TlAjEAhpwJ3tpzPXpThRML8DMJYZ3YgMh3 +CMuLqhPpla3cL0PhybrD27hJWl29C4el6aMO +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrDCCAjOgAwIBAgIQGcztRyV40pyMKbNeSN+vXTAKBggqhkjOPQQDAzCBljEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6 +b24gUkRTIHVzLWVhc3QtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTAgFw0yMTA1MjEyMzE1NTZaGA8yMTIxMDUyMjAwMTU1NlowgZYxCzAJBgNV +BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD +VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE +UyB1cy1lYXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfDcv+GGRESD9wT+I5YIPRsD3L+/jsiIis +Tr7t9RSbFl+gYpO7ZbDXvNbV5UGOC5lMJo/SnqFRTC6vL06NF7qOHfig3XO8QnQz +6T5uhhrhnX2RSY3/10d2kTyHq3ZZg3+jQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFLDyD3PRyNXpvKHPYYxjHXWOgfPnMA4GA1UdDwEB/wQEAwIBhjAKBggq +hkjOPQQDAwNnADBkAjB20HQp6YL7CqYD82KaLGzgw305aUKw2aMrdkBR29J183jY +6Ocj9+Wcif9xnRMS+7oCMAvrt03rbh4SU9BohpRUcQ2Pjkh7RoY0jDR4Xq4qzjNr +5UFr3BXpFvACxXF51BksGQ== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjWgAwIBAgIQeKbS5zvtqDvRtwr5H48cAjAKBggqhkjOPQQDAzCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIG1lLXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTIwMTcxOTU1WhgPMjEyMTA1MjAxODE5NTVaMIGXMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS +RFMgbWUtc291dGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs +ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABEKjgUaAPmUlRMEQdBC7BScAGosJ1zRV +LDd38qTBjzgmwBfQJ5ZfGIvyEK5unB09MB4e/3qqK5I/L6Qn5Px/n5g4dq0c7MQZ +u7G9GBYm90U3WRJBf7lQrPStXaRnS4A/O6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUNKcAbGEIn03/vkwd8g6jNyiRdD4wDgYDVR0PAQH/BAQDAgGGMAoG +CCqGSM49BAMDA2cAMGQCMHIeTrjenCSYuGC6txuBt/0ZwnM/ciO9kHGWVCoK8QLs +jGghb5/YSFGZbmQ6qpGlSAIwVOQgdFfTpEfe5i+Vs9frLJ4QKAfc27cTNYzRIM0I +E+AJgK4C4+DiyyMzOpiCfmvq +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCDCCA/CgAwIBAgIQSFkEUzu9FYgC5dW+5lnTgjANBgkqhkiG9w0BAQwFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIGFwLXNvdXRoZWFzdC0zIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yMTA2MTEwMDA4MzZaGA8yMTIxMDYxMTAxMDgzNlow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtMyBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQDx +my5Qmd8zdwaI/KOKV9Xar9oNbhJP5ED0JCiigkuvCkg5qM36klszE8JhsUj40xpp +vQw9wkYW4y+C8twBpzKGBvakqMnoaVUV7lOCKx0RofrnNwkZCboTBB4X/GCZ3fIl +YTybS7Ehi1UuiaZspIT5A2jidoA8HiBPk+mTg1UUkoWS9h+MEAPa8L4DY6fGf4pO +J1Gk2cdePuNzzIrpm2yPto+I8MRROwZ3ha7ooyymOXKtz2c7jEHHJ314boCXAv9G +cdo27WiebewZkHHH7Zx9iTIVuuk2abyVSzvLVeGv7Nuy4lmSqa5clWYqWsGXxvZ2 +0fZC5Gd+BDUMW1eSpW7QDTk3top6x/coNoWuLSfXiC5ZrJkIKimSp9iguULgpK7G +abMMN4PR+O+vhcB8E879hcwmS2yd3IwcPTl3QXxufqeSV58/h2ibkqb/W4Bvggf6 +5JMHQPlPHOqMCVFIHP1IffIo+Of7clb30g9FD2j3F4qgV3OLwEDNg/zuO1DiAvH1 +L+OnmGHkfbtYz+AVApkAZrxMWwoYrwpauyBusvSzwRE24vLTd2i80ZDH422QBLXG +rN7Zas8rwIiBKacJLYtBYETw8mfsNt8gb72aIQX6cZOsphqp6hUtKaiMTVgGazl7 +tBXqbB+sIv3S9X6bM4cZJKkMJOXbnyCCLZFYv8TurwIDAQABo0IwQDAPBgNVHRMB +Af8EBTADAQH/MB0GA1UdDgQWBBTOVtaS1b/lz6yJDvNk65vEastbQTAOBgNVHQ8B +Af8EBAMCAYYwDQYJKoZIhvcNAQEMBQADggIBABEONg+TmMZM/PrYGNAfB4S41zp1 +3CVjslZswh/pC4kgXSf8cPJiUOzMwUevuFQj7tCqxQtJEygJM2IFg4ViInIah2kh +xlRakEGGw2dEVlxZAmmLWxlL1s1lN1565t5kgVwM0GVfwYM2xEvUaby6KDVJIkD3 +aM6sFDBshvVA70qOggM6kU6mwTbivOROzfoIQDnVaT+LQjHqY/T+ok6IN0YXXCWl +Favai8RDjzLDFwXSRvgIK+1c49vlFFY4W9Efp7Z9tPSZU1TvWUcKdAtV8P2fPHAS +vAZ+g9JuNfeawhEibjXkwg6Z/yFUueQCQOs9TRXYogzp5CMMkfdNJF8byKYqHscs +UosIcETnHwqwban99u35sWcoDZPr6aBIrz7LGKTJrL8Nis8qHqnqQBXu/fsQEN8u +zJ2LBi8sievnzd0qI0kaWmg8GzZmYH1JCt1GXSqOFkI8FMy2bahP7TUQR1LBUKQ3 +hrOSqldkhN+cSAOnvbQcFzLr+iEYEk34+NhcMIFVE+51KJ1n6+zISOinr6mI3ckX +6p2tmiCD4Shk2Xx/VTY/KGvQWKFcQApWezBSvDNlGe0yV71LtLf3dr1pr4ofo7cE +rYucCJ40bfxEU/fmzYdBF32xP7AOD9U0FbOR3Mcthc6Z6w20WFC+zru8FGY08gPf +WT1QcNdw7ntUJP/w +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrzCCAjWgAwIBAgIQARky6+5PNFRkFVOp3Ob1CTAKBggqhkjOPQQDAzCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGV1LXNvdXRoLTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjIwNTIzMTg0MTI4WhgPMjEyMjA1MjMxOTQxMjdaMIGXMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS +RFMgZXUtc291dGgtMiBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs +ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABNVGL5oF7cfIBxKyWd2PVK/S5yQfaJY3 +QFHWvEdt6951n9JhiiPrHzfVHsxZp1CBjILRMzjgRbYWmc8qRoLkgGE7htGdwudJ +Fa/WuKzO574Prv4iZXUnVGTboC7JdvKbh6NCMEAwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUgDeIIEKynwUbNXApdIPnmRWieZwwDgYDVR0PAQH/BAQDAgGGMAoG +CCqGSM49BAMDA2gAMGUCMEOOJfucrST+FxuqJkMZyCM3gWGZaB+/w6+XUAJC6hFM +uSTY0F44/bERkA4XhH+YGAIxAIpJQBakCA1/mXjsTnQ+0El9ty+LODp8ibkn031c +8DKDS7pR9UK7ZYdR6zFg3ZCjQw== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjOgAwIBAgIQJvkWUcYLbnxtuwnyjMmntDAKBggqhkjOPQQDAzCBljEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMS8wLQYDVQQDDCZBbWF6 +b24gUkRTIGV1LXdlc3QtMyBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTAgFw0yMTA1MjUyMjI2MTJaGA8yMTIxMDUyNTIzMjYxMlowgZYxCzAJBgNV +BAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMwEQYD +VQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1hem9uIFJE +UyBldS13ZXN0LTMgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0bGUw +djAQBgcqhkjOPQIBBgUrgQQAIgNiAARENn8uHCyjn1dFax4OeXxvbV861qsXFD9G +DshumTmFzWWHN/69WN/AOsxy9XN5S7Cgad4gQgeYYYgZ5taw+tFo/jQvCLY//uR5 +uihcLuLJ78opvRPvD9kbWZ6oXfBtFkWjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYD +VR0OBBYEFKiK3LpoF+gDnqPldGSwChBPCYciMA4GA1UdDwEB/wQEAwIBhjAKBggq +hkjOPQQDAwNpADBmAjEA+7qfvRlnvF1Aosyp9HzxxCbN7VKu+QXXPhLEBWa5oeWW +UOcifunf/IVLC4/FGCsLAjEAte1AYp+iJyOHDB8UYkhBE/1sxnFaTiEPbvQBU0wZ +SuwWVLhu2wWDuSW+K7tTuL8p +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/zCCAuegAwIBAgIRAKeDpqX5WFCGNo94M4v69sUwDQYJKoZIhvcNAQELBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBldS13ZXN0LTMgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyNTIyMTgzM1oYDzIwNjEwNTI1MjMxODMzWjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGV1LXdlc3QtMyBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCcKOTEMTfzvs4H +WtJR8gI7GXN6xesulWtZPv21oT+fLGwJ+9Bv8ADCGDDrDxfeH/HxJmzG9hgVAzVn +4g97Bn7q07tGZM5pVi96/aNp11velZT7spOJKfJDZTlGns6DPdHmx48whpdO+dOb +6+eR0VwCIv+Vl1fWXgoACXYCoKjhxJs+R+fwY//0JJ1YG8yjZ+ghLCJmvlkOJmE1 +TCPUyIENaEONd6T+FHGLVYRRxC2cPO65Jc4yQjsXvvQypoGgx7FwD5voNJnFMdyY +754JGPOOe/SZdepN7Tz7UEq8kn7NQSbhmCsgA/Hkjkchz96qN/YJ+H/okiQUTNB0 +eG9ogiVFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFFjayw9Y +MjbxfF14XAhMM2VPl0PfMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC +AQEAAtmx6d9+9CWlMoU0JCirtp4dSS41bBfb9Oor6GQ8WIr2LdfZLL6uES/ubJPE +1Sh5Vu/Zon5/MbqLMVrfniv3UpQIof37jKXsjZJFE1JVD/qQfRzG8AlBkYgHNEiS +VtD4lFxERmaCkY1tjKB4Dbd5hfhdrDy29618ZjbSP7NwAfnwb96jobCmMKgxVGiH +UqsLSiEBZ33b2hI7PJ6iTJnYBWGuiDnsWzKRmheA4nxwbmcQSfjbrNwa93w3caL2 +v/4u54Kcasvcu3yFsUwJygt8z43jsGAemNZsS7GWESxVVlW93MJRn6M+MMakkl9L +tWaXdHZ+KUV7LhfYLb0ajvb40w== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEBDCCAuygAwIBAgIQJ5oxPEjefCsaESSwrxk68DANBgkqhkiG9w0BAQsFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGV1LWNlbnRyYWwtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjIwNjA2MjExNzA1WhgPMjA2MjA2MDYyMjE3MDVaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgZXUtY2VudHJhbC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALTQt5eX +g+VP3BjO9VBkWJhE0GfLrU/QIk32I6WvrnejayTrlup9H1z4QWlXF7GNJrqScRMY +KhJHlcP05aPsx1lYco6pdFOf42ybXyWHHJdShj4A5glU81GTT+VrXGzHSarLmtua +eozkQgPpDsSlPt0RefyTyel7r3Cq+5K/4vyjCTcIqbfgaGwTU36ffjM1LaPCuE4O +nINMeD6YuImt2hU/mFl20FZ+IZQUIFZZU7pxGLqTRz/PWcH8tDDxnkYg7tNuXOeN +JbTpXrw7St50/E9ZQ0llGS+MxJD8jGRAa/oL4G/cwnV8P2OEPVVkgN9xDDQeieo0 +3xkzolkDkmeKOnUCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQU +bwu8635iQGQMRanekesORM8Hkm4wDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEB +CwUAA4IBAQAgN6LE9mUgjsj6xGCX1afYE69fnmCjjb0rC6eEe1mb/QZNcyw4XBIW +6+zTXo4mjZ4ffoxb//R0/+vdTE7IvaLgfAZgFsLKJCtYDDstXZj8ujQnGR9Pig3R +W+LpNacvOOSJSawNQq0Xrlcu55AU4buyD5VjcICnfF1dqBMnGTnh27m/scd/ZMx/ +kapHZ/fMoK2mAgSX/NvUKF3UkhT85vSSM2BTtET33DzCPDQTZQYxFBa4rFRmFi4c +BLlmIReiCGyh3eJhuUUuYAbK6wLaRyPsyEcIOLMQmZe1+gAFm1+1/q5Ke9ugBmjf +PbTWjsi/lfZ5CdVAhc5lmZj/l5aKqwaS +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjSgAwIBAgIRAKKPTYKln9L4NTx9dpZGUjowCgYIKoZIzj0EAwMwgZYx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h +em9uIFJEUyBldS13ZXN0LTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTIxMjI1NTIxWhgPMjEyMTA1MjEyMzU1MjFaMIGWMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS +RFMgZXUtd2VzdC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAE/owTReDvaRqdmbtTzXbyRmEpKCETNj6O +hZMKH0F8oU9Tmn8RU7kQQj6xUKEyjLPrFBN7c+26TvrVO1KmJAvbc8bVliiJZMbc +C0yV5PtJTalvlMZA1NnciZuhxaxrzlK1o0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G +A1UdDgQWBBT4i5HaoHtrs7Mi8auLhMbKM1XevDAOBgNVHQ8BAf8EBAMCAYYwCgYI +KoZIzj0EAwMDaAAwZQIxAK9A+8/lFdX4XJKgfP+ZLy5ySXC2E0Spoy12Gv2GdUEZ +p1G7c1KbWVlyb1d6subzkQIwKyH0Naf/3usWfftkmq8SzagicKz5cGcEUaULq4tO +GzA/AMpr63IDBAqkZbMDTCmH +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrzCCAjWgAwIBAgIQTgIvwTDuNWQo0Oe1sOPQEzAKBggqhkjOPQQDAzCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGV1LW5vcnRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTI0MjEwNjM4WhgPMjEyMTA1MjQyMjA2MzhaMIGXMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpvbiBS +RFMgZXUtbm9ydGgtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwHU2VhdHRs +ZTB2MBAGByqGSM49AgEGBSuBBAAiA2IABJuzXLU8q6WwSKXBvx8BbdIi3mPhb7Xo +rNJBfuMW1XRj5BcKH1ZoGaDGw+BIIwyBJg8qNmCK8kqIb4cH8/Hbo3Y+xBJyoXq/ +cuk8aPrxiNoRsKWwiDHCsVxaK9L7GhHHAqNCMEAwDwYDVR0TAQH/BAUwAwEB/zAd +BgNVHQ4EFgQUYgcsdU4fm5xtuqLNppkfTHM2QMYwDgYDVR0PAQH/BAQDAgGGMAoG +CCqGSM49BAMDA2gAMGUCMQDz/Rm89+QJOWJecYAmYcBWCcETASyoK1kbr4vw7Hsg +7Ew3LpLeq4IRmTyuiTMl0gMCMAa0QSjfAnxBKGhAnYxcNJSntUyyMpaXzur43ec0 +3D8npJghwC4DuICtKEkQiI5cSg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIRAORIGqQXLTcbbYT2upIsSnQwDQYJKoZIhvcNAQEMBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBldS1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMjA1MjMxODM0MjJaGA8yMTIyMDUyMzE5MzQyMlowgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBldS1zb3V0aC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAPKukwsW2s/h +1k+Hf65pOP0knVBnOnMQyT1mopp2XHGdXznj9xS49S30jYoUnWccyXgD983A1bzu +w4fuJRHg4MFdz/NWTgXvy+zy0Roe83OPIJjUmXnnzwUHQcBa9vl6XUO65iQ3pbSi +fQfNDFXD8cvuXbkezeADoy+iFAlzhXTzV9MD44GTuo9Z3qAXNGHQCrgRSCL7uRYt +t1nfwboCbsVRnElopn2cTigyVXE62HzBUmAw1GTbAZeFAqCn5giBWYAfHwTUldRL +6eEa6atfsS2oPNus4ZENa1iQxXq7ft+pMdNt0qKXTCZiiCZjmLkY0V9kWwHTRRF8 +r+75oSL//3di43QnuSCgjwMRIeWNtMud5jf3eQzSBci+9njb6DrrSUbx7blP0srg +94/C/fYOp/0/EHH34w99Th14VVuGWgDgKahT9/COychLOubXUT6vD1As47S9KxTv +yYleVKwJnF9cVjepODN72fNlEf74BwzgSIhUmhksmZSeJBabrjSUj3pdyo/iRZN/ +CiYz9YPQ29eXHPQjBZVIUqWbOVfdwsx0/Xu5T1e7yyXByQ3/oDulahtcoKPAFQ3J +ee6NJK655MdS7pM9hJnU2Rzu3qZ/GkM6YK7xTlMXVouPUZov/VbiaCKbqYDs8Dg+ +UKdeNXAT6+BMleGQzly1X7vjhgeA8ugVAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFJdaPwpCf78UolFTEn6GO85/QwUIMA4GA1UdDwEB/wQEAwIB +hjANBgkqhkiG9w0BAQwFAAOCAgEAWkxHIT3mers5YnZRSVjmpxCLivGj1jMB9VYC +iKqTAeIvD0940L0YaZgivQll5pue8UUcQ6M2uCdVVAsNJdmQ5XHIYiGOknYPtxzO +aO+bnZp7VIZw/vJ49hvH6RreA2bbxYMZO/ossYdcWsWbOKHFrRmAw0AhtK/my51g +obV7eQg+WmlE5Iqc75ycUsoZdc3NimkjBi7LQoNP1HMvlLHlF71UZhQDdq+/WdV7 +0zmg+epkki1LjgMmuPyb+xWuYkFKT1/faX+Xs62hIm5BY+aI4if4RuQ+J//0pOSs +UajrjTo+jLGB8A96jAe8HaFQenbwMjlaHRDAF0wvbkYrMr5a6EbneAB37V05QD0Y +Rh4L4RrSs9DX2hbSmS6iLDuPEjanHKzglF5ePEvnItbRvGGkynqDVlwF+Bqfnw8l +0i8Hr1f1/LP1c075UjkvsHlUnGgPbLqA0rDdcxF8Fdlv1BunUjX0pVlz10Ha5M6P +AdyWUOneOfaA5G7jjv7i9qg3r99JNs1/Lmyg/tV++gnWTAsSPFSSEte81kmPhlK3 +2UtAO47nOdTtk+q4VIRAwY1MaOR7wTFZPfer1mWs4RhKNu/odp8urEY87iIzbMWT +QYO/4I6BGj9rEWNGncvR5XTowwIthMCj2KWKM3Z/JxvjVFylSf+s+FFfO1bNIm6h +u3UBpZI= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtDCCAjmgAwIBAgIQenQbcP/Zbj9JxvZ+jXbRnTAKBggqhkjOPQQDAzCBmTEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTIwMAYDVQQDDClBbWF6 +b24gUkRTIGV1LWNlbnRyYWwtMSBSb290IENBIEVDQzM4NCBHMTEQMA4GA1UEBwwH +U2VhdHRsZTAgFw0yMTA1MjEyMjMzMjRaGA8yMTIxMDUyMTIzMzMyNFowgZkxCzAJ +BgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMuMRMw +EQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1hem9u +IFJEUyBldS1jZW50cmFsLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAATlBHiEM9LoEb1Hdnd5j2VpCDOU +5nGuFoBD8ROUCkFLFh5mHrHfPXwBc63heW9WrP3qnDEm+UZEUvW7ROvtWCTPZdLz +Z4XaqgAlSqeE2VfUyZOZzBSgUUJk7OlznXfkCMOjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFDT/ThjQZl42Nv/4Z/7JYaPNMly2MA4GA1UdDwEB/wQEAwIB +hjAKBggqhkjOPQQDAwNpADBmAjEAnZWmSgpEbmq+oiCa13l5aGmxSlfp9h12Orvw +Dq/W5cENJz891QD0ufOsic5oGq1JAjEAp5kSJj0MxJBTHQze1Aa9gG4sjHBxXn98 +4MP1VGsQuhfndNHQb4V0Au7OWnOeiobq +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/zCCAuegAwIBAgIRAMgnyikWz46xY6yRgiYwZ3swDQYJKoZIhvcNAQELBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBldS13ZXN0LTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMDE2NDkxMloYDzIwNjEwNTIwMTc0OTEyWjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGV1LXdlc3QtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCi8JYOc9cYSgZH +gYPxLk6Xcc7HqzamvsnjYU98Dcb98y6iDqS46Ra2Ne02MITtU5MDL+qjxb8WGDZV +RUA9ZS69tkTO3gldW8QdiSh3J6hVNJQW81F0M7ZWgV0gB3n76WCmfT4IWos0AXHM +5v7M/M4tqVmCPViQnZb2kdVlM3/Xc9GInfSMCgNfwHPTXl+PXX+xCdNBePaP/A5C +5S0oK3HiXaKGQAy3K7VnaQaYdiv32XUatlM4K2WS4AMKt+2cw3hTCjlmqKRHvYFQ +veWCXAuc+U5PQDJ9SuxB1buFJZhT4VP3JagOuZbh5NWpIbOTxlAJOb5pGEDuJTKi +1gQQQVEFAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFNXm+N87 +OFxK9Af/bjSxDCiulGUzMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsFAAOC +AQEAkqIbkgZ45spvrgRQ6n9VKzDLvNg+WciLtmVrqyohwwJbj4pYvWwnKQCkVc7c +hUOSBmlSBa5REAPbH5o8bdt00FPRrD6BdXLXhaECKgjsHe1WW08nsequRKD8xVmc +8bEX6sw/utBeBV3mB+3Zv7ejYAbDFM4vnRsWtO+XqgReOgrl+cwdA6SNQT9oW3e5 +rSQ+VaXgJtl9NhkiIysq9BeYigxqS/A13pHQp0COMwS8nz+kBPHhJTsajHCDc8F4 +HfLi6cgs9G0gaRhT8FCH66OdGSqn196sE7Y3bPFFFs/3U+vxvmQgoZC6jegQXAg5 +Prxd+VNXtNI/azitTysQPumH7A== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEBTCCAu2gAwIBAgIRAO8bekN7rUReuNPG8pSTKtEwDQYJKoZIhvcNAQELBQAw +gZoxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEzMDEGA1UEAwwq +QW1hem9uIFJEUyBldS1jZW50cmFsLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYD +VQQHDAdTZWF0dGxlMCAXDTIxMDUyMTIyMjM0N1oYDzIwNjEwNTIxMjMyMzQ3WjCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGV1LWNlbnRyYWwtMSBSb290IENBIFJTQTIwNDggRzExEDAOBgNV +BAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCTTYds +Tray+Q9VA5j5jTh5TunHKFQzn68ZbOzdqaoi/Rq4ohfC0xdLrxCpfqn2TGDHN6Zi +2qGK1tWJZEd1H0trhzd9d1CtGK+3cjabUmz/TjSW/qBar7e9MA67/iJ74Gc+Ww43 +A0xPNIWcL4aLrHaLm7sHgAO2UCKsrBUpxErOAACERScVYwPAfu79xeFcX7DmcX+e +lIqY16pQAvK2RIzrekSYfLFxwFq2hnlgKHaVgZ3keKP+nmXcXmRSHQYUUr72oYNZ +HcNYl2+gxCc9ccPEHM7xncVEKmb5cWEWvVoaysgQ+osi5f5aQdzgC2X2g2daKbyA +XL/z5FM9GHpS5BJjAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYE +FBDAiJ7Py9/A9etNa/ebOnx5l5MGMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0B +AQsFAAOCAQEALMh/+81fFPdJV/RrJUeoUvFCGMp8iaANu97NpeJyKitNOv7RoeVP +WjivS0KcCqZaDBs+p6IZ0sLI5ZH098LDzzytcfZg0PsGqUAb8a0MiU/LfgDCI9Ee +jsOiwaFB8k0tfUJK32NPcIoQYApTMT2e26lPzYORSkfuntme2PTHUnuC7ikiQrZk +P+SZjWgRuMcp09JfRXyAYWIuix4Gy0eZ4rpRuaTK6mjAb1/LYoNK/iZ/gTeIqrNt +l70OWRsWW8jEmSyNTIubGK/gGGyfuZGSyqoRX6OKHESkP6SSulbIZHyJ5VZkgtXo +2XvyRyJ7w5pFyoofrL3Wv0UF8yt/GDszmg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/zCCA+egAwIBAgIRAMDk/F+rrhdn42SfE+ghPC8wDQYJKoZIhvcNAQEMBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBldS13ZXN0LTIgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMTIyNTEyMloYDzIxMjEwNTIxMjM1MTIyWjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGV1LXdlc3QtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQC2twMALVg9vRVu +VNqsr6N8thmp3Dy8jEGTsm3GCQ+C5P2YcGlD/T/5icfWW84uF7Sx3ezcGlvsqFMf +Ukj9sQyqtz7qfFFugyy7pa/eH9f48kWFHLbQYm9GEgbYBIrWMp1cy3vyxuMCwQN4 +DCncqU+yNpy0CprQJEha3PzY+3yJOjDQtc3zr99lyECCFJTDUucxHzyQvX89eL74 +uh8la0lKH3v9wPpnEoftbrwmm5jHNFdzj7uXUHUJ41N7af7z7QUfghIRhlBDiKtx +5lYZemPCXajTc3ryDKUZC/b+B6ViXZmAeMdmQoPE0jwyEp/uaUcdp+FlUQwCfsBk +ayPFEApTWgPiku2isjdeTVmEgL8bJTDUZ6FYFR7ZHcYAsDzcwHgIu3GGEMVRS3Uf +ILmioiyly9vcK4Sa01ondARmsi/I0s7pWpKflaekyv5boJKD/xqwz9lGejmJHelf +8Od2TyqJScMpB7Q8c2ROxBwqwB72jMCEvYigB+Wnbb8RipliqNflIGx938FRCzKL +UQUBmNAznR/yRRL0wHf9UAE/8v9a09uZABeiznzOFAl/frHpgdAbC00LkFlnwwgX +g8YfEFlkp4fLx5B7LtoO6uVNFVimLxtwirpyKoj3G4M/kvSTux8bTw0heBCmWmKR +57MS6k7ODzbv+Kpeht2hqVZCNFMxoQIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBRuMnDhJjoj7DcKALj+HbxEqj3r6jAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQEMBQADggIBALSnXfx72C3ldhBP5kY4Mo2DDaGQ8FGpTOOiD95d +0rf7I9LrsBGVqu/Nir+kqqP80PB70+Jy9fHFFigXwcPBX3MpKGxK8Cel7kVf8t1B +4YD6A6bqlzP+OUL0uGWfZpdpDxwMDI2Flt4NEldHgXWPjvN1VblEKs0+kPnKowyg +jhRMgBbD/y+8yg0fIcjXUDTAw/+INcp21gWaMukKQr/8HswqC1yoqW9in2ijQkpK +2RB9vcQ0/gXR0oJUbZQx0jn0OH8Agt7yfMAnJAdnHO4M3gjvlJLzIC5/4aGrRXZl +JoZKfJ2fZRnrFMi0nhAYDeInoS+Rwx+QzaBk6fX5VPyCj8foZ0nmqvuYoydzD8W5 +mMlycgxFqS+DUmO+liWllQC4/MnVBlHGB1Cu3wTj5kgOvNs/k+FW3GXGzD3+rpv0 +QTLuwSbMr+MbEThxrSZRSXTCQzKfehyC+WZejgLb+8ylLJUA10e62o7H9PvCrwj+ +ZDVmN7qj6amzvndCP98sZfX7CFZPLfcBd4wVIjHsFjSNEwWHOiFyLPPG7cdolGKA +lOFvonvo4A1uRc13/zFeP0Xi5n5OZ2go8aOOeGYdI2vB2sgH9R2IASH/jHmr0gvY +0dfBCcfXNgrS0toq0LX/y+5KkKOxh52vEYsJLdhqrveuZhQnsFEm/mFwjRXkyO7c +2jpC +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGADCCA+igAwIBAgIQYe0HgSuFFP9ivYM2vONTrTANBgkqhkiG9w0BAQwFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxOTE4MzMyMVoYDzIxMjEwNTE5MTkzMzIxWjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAuO7QPKfPMTo2 +POQWvzDLwi5f++X98hGjORI1zkN9kotCYH5pAzSBwBPoMNaIfedgmsIxGHj2fq5G +4oXagNhNuGP79Zl6uKW5H7S74W7aWM8C0s8zuxMOI4GZy5h2IfQk3m/3AzZEX5w8 +UtNPkzo2feDVOkerHT+j+vjXgAxZ4wHnuMDcRT+K4r9EXlAH6X9b/RO0JlfEwmNz +xlqqGxocq9qRC66N6W0HF2fNEAKP84n8H80xcZBOBthQORRi8HSmKcPdmrvwCuPz +M+L+j18q6RAVaA0ABbD0jMWcTf0UvjUfBStn5mvu/wGlLjmmRkZsppUTRukfwqXK +yltUsTq0tOIgCIpne5zA4v+MebbR5JBnsvd4gdh5BI01QH470yB7BkUefZ9bobOm +OseAAVXcYFJKe4DAA6uLDrqOfFSxV+CzVvEp3IhLRaik4G5MwI/h2c/jEYDqkg2J +HMflxc2gcSMdk7E5ByLz5f6QrFfSDFk02ZJTs4ssbbUEYohht9znPMQEaWVqATWE +3n0VspqZyoBNkH/agE5GiGZ/k/QyeqzMNj+c9kr43Upu8DpLrz8v2uAp5xNj3YVg +ihaeD6GW8+PQoEjZ3mrCmH7uGLmHxh7Am59LfEyNrDn+8Rq95WvkmbyHSVxZnBmo +h/6O3Jk+0/QhIXZ2hryMflPcYWeRGH0CAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB +/zAdBgNVHQ4EFgQU2eFK7+R3x/me8roIBNxBrplkM6EwDgYDVR0PAQH/BAQDAgGG +MA0GCSqGSIb3DQEBDAUAA4ICAQB5gWFe5s7ObQFj1fTO9L6gYgtFhnwdmxU0q8Ke +HWCrdFmyXdC39qdAFOwM5/7fa9zKmiMrZvy9HNvCXEp4Z7z9mHhBmuqPZQx0qPgU +uLdP8wGRuWryzp3g2oqkX9t31Z0JnkbIdp7kfRT6ME4I4VQsaY5Y3mh+hIHOUvcy +p+98i3UuEIcwJnVAV9wTTzrWusZl9iaQ1nSYbmkX9bBssJ2GmtW+T+VS/1hJ/Q4f +AlE3dOQkLFoPPb3YRWBHr2n1LPIqMVwDNAuWavRA2dSfaLl+kzbn/dua7HTQU5D4 +b2Fu2vLhGirwRJe+V7zdef+tI7sngXqjgObyOeG5O2BY3s+um6D4fS0Th3QchMO7 +0+GwcIgSgcjIjlrt6/xJwJLE8cRkUUieYKq1C4McpZWTF30WnzOPUzRzLHkcNzNA +0A7sKMK6QoYWo5Rmo8zewUxUqzc9oQSrYADP7PEwGncLtFe+dlRFx+PA1a+lcIgo +1ZGfXigYtQ3VKkcknyYlJ+hN4eCMBHtD81xDy9iP2MLE41JhLnoB2rVEtewO5diF +7o95Mwl84VMkLhhHPeGKSKzEbBtYYBifHNct+Bst8dru8UumTltgfX6urH3DN+/8 +JF+5h3U8oR2LL5y76cyeb+GWDXXy9zoQe2QvTyTy88LwZq1JzujYi2k8QiLLhFIf +FEv9Bg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICsDCCAjagAwIBAgIRAMgApnfGYPpK/fD0dbN2U4YwCgYIKoZIzj0EAwMwgZcx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwnQW1h +em9uIFJEUyBldS1zb3V0aC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMCAXDTIxMDUxOTE4MzgxMVoYDzIxMjEwNTE5MTkzODExWjCBlzELMAkG +A1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4xEzAR +BgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6b24g +UkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1NlYXR0 +bGUwdjAQBgcqhkjOPQIBBgUrgQQAIgNiAAQfEWl6d4qSuIoECdZPp+39LaKsfsX7 +THs3/RrtT0+h/jl3bjZ7Qc68k16x+HGcHbaayHfqD0LPdzH/kKtNSfQKqemdxDQh +Z4pwkixJu8T1VpXZ5zzCvBXCl75UqgEFS92jQjBAMA8GA1UdEwEB/wQFMAMBAf8w +HQYDVR0OBBYEFFPrSNtWS5JU+Tvi6ABV231XbjbEMA4GA1UdDwEB/wQEAwIBhjAK +BggqhkjOPQQDAwNoADBlAjEA+a7hF1IrNkBd2N/l7IQYAQw8chnRZDzh4wiGsZsC +6A83maaKFWUKIb3qZYXFSi02AjAbp3wxH3myAmF8WekDHhKcC2zDvyOiKLkg9Y6v +ZVmyMR043dscQbcsVoacOYv198c= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtDCCAjqgAwIBAgIRAPhVkIsQ51JFhD2kjFK5uAkwCgYIKoZIzj0EAwMwgZkx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEyMDAGA1UEAwwpQW1h +em9uIFJEUyBldS1jZW50cmFsLTIgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjIwNjA2MjEyOTE3WhgPMjEyMjA2MDYyMjI5MTdaMIGZMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMjAwBgNVBAMMKUFtYXpv +biBSRFMgZXUtY2VudHJhbC0yIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEA5xnIEBtG5b2nmbj49UEwQza +yX0844fXjccYzZ8xCDUe9dS2XOUi0aZlGblgSe/3lwjg8fMcKXLObGGQfgIx1+5h +AIBjORis/dlyN5q/yH4U5sjS8tcR0GDGVHrsRUZCo0IwQDAPBgNVHRMBAf8EBTAD +AQH/MB0GA1UdDgQWBBRK+lSGutXf4DkTjR3WNfv4+KeNFTAOBgNVHQ8BAf8EBAMC +AYYwCgYIKoZIzj0EAwMDaAAwZQIxAJ4NxQ1Gerqr70ZrnUqc62Vl8NNqTzInamCG +Kce3FTsMWbS9qkgrjZkO9QqOcGIw/gIwSLrwUT+PKr9+H9eHyGvpq9/3AIYSnFkb +Cf3dyWPiLKoAtLFwjzB/CkJlsAS1c8dS +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/jCCA+agAwIBAgIQGZH12Q7x41qIh9vDu9ikTjANBgkqhkiG9w0BAQwFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIGV1LXdlc3QtMyBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTI1MjIyMjMzWhgPMjEyMTA1MjUyMzIyMzNaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgZXUtd2VzdC0zIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBAMqE47sHXWzdpuqj +JHb+6jM9tDbQLDFnYjDWpq4VpLPZhb7xPNh9gnYYTPKG4avG421EblAHqzy9D2pN +1z90yKbIfUb/Sy2MhQbmZomsObhONEra06fJ0Dydyjswf1iYRp2kwpx5AgkVoNo7 +3dlws73zFjD7ImKvUx2C7B75bhnw2pJWkFnGcswl8fZt9B5Yt95sFOKEz2MSJE91 +kZlHtya19OUxZ/cSGci4MlOySzqzbGwUqGxEIDlY8I39VMwXaYQ8uXUN4G780VcL +u46FeyRGxZGz2n3hMc805WAA1V5uir87vuirTvoSVREET97HVRGVVNJJ/FM6GXr1 +VKtptybbo81nefYJg9KBysxAa2Ao2x2ry/2ZxwhS6VZ6v1+90bpZA1BIYFEDXXn/ +dW07HSCFnYSlgPtSc+Muh15mdr94LspYeDqNIierK9i4tB6ep7llJAnq0BU91fM2 +JPeqyoTtc3m06QhLf68ccSxO4l8Hmq9kLSHO7UXgtdjfRVaffngopTNk8qK7bIb7 +LrgkqhiQw/PRCZjUdyXL153/fUcsj9nFNe25gM4vcFYwH6c5trd2tUl31NTi1MfG +Mgp3d2dqxQBIYANkEjtBDMy3SqQLIo9EymqmVP8xx2A/gCBgaxvMAsI6FSWRoC7+ +hqJ8XH4mFnXSHKtYMe6WPY+/XZgtAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8w +HQYDVR0OBBYEFIkXqTnllT/VJnI2NqipA4XV8rh1MA4GA1UdDwEB/wQEAwIBhjAN +BgkqhkiG9w0BAQwFAAOCAgEAKjSle8eenGeHgT8pltWCw/HzWyQruVKhfYIBfKJd +MhV4EnH5BK7LxBIvpXGsFUrb0ThzSw0fn0zoA9jBs3i/Sj6KyeZ9qUF6b8ycDXd+ +wHonmJiQ7nk7UuMefaYAfs06vosgl1rI7eBHC0itexIQmKh0aX+821l4GEgEoSMf +loMFTLXv2w36fPHHCsZ67ODldgcZbKNnpCTX0YrCwEYO3Pz/L398btiRcWGrewrK +jdxAAyietra8DRno1Zl87685tfqc6HsL9v8rVw58clAo9XAQvT+fmSOFw/PogRZ7 +OMHUat3gu/uQ1M5S64nkLLFsKu7jzudBuoNmcJysPlzIbqJ7vYc82OUGe9ucF3wi +3tbKQ983hdJiTExVRBLX/fYjPsGbG3JtPTv89eg2tjWHlPhCDMMxyRKl6isu2RTq +6VT489Z2zQrC33MYF8ZqO1NKjtyMAMIZwxVu4cGLkVsqFmEV2ScDHa5RadDyD3Ok +m+mqybhvEVm5tPgY6p0ILPMN3yvJsMSPSvuBXhO/X5ppNnpw9gnxpwbjQKNhkFaG +M5pkADZ14uRguOLM4VthSwUSEAr5VQYCFZhEwK+UOyJAGiB/nJz6IxL5XBNUXmRM +Hl8Xvz4riq48LMQbjcVQj0XvH941yPh+P8xOi00SGaQRaWp55Vyr4YKGbV0mEDz1 +r1o= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIF/zCCA+egAwIBAgIRAKwYju1QWxUZpn6D1gOtwgQwDQYJKoZIhvcNAQEMBQAw +gZcxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEwMC4GA1UEAwwn +QW1hem9uIFJEUyBldS13ZXN0LTEgUm9vdCBDQSBSU0E0MDk2IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyMDE2NTM1NFoYDzIxMjEwNTIwMTc1MzU0WjCBlzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdBbWF6 +b24gUkRTIGV1LXdlc3QtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwggIiMA0GCSqGSIb3DQEBAQUAA4ICDwAwggIKAoICAQCKdBP1U4lqWWkc +Cb25/BKRTsvNVnISiKocva8GAzJyKfcGRa85gmgu41U+Hz6+39K+XkRfM0YS4BvQ +F1XxWT0bNyypuvwCvmYShSTjN1TY0ltncDddahTajE/4MdSOZb/c98u0yt03cH+G +hVwRyT50h0v/UEol50VfwcVAEZEgcQQYhf1IFUFlIvKpmDOqLuFakOnc7c9akK+i +ivST+JO1tgowbnNkn2iLlSSgUWgb1gjaOsNfysagv1RXdlyPw3EyfwkFifAQvF2P +Q0ayYZfYS640cccv7efM1MSVyFHR9PrrDsF/zr2S2sGPbeHr7R/HwLl+S5J/l9N9 +y0rk6IHAWV4dEkOvgpnuJKURwA48iu1Hhi9e4moNS6eqoK2KmY3VFpuiyWcA73nH +GSmyaH+YuMrF7Fnuu7GEHZL/o6+F5cL3mj2SJJhL7sz0ryf5Cs5R4yN9BIEj/f49 +wh84pM6nexoI0Q4wiSFCxWiBpjSmOK6h7z6+2utaB5p20XDZHhxAlmlx4vMuWtjh +XckgRFxc+ZpVMU3cAHUpVEoO49e/+qKEpPzp8Xg4cToKw2+AfTk3cmyyXQfGwXMQ +ZUHNZ3w9ILMWihGCM2aGUsLcGDRennvNmnmin/SENsOQ8Ku0/a3teEzwV9cmmdYz +5iYs1YtgPvKFobY6+T2RXXh+A5kprwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/ +MB0GA1UdDgQWBBSyUrsQVnKmA8z6/2Ech0rCvqpNmTAOBgNVHQ8BAf8EBAMCAYYw +DQYJKoZIhvcNAQEMBQADggIBAFlj3IFmgiFz5lvTzFTRizhVofhTJsGr14Yfkuc7 +UrXPuXOwJomd4uot2d/VIeGJpfnuS84qGdmQyGewGTJ9inatHsGZgHl9NHNWRwKZ +lTKTbBiq7aqgtUSFa06v202wpzU+1kadxJJePrbABxiXVfOmIW/a1a4hPNcT3syH +FIEg1+CGsp71UNjBuwg3JTKWna0sLSKcxLOSOvX1fzxK5djzVpEsvQMB4PSAzXca +vENgg2ErTwgTA+4s6rRtiBF9pAusN1QVuBahYP3ftrY6f3ycS4K65GnqscyfvKt5 +YgjtEKO3ZeeX8NpubMbzC+0Z6tVKfPFk/9TXuJtwvVeqow0YMrLLyRiYvK7EzJ97 +rrkxoKnHYQSZ+rH2tZ5SE392/rfk1PJL0cdHnkpDkUDO+8cKsFjjYKAQSNC52sKX +74AVh6wMwxYwVZZJf2/2XxkjMWWhKNejsZhUkTISSmiLs+qPe3L67IM7GyKm9/m6 +R3r8x6NGjhTsKH64iYJg7AeKeax4b2e4hBb6GXFftyOs7unpEOIVkJJgM6gh3mwn +R7v4gwFbLKADKt1vHuerSZMiTuNTGhSfCeDM53XI/mjZl2HeuCKP1mCDLlaO+gZR +Q/G+E0sBKgEX4xTkAc3kgkuQGfExdGtnN2U2ehF80lBHB8+2y2E+xWWXih/ZyIcW +wOx+ +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGBDCCA+ygAwIBAgIQM4C8g5iFRucSWdC8EdqHeDANBgkqhkiG9w0BAQwFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGV1LWNlbnRyYWwtMSBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjEwNTIxMjIyODI2WhgPMjEyMTA1MjEyMzI4MjZaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgZXUtY2VudHJhbC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANeTsD/u +6saPiY4Sg0GlJlMXMBltnrcGAEkwq34OKQ0bCXqcoNJ2rcAMmuFC5x9Ho1Y3YzB7 +NO2GpIh6bZaO76GzSv4cnimcv9n/sQSYXsGbPD+bAtnN/RvNW1avt4C0q0/ghgF1 +VFS8JihIrgPYIArAmDtGNEdl5PUrdi9y6QGggbRfidMDdxlRdZBe1C18ZdgERSEv +UgSTPRlVczONG5qcQkUGCH83MMqL5MKQiby/Br5ZyPq6rxQMwRnQ7tROuElzyYzL +7d6kke+PNzG1mYy4cbYdjebwANCtZ2qYRSUHAQsOgybRcSoarv2xqcjO9cEsDiRU +l97ToadGYa4VVERuTaNZxQwrld4mvzpyKuirqZltOqg0eoy8VUsaRPL3dc5aChR0 +dSrBgRYmSAClcR2/2ZCWpXemikwgt031Dsc0A/+TmVurrsqszwbr0e5xqMow9LzO +MI/JtLd0VFtoOkL/7GG2tN8a+7gnLFxpv+AQ0DH5n4k/BY/IyS+H1erqSJhOTQ11 +vDOFTM5YplB9hWV9fp5PRs54ILlHTlZLpWGs3I2BrJwzRtg/rOlvsosqcge9ryai +AKm2j+JBg5wJ19R8oxRy8cfrNTftZePpISaLTyV2B16w/GsSjqixjTQe9LRN2DHk +cC+HPqYyzW2a3pUVyTGHhW6a7YsPBs9yzt6hAgMBAAGjQjBAMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFIqA8QkOs2cSirOpCuKuOh9VDfJfMA4GA1UdDwEB/wQE +AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAOUI90mEIsa+vNJku0iUwdBMnHiO4gm7E +5JloP7JG0xUr7d0hypDorMM3zVDAL+aZRHsq8n934Cywj7qEp1304UF6538ByGdz +tkfacJsUSYfdlNJE9KbA4T+U+7SNhj9jvePpVjdQbhgzxITE9f8CxY/eM40yluJJ +PhbaWvOiRagzo74wttlcDerzLT6Y/JrVpWhnB7IY8HvzK+BwAdaCsBUPC3HF+kth +CIqLq7J3YArTToejWZAp5OOI6DLPM1MEudyoejL02w0jq0CChmZ5i55ElEMnapRX +7GQTARHmjgAOqa95FjbHEZzRPqZ72AtZAWKFcYFNk+grXSeWiDgPFOsq6mDg8DDB +0kfbYwKLFFCC9YFmYzR2YrWw2NxAScccUc2chOWAoSNHiqBbHR8ofrlJSWrtmKqd +YRCXzn8wqXnTS3NNHNccqJ6dN+iMr9NGnytw8zwwSchiev53Fpc1mGrJ7BKTWH0t +ZrA6m32wzpMymtKozlOPYoE5mtZEzrzHEXfa44Rns7XIHxVQSXVWyBHLtIsZOrvW +U5F41rQaFEpEeUQ7sQvqUoISfTUVRNDn6GK6YaccEhCji14APLFIvhRQUDyYMIiM +4vll0F/xgVRHTgDVQ8b8sxdhSYlqB4Wc2Ym41YRz+X2yPqk3typEZBpc4P5Tt1/N +89cEIGdbjsA= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIQYjbPSg4+RNRD3zNxO1fuKDANBgkqhkiG9w0BAQsFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIGV1LW5vcnRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUyNDIwNTkyMVoYDzIwNjEwNTI0MjE1OTIxWjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIGV1LW5vcnRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA179eQHxcV0YL +XMkqEmhSBazHhnRVd8yICbMq82PitE3BZcnv1Z5Zs/oOgNmMkOKae4tCXO/41JCX +wAgbs/eWWi+nnCfpQ/FqbLPg0h3dqzAgeszQyNl9IzTzX4Nd7JFRBVJXPIIKzlRf ++GmFsAhi3rYgDgO27pz3ciahVSN+CuACIRYnA0K0s9lhYdddmrW/SYeWyoB7jPa2 +LmWpAs7bDOgS4LlP2H3eFepBPgNufRytSQUVA8f58lsE5w25vNiUSnrdlvDrIU5n +Qwzc7NIZCx4qJpRbSKWrUtbyJriWfAkGU7i0IoainHLn0eHp9bWkwb9D+C/tMk1X +ERZw2PDGkwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBSFmR7s +dAblusFN+xhf1ae0KUqhWTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +ggEBAHsXOpjPMyH9lDhPM61zYdja1ebcMVgfUvsDvt+w0xKMKPhBzYDMs/cFOi1N +Q8LV79VNNfI2NuvFmGygcvTIR+4h0pqqZ+wjWl3Kk5jVxCrbHg3RBX02QLumKd/i +kwGcEtTUvTssn3SM8bgM0/1BDXgImZPC567ciLvWDo0s/Fe9dJJC3E0G7d/4s09n +OMdextcxFuWBZrBm/KK3QF0ByA8MG3//VXaGO9OIeeOJCpWn1G1PjT1UklYhkg61 +EbsTiZVA2DLd1BGzfU4o4M5mo68l0msse/ndR1nEY6IywwpgIFue7+rEleDh6b9d +PYkG1rHVw2I0XDG4o17aOn5E94I= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIQC6W4HFghUkkgyQw14a6JljANBgkqhkiG9w0BAQsFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIGV1LXNvdXRoLTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIyMDUyMzE4MTYzMloYDzIwNjIwNTIzMTkxNjMyWjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIGV1LXNvdXRoLTIgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAiM/t4FV2R9Nx +UQG203UY83jInTa/6TMq0SPyg617FqYZxvz2kkx09x3dmxepUg9ttGMlPgjsRZM5 +LCFEi1FWk+hxHzt7vAdhHES5tdjwds3aIkgNEillmRDVrUsbrDwufLaa+MMDO2E1 +wQ/JYFXw16WBCCi2g1EtyQ2Xp+tZDX5IWOTnvhZpW8vVDptZ2AcJ5rMhfOYO3OsK +5EF0GGA5ldzuezP+BkrBYGJ4wVKGxeaq9+5AT8iVZrypjwRkD7Y5CurywK3+aBwm +s9Q5Nd8t45JCOUzYp92rFKsCriD86n/JnEvgDfdP6Hvtm0/DkwXK40Wz2q0Zrd0k +mjP054NRPwIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBRR7yqd +SfKcX2Q8GzhcVucReIpewTAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +ggEBAEszBRDwXcZyNm07VcFwI1Im94oKwKccuKYeJEsizTBsVon8VpEiMwDs+yGu +3p8kBhvkLwWybkD/vv6McH7T5b9jDX2DoOudqYnnaYeypsPH/00Vh3LvKagqzQza +orWLx+0tLo8xW4BtU+Wrn3JId8LvAhxyYXTn9bm+EwPcStp8xGLwu53OPD1RXYuy +uu+3ps/2piP7GVfou7H6PRaqbFHNfiGg6Y+WA0HGHiJzn8uLmrRJ5YRdIOOG9/xi +qTmAZloUNM7VNuurcMM2hWF494tQpsQ6ysg2qPjbBqzlGoOt3GfBTOZmqmwmqtam +K7juWM/mdMQAJ3SMlE5wI8nVdx4= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICrjCCAjSgAwIBAgIRAL9SdzVPcpq7GOpvdGoM80IwCgYIKoZIzj0EAwMwgZYx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTEvMC0GA1UEAwwmQW1h +em9uIFJEUyBldS13ZXN0LTEgUm9vdCBDQSBFQ0MzODQgRzExEDAOBgNVBAcMB1Nl +YXR0bGUwIBcNMjEwNTIwMTY1ODA3WhgPMjEyMTA1MjAxNzU4MDdaMIGWMQswCQYD +VQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjETMBEG +A1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExLzAtBgNVBAMMJkFtYXpvbiBS +RFMgZXUtd2VzdC0xIFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQHDAdTZWF0dGxl +MHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEJWDgXebvwjR+Ce+hxKOLbnsfN5W5dOlP +Zn8kwWnD+SLkU81Eac/BDJsXGrMk6jFD1vg16PEkoSevsuYWlC8xR6FmT6F6pmeh +fsMGOyJpfK4fyoEPhKeQoT23lFIc5Orjo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0G +A1UdDgQWBBSVNAN1CHAz0eZ77qz2adeqjm31TzAOBgNVHQ8BAf8EBAMCAYYwCgYI +KoZIzj0EAwMDaAAwZQIxAMlQeHbcjor49jqmcJ9gRLWdEWpXG8thIf6zfYQ/OEAg +d7GDh4fR/OUk0VfjsBUN/gIwZB0bGdXvK38s6AAE/9IT051cz/wMe9GIrX1MnL1T +1F5OqnXJdiwfZRRTHsRQ/L00 +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGBDCCA+ygAwIBAgIQalr16vDfX4Rsr+gfQ4iVFDANBgkqhkiG9w0BAQwFADCB +mjELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTMwMQYDVQQDDCpB +bWF6b24gUkRTIGV1LWNlbnRyYWwtMiBSb290IENBIFJTQTQwOTYgRzExEDAOBgNV +BAcMB1NlYXR0bGUwIBcNMjIwNjA2MjEyNTIzWhgPMjEyMjA2MDYyMjI1MjNaMIGa +MQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5j +LjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMzAxBgNVBAMMKkFt +YXpvbiBSRFMgZXUtY2VudHJhbC0yIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANbHbFg7 +2VhZor1YNtez0VlNFaobS3PwOMcEn45BE3y7HONnElIIWXGQa0811M8V2FnyqnE8 +Z5aO1EuvijvWf/3D8DPZkdmAkIfh5hlZYY6Aatr65kEOckwIAm7ZZzrwFogYuaFC +z/q0CW+8gxNK+98H/zeFx+IxiVoPPPX6UlrLvn+R6XYNERyHMLNgoZbbS5gGHk43 +KhENVv3AWCCcCc85O4rVd+DGb2vMVt6IzXdTQt6Kih28+RGph+WDwYmf+3txTYr8 +xMcCBt1+whyCPlMbC+Yn/ivtCO4LRf0MPZDRQrqTTrFf0h/V0BGEUmMGwuKgmzf5 +Kl9ILdWv6S956ioZin2WgAxhcn7+z//sN++zkqLreSf90Vgv+A7xPRqIpTdJ/nWG +JaAOUofBfsDsk4X4SUFE7xJa1FZAiu2lqB/E+y7jnWOvFRalzxVJ2Y+D/ZfUfrnK +4pfKtyD1C6ni1celrZrAwLrJ3PoXPSg4aJKh8+CHex477SRsGj8KP19FG8r0P5AG +8lS1V+enFCNvT5KqEBpDZ/Y5SQAhAYFUX+zH4/n4ql0l/emS+x23kSRrF+yMkB9q +lhC/fMk6Pi3tICBjrDQ8XAxv56hfud9w6+/ljYB2uQ1iUYtlE3JdIiuE+3ws26O8 +i7PLMD9zQmo+sVi12pLHfBHQ6RRHtdVRXbXRAgMBAAGjQjBAMA8GA1UdEwEB/wQF +MAMBAf8wHQYDVR0OBBYEFBFot08ipEL9ZUXCG4lagmF53C0/MA4GA1UdDwEB/wQE +AwIBhjANBgkqhkiG9w0BAQwFAAOCAgEAi2mcZi6cpaeqJ10xzMY0F3L2eOKYnlEQ +h6QyhmNKCUF05q5u+cok5KtznzqMwy7TFOZtbVHl8uUX+xvgq/MQCxqFAnuStBXm +gr2dg1h509ZwvTdk7TDxGdftvPCfnPNJBFbMSq4CZtNcOFBg9Rj8c3Yj+Qvwd56V +zWs65BUkDNJrXmxdvhJZjUkMa9vi/oFN+M84xXeZTaC5YDYNZZeW9706QqDbAVES +5ulvKLavB8waLI/lhRBK5/k0YykCMl0A8Togt8D1QsQ0eWWbIM8/HYJMPVFhJ8Wj +vT1p/YVeDA3Bo1iKDOttgC5vILf5Rw1ZEeDxjf/r8A7VS13D3OLjBmc31zxRTs3n +XvHKP9MieQHn9GE44tEYPjK3/yC6BDFzCBlvccYHmqGb+jvDEXEBXKzimdC9mcDl +f4BBQWGJBH5jkbU9p6iti19L/zHhz7qU6UJWbxY40w92L9jS9Utljh4A0LCTjlnR +NQUgjnGC6K+jkw8hj0LTC5Ip87oqoT9w7Av5EJ3VJ4hcnmNMXJJ1DkWYdnytcGpO +DMVITQzzDZRwhbitCVPHagTN2wdi9TEuYE33J0VmFeTc6FSI50wP2aOAZ0Q1/8Aj +bxeM5jS25eaHc2CQAuhrc/7GLnxOcPwdWQb2XWT8eHudhMnoRikVv/KSK3mf6om4 +1YfpdH2jp30= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIID/jCCAuagAwIBAgIQTDc+UgTRtYO7ZGTQ8UWKDDANBgkqhkiG9w0BAQsFADCB +lzELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTAwLgYDVQQDDCdB +bWF6b24gUkRTIGV1LXdlc3QtMiBSb290IENBIFJTQTIwNDggRzExEDAOBgNVBAcM +B1NlYXR0bGUwIBcNMjEwNTIxMjI0NjI0WhgPMjA2MTA1MjEyMzQ2MjRaMIGXMQsw +CQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywgSW5jLjET +MBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExMDAuBgNVBAMMJ0FtYXpv +biBSRFMgZXUtd2VzdC0yIFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4GA1UEBwwHU2Vh +dHRsZTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAM1oGtthQ1YiVIC2 +i4u4swMAGxAjc/BZp0yq0eP5ZQFaxnxs7zFAPabEWsrjeDzrRhdVO0h7zskrertP +gblGhfD20JfjvCHdP1RUhy/nzG+T+hn6Takan/GIgs8grlBMRHMgBYHW7tklhjaH +3F7LujhceAHhhgp6IOrpb6YTaTTaJbF3GTmkqxSJ3l1LtEoWz8Al/nL/Ftzxrtez +Vs6ebpvd7sw37sxmXBWX2OlvUrPCTmladw9OrllGXtCFw4YyLe3zozBlZ3cHzQ0q +lINhpRcajTMfZrsiGCkQtoJT+AqVJPS2sHjqsEH8yiySW9Jbq4zyMbM1yqQ2vnnx +MJgoYMcCAwEAAaNCMEAwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUaQG88UnV +JPTI+Pcti1P+q3H7pGYwDgYDVR0PAQH/BAQDAgGGMA0GCSqGSIb3DQEBCwUAA4IB +AQBAkgr75V0sEJimC6QRiTVWEuj2Khy7unjSfudbM6zumhXEU2/sUaVLiYy6cA/x +3v0laDle6T07x9g64j5YastE/4jbzrGgIINFlY0JnaYmR3KZEjgi1s1fkRRf3llL +PJm9u4Q1mbwAMQK/ZjLuuRcL3uRIHJek18nRqT5h43GB26qXyvJqeYYpYfIjL9+/ +YiZAbSRRZG+Li23cmPWrbA1CJY121SB+WybCbysbOXzhD3Sl2KSZRwSw4p2HrFtV +1Prk0dOBtZxCG9luf87ultuDZpfS0w6oNBAMXocgswk24ylcADkkFxBWW+7BETn1 +EpK+t1Lm37mU4sxtuha00XAi +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIEADCCAuigAwIBAgIQcY44/8NUvBwr6LlHfRy7KjANBgkqhkiG9w0BAQsFADCB +mDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChB +bWF6b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTIxMDUxOTE4MjcxOFoYDzIwNjEwNTE5MTkyNzE4WjCBmDEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTEwLwYDVQQDDChBbWF6 +b24gUkRTIGV1LXNvdXRoLTEgUm9vdCBDQSBSU0EyMDQ4IEcxMRAwDgYDVQQHDAdT +ZWF0dGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0UaBeC+Usalu +EtXnV7+PnH+gi7/71tI/jkKVGKuhD2JDVvqLVoqbMHRh3+wGMvqKCjbHPcC2XMWv +566fpAj4UZ9CLB5fVzss+QVNTl+FH2XhEzigopp+872ajsNzcZxrMkifxGb4i0U+ +t0Zi+UrbL5tsfP2JonKR1crOrbS6/DlzHBjIiJazGOQcMsJjNuTOItLbMohLpraA +/nApa3kOvI7Ufool1/34MG0+wL3UUA4YkZ6oBJVxjZvvs6tI7Lzz/SnhK2widGdc +snbLqBpHNIZQSorVoiwcFaRBGYX/uzYkiw44Yfa4cK2V/B5zgu1Fbr0gbI2am4eh +yVYyg4jPawIDAQABo0IwQDAPBgNVHRMBAf8EBTADAQH/MB0GA1UdDgQWBBS9gM1m +IIjyh9O5H/7Vj0R/akI7UzAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcNAQELBQAD +ggEBAF0Sm9HC2AUyedBVnwgkVXMibnYChOzz7T+0Y+fOLXYAEXex2s8oqGeZdGYX +JHkjBn7JXu7LM+TpTbPbFFDoc1sgMguD/ls+8XsqAl1CssW+amryIL+jfcfbgQ+P +ICwEUD9hGdjBgJ5WcuS+qqxHsEIlFNci3HxcxfBa9VsWs5TjI7Vsl4meL5lf7ZyL +wDV7dHRuU+cImqG1MIvPRIlvPnT7EghrCYi2VCPhP2pM/UvShuwVnkz4MJ29ebIk +WR9kpblFxFdE92D5UUvMCjC2kmtgzNiErvTcwIvOO9YCbBHzRB1fFiWrXUHhJWq9 +IkaxR5icb/IpAV0A1lYZEWMVsfQ= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGATCCA+mgAwIBAgIRAMa0TPL+QgbWfUPpYXQkf8wwDQYJKoZIhvcNAQEMBQAw +gZgxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwo +QW1hem9uIFJEUyBldS1ub3J0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UE +BwwHU2VhdHRsZTAgFw0yMTA1MjQyMTAzMjBaGA8yMTIxMDUyNDIyMDMyMFowgZgx +CzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJbmMu +MRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTExMC8GA1UEAwwoQW1h +em9uIFJEUyBldS1ub3J0aC0xIFJvb3QgQ0EgUlNBNDA5NiBHMTEQMA4GA1UEBwwH +U2VhdHRsZTCCAiIwDQYJKoZIhvcNAQEBBQADggIPADCCAgoCggIBANhS9LJVJyWp +6Rudy9t47y6kzvgnFYDrvJVtgEK0vFn5ifdlHE7xqMz4LZqWBFTnS+3oidwVRqo7 +tqsuuElsouStO8m315/YUzKZEPmkw8h5ufWt/lg3NTCoUZNkB4p4skr7TspyMUwE +VdlKQuWTCOLtofwmWT+BnFF3To6xTh3XPlT3ssancw27Gob8kJegD7E0TSMVsecP +B8je65+3b8CGwcD3QB3kCTGLy87tXuS2+07pncHvjMRMBdDQQQqhXWsRSeUNg0IP +xdHTWcuwMldYPWK5zus9M4dCNBDlmZjKdcZZVUOKeBBAm7Uo7CbJCk8r/Fvfr6mw +nXXDtuWhqn/WhJiI/y0QU27M+Hy5CQMxBwFsfAjJkByBpdXmyYxUgTmMpLf43p7H +oWfH1xN0cT0OQEVmAQjMakauow4AQLNkilV+X6uAAu3STQVFRSrpvMen9Xx3EPC3 +G9flHueTa71bU65Xe8ZmEmFhGeFYHY0GrNPAFhq9RThPRY0IPyCZe0Th8uGejkek +jQjm0FHPOqs5jc8CD8eJs4jSEFt9lasFLVDcAhx0FkacLKQjGHvKAnnbRwhN/dF3 +xt4oL8Z4JGPCLau056gKnYaEyviN7PgO+IFIVOVIdKEBu2ASGE8/+QJB5bcHefNj +04hEkDW0UYJbSfPpVbGAR0gFI/QpycKnAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMB +Af8wHQYDVR0OBBYEFFMXvvjoaGGUcul8GA3FT05DLbZcMA4GA1UdDwEB/wQEAwIB +hjANBgkqhkiG9w0BAQwFAAOCAgEAQLwFhd2JKn4K/6salLyIA4mP58qbA/9BTB/r +D9l0bEwDlVPSdY7R3gZCe6v7SWLfA9RjE5tdWDrQMi5IU6W2OVrVsZS/yGJfwnwe +a/9iUAYprA5QYKDg37h12XhVsDKlYCekHdC+qa5WwB1SL3YUprDLPWeaIQdg+Uh2 ++LxvpZGoxoEbca0fc7flwq9ke/3sXt/3V4wJDyY6AL2YNdjFzC+FtYjHHx8rYxHs +aesP7yunuN17KcfOZBBnSFRrx96k+Xm95VReTEEpwiBqAECqEpMbd+R0mFAayMb1 +cE77GaK5yeC2f67NLYGpkpIoPbO9p9rzoXLE5GpSizMjimnz6QCbXPFAFBDfSzim +u6azp40kEUO6kWd7rBhqRwLc43D3TtNWQYxMve5mTRG4Od+eMKwYZmQz89BQCeqm +aZiJP9y9uwJw4p/A5V3lYHTDQqzmbOyhGUk6OdpdE8HXs/1ep1xTT20QDYOx3Ekt +r4mmNYfH/8v9nHNRlYJOqFhmoh1i85IUl5IHhg6OT5ZTTwsGTSxvgQQXrmmHVrgZ +rZIqyBKllCgVeB9sMEsntn4bGLig7CS/N1y2mYdW/745yCLZv2gj0NXhPqgEIdVV +f9DhFD4ohE1C63XP0kOQee+LYg/MY5vH8swpCSWxQgX5icv5jVDz8YTdCKgUc5u8 +rM2p0kk= +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIECDCCAvCgAwIBAgIQYWF2Yb4HiQV2OJlcN2BhUDANBgkqhkiG9w0BAQsFADCB +nDELMAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIElu +Yy4xEzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTUwMwYDVQQDDCxB +bWF6b24gUkRTIGFwLXNvdXRoZWFzdC02IFJvb3QgQ0EgUlNBMjA0OCBHMTEQMA4G +A1UEBwwHU2VhdHRsZTAgFw0yNTA1MjAwMTQzNTdaGA8yMDY1MDUyMDAyNDM1N1ow +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNiBSb290IENBIFJTQTIwNDggRzExEDAO +BgNVBAcMB1NlYXR0bGUwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCp +7R+Rclm+GQyjwytLA5lg6AH6IzXEsp8Q5ZtYzjYizhzOWhdqYfYQsv43IJjzY3Cd +Wwtp+/+WOegfFntFfEN7Cy2zP+Ib18TT4alkalo45mbTjcKAflDhLuwLZCrXq7Sk +ECm0lveumAlVXXUW0mFEOd48XvTzvY1tNO8hGlN2l1n2wG6TfOU317q+PLF2F79J +iAqVt2ZUIvFgwIS3qfQK0n6c5OKzPrpsvfecFZePhL20YH/2yCNxGb6rNBRErXxV +oNICqsl03LNOcgpm1WvXINWLJT/le6IEAbHMgMeG3DIG3q4sYiEyE5qi8SSR6S5P +ky3+mtWZL/ZWp2HFQ8xZAgMBAAGjQjBAMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0O +BBYEFAlH8qgMxdi5cVGO+FTynv4hC3sOMA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG +9w0BAQsFAAOCAQEAS+oW1l/6C3lh4WWE2aBGCdC713mjpBjgTjzpUnyIdQDaBuzD +vHpm+p6bK+a4WP/jtjniUvZhyYD9VbaQhHYa9nSX+LHIkF1cxMTqHMjK8dgnenF7 +KhUbmaERlk7MPAGLoRKngoS8NRjizFiBLUTKn62KvI4DKiswxWJklpd3HIn9qq8q +eR2PLoHHc4WJ/E1UXpCIt9dbWwB22xHp0Gb0vFcdWE76uwR5C4x8eAqct8455NrC +gh3UCCsNEu57aUjNRA+PwvCUDEsJj72mKCzUNGG4bTDCqY1DMlx2TaXByxs7Ctwx +wiK/vWV+ZChc5mMDzf9csrOQzDPPJpiUfp11rg== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIIGCTCCA/GgAwIBAgIRAKEoQBLrmKhwHJppfnj9miEwDQYJKoZIhvcNAQEMBQAw +gZwxCzAJBgNVBAYTAlVTMSIwIAYDVQQKDBlBbWF6b24gV2ViIFNlcnZpY2VzLCBJ +bmMuMRMwEQYDVQQLDApBbWF6b24gUkRTMQswCQYDVQQIDAJXQTE1MDMGA1UEAwws +QW1hem9uIFJEUyBhcC1zb3V0aGVhc3QtNiBSb290IENBIFJTQTQwOTYgRzExEDAO +BgNVBAcMB1NlYXR0bGUwIBcNMjUwNTIwMDE0NDAyWhgPMjEyNTA1MjAwMjQ0MDJa +MIGcMQswCQYDVQQGEwJVUzEiMCAGA1UECgwZQW1hem9uIFdlYiBTZXJ2aWNlcywg +SW5jLjETMBEGA1UECwwKQW1hem9uIFJEUzELMAkGA1UECAwCV0ExNTAzBgNVBAMM +LEFtYXpvbiBSRFMgYXAtc291dGhlYXN0LTYgUm9vdCBDQSBSU0E0MDk2IEcxMRAw +DgYDVQQHDAdTZWF0dGxlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA +m5LnhN6bm6BRlvFolsYe4EuK0uIWhLFItpCs4GbfAyQMJUEFc9pUIayg9+N6/B7q +4VVRvIDYfqEIjywkWaJwBu58/B2EE47iLTHvAU9HyxojKvucFFHRmrrsQG5Fyn/0 +LNDDiOpik6BTKp4b32JnEe+X5ASd4pU7ibOSec6m+mISIEIAsjaRw8WdcrglJpIu +69NKoM9QJRkiECWe6MSxwuTdNgh5SouuABThg7ROPrxlxt1pkwlN1nA1Czb2GrBe +XV4Be1h1djEC7UoehaVxOs4VFJfOuHg72YHHf3zVhtpJAGR0/HypOcFnXd+DXoXL +wjMUm3mDNyMEJLHQUwYA99QheEl7+aprpe9gM3RQ85sg5XQJ3YUOPuErqDnnVveH +bckOkkTYTfSZUY9fpQmX7YxFv/QN6UpMXh7pzxOeM+VTvsH3JH0HweFNWCSALcbg +/no7Z8mIkOEE9gMCzqoFz0uILQzFM/n5yrAnmCzU+EM5HC3+oxO9mGGwiNp/LQUY +nWqkHHLQjurxmqlLQoBofpYiyi9vdh3IbULtYZJTUT87OA5BsKOH5Vaq6J9vw701 +1zCQnpg8B6tp7+Z2/vCRr1sY7tNmh8gQoiwFfx9Qpkc83/mlyoenvqeevQ42bok8 +0KZvJ/dYKNRZLO7kX8kHZTWkzGOYpfI5djYCWAAlPRUCAwEAAaNCMEAwDwYDVR0T +AQH/BAUwAwEB/zAdBgNVHQ4EFgQUri9+CM+fxgpdvEDFDhb0smAKHy4wDgYDVR0P +AQH/BAQDAgGGMA0GCSqGSIb3DQEBDAUAA4ICAQAUOKOXItwvve85tuPTLBNVP18f +40rf8RPhH1JFKMePXcQ2gav7t9KwxnUk6iqVo/Pt/knUeXJ+uLMRHfjzVpadlUoT +6zH+TndeljwG1QFuYOxwYI+VNwZnb7lF0O0cADkhDfc8/QvG/ZkrAx7s2kWWC8by +fWpsjDt3xDD3ump+Qr+o0jpZyXPbWZQeIo5wmnMOc0PXxeFlIOCeUaJDtaJMRHBq +CpdPT5xkNaRJnZzKJiUZx3NZe4du5lVuz5gT9YmooFGRFHU26hANkHQGxsDTkTx9 +Mg+5QXeDFQ7MnvFmFu2rb2cizZuKL9ZpiLE5f2/Hcd7apY7z8dSJhDWhvmTeeJPr +GbplpepGVt5BIhg395guJ8Kww4Ux7a/8ERdQHkRd+ykspQNfveqLl+IP8s/snLDP +lcILGYvHLq02HGrM8chU5mzNe5lyYmSI3cYxEZdDMiuOVpLlNuNUGadyafFx13Y0 +a6wDpXcot9Qh6W+JFpq0TbgbVezkk+1YzDJK7ShBQqckPlGHl9uyWjX3xuC4KD6g +epx7UmkEP56BhvLMoT+o3KDBts9ujuJIZt+uGoo+rYIZaSuGLKdA60B4ZS3ONrws +G3+o22y0lMvHGMHiwCIH+RQQBt5brmfkjD+QJh5K/1iJaZtFecgeuZnuar5W37k2 +IGstLzLjZODMnBQoSA== +-----END CERTIFICATE----- +-----BEGIN CERTIFICATE----- +MIICtzCCAj2gAwIBAgIQbliDBFi6VBnhtzveX+/ALjAKBggqhkjOPQQDAzCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC02IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMCAXDTI1MDUyMDAxNDQwN1oYDzIxMjUwNTIwMDI0NDA3WjCBmzEL +MAkGA1UEBhMCVVMxIjAgBgNVBAoMGUFtYXpvbiBXZWIgU2VydmljZXMsIEluYy4x +EzARBgNVBAsMCkFtYXpvbiBSRFMxCzAJBgNVBAgMAldBMTQwMgYDVQQDDCtBbWF6 +b24gUkRTIGFwLXNvdXRoZWFzdC02IFJvb3QgQ0EgRUNDMzg0IEcxMRAwDgYDVQQH +DAdTZWF0dGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEf1cgi4GHIBFSOQMW6NPm +/MUlTNs34ONxLDenJ/m3tkuMjoDSrimTAwQcCoIUrlwOpauaW4le0aFb+SUw6IEW +axCohHeASRW5P7rV/MBgiSWcKxgAj0XSWXaGMXM9ycfso0IwQDAPBgNVHRMBAf8E +BTADAQH/MB0GA1UdDgQWBBTTHGkZp0gQNJj2xYOEKgB+WoGw/zAOBgNVHQ8BAf8E +BAMCAYYwCgYIKoZIzj0EAwMDaAAwZQIwSZoT6sdk5Duk2oqvI9kbYDH84vut3CmX +EtJwpeusN5Uv0fm//WfNwXZmZ3RB7L9qAjEAqFQK/AKtmyTePw4w+LQVljNOh1UQ +sfb8fO9Mt9eYGJ0i1QYo60u/qIypql6ZsIvW +-----END CERTIFICATE----- diff --git a/hasna.contract.json b/hasna.contract.json new file mode 100644 index 0000000..78d9376 --- /dev/null +++ b/hasna.contract.json @@ -0,0 +1,36 @@ +{ + "schema": "hasna.service_contract.v1", + "name": "instructions", + "class": "service", + "contractVersion": "v1", + "kitVersion": "0.4.1", + "description": "AI coding agent instruction & configuration manager (formerly @hasna/configs). CLI + MCP + HTTP API (instructions-serve) + generated SDK. Cloud mode (HASNA_INSTRUCTIONS_DATABASE_URL set) is PURE REMOTE per Amendment A1: the serve process reads/writes the shared cloud Postgres directly with API-key auth via @hasna/contracts. The MCP server keeps the legacy name 'configs' aliased for the existing fleet.", + "bins": ["instructions", "instructions-mcp", "instructions-serve", "configs-mcp"], + "storage": { + "mode": "local", + "envPrefix": "HASNA_INSTRUCTIONS_", + "aliasEnvPrefix": "INSTRUCTIONS_", + "databaseUrlSecretRef": "hasna/oss/instructions/database-url", + "sqlitePath": "~/.hasna/instructions/instructions.db" + }, + "metadata": { + "service": { + "port": 8080, + "healthPath": "/health", + "readyPath": "/ready", + "versionPath": "/version", + "openapiPath": "/openapi.json", + "apiVersion": "v1", + "auth": "api-key", + "signingSecretSecretRef": "hasna/oss/instructions/api-key-signing-secret" + }, + "client": { + "apiUrlEnv": "INSTRUCTIONS_API_URL", + "apiKeyEnv": "INSTRUCTIONS_API_KEY" + }, + "mcp": { + "name": "configs", + "note": "MCP server identity intentionally kept as 'configs' so the 17-machine fleet MCP config keeps working; fleet rename is a separate controlled step." + } + } +} diff --git a/migrations/0001_instructions.sql b/migrations/0001_instructions.sql new file mode 100644 index 0000000..437af49 --- /dev/null +++ b/migrations/0001_instructions.sql @@ -0,0 +1,61 @@ +-- instructions cloud (A1 pure-remote) domain schema. +-- Idempotent; NEVER drops or rewrites existing tables. The serve process and the +-- migration runner apply the equivalent statements via src/storage/schema.ts. + +CREATE TABLE IF NOT EXISTS configs ( + id TEXT PRIMARY KEY, + name TEXT NOT NULL, + slug TEXT NOT NULL UNIQUE, + kind TEXT NOT NULL DEFAULT 'file', + category TEXT NOT NULL, + agent TEXT NOT NULL DEFAULT 'global', + target_path TEXT, + outputs JSONB NOT NULL DEFAULT '[]'::jsonb, + format TEXT NOT NULL DEFAULT 'text', + content TEXT NOT NULL DEFAULT '', + description TEXT, + tags JSONB NOT NULL DEFAULT '[]'::jsonb, + is_template BOOLEAN NOT NULL DEFAULT false, + version INTEGER NOT NULL DEFAULT 1, + created_at TIMESTAMPTZ NOT NULL DEFAULT now(), + updated_at TIMESTAMPTZ NOT NULL DEFAULT now(), + synced_at TIMESTAMPTZ +); +CREATE INDEX IF NOT EXISTS configs_category_idx ON configs (category); +CREATE INDEX IF NOT EXISTS configs_agent_idx ON configs (agent); + +CREATE TABLE IF NOT EXISTS config_snapshots ( + id TEXT PRIMARY KEY, + config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE, + content TEXT NOT NULL, + version INTEGER NOT NULL, + created_at TIMESTAMPTZ NOT NULL DEFAULT now() +); +CREATE INDEX IF NOT EXISTS config_snapshots_config_idx ON config_snapshots (config_id); + +CREATE TABLE IF NOT EXISTS profiles ( + id TEXT PRIMARY KEY, + name TEXT NOT NULL, + slug TEXT NOT NULL UNIQUE, + description TEXT, + selectors JSONB NOT NULL DEFAULT '{}'::jsonb, + variables JSONB NOT NULL DEFAULT '{}'::jsonb, + created_at TIMESTAMPTZ NOT NULL DEFAULT now(), + updated_at TIMESTAMPTZ NOT NULL DEFAULT now() +); + +CREATE TABLE IF NOT EXISTS profile_configs ( + profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE, + config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE, + sort_order INTEGER NOT NULL DEFAULT 0, + PRIMARY KEY (profile_id, config_id) +); + +CREATE TABLE IF NOT EXISTS machines ( + id TEXT PRIMARY KEY, + hostname TEXT NOT NULL UNIQUE, + os TEXT, + arch TEXT, + last_applied_at TIMESTAMPTZ, + created_at TIMESTAMPTZ NOT NULL DEFAULT now() +); diff --git a/migrations/0002_api_keys.sql b/migrations/0002_api_keys.sql new file mode 100644 index 0000000..09942c4 --- /dev/null +++ b/migrations/0002_api_keys.sql @@ -0,0 +1,20 @@ +-- Contracts API-key store (idempotent) +-- hasna_auth_0001_api_keys +CREATE TABLE IF NOT EXISTS api_keys ( + kid TEXT PRIMARY KEY, + app TEXT NOT NULL, + agent TEXT, + scopes JSONB NOT NULL, + token_hash TEXT NOT NULL UNIQUE, + issued_at TIMESTAMPTZ NOT NULL, + expires_at TIMESTAMPTZ, + revoked_at TIMESTAMPTZ, + revoked_reason TEXT, + last_used_at TIMESTAMPTZ, + created_by TEXT, + created_at TIMESTAMPTZ NOT NULL DEFAULT now() + ) + +-- hasna_auth_0002_api_keys_indexes +CREATE INDEX IF NOT EXISTS api_keys_app_idx ON api_keys (app); + CREATE INDEX IF NOT EXISTS api_keys_token_hash_idx ON api_keys (token_hash); diff --git a/package.json b/package.json index 83c6fdf..74913a9 100644 --- a/package.json +++ b/package.json @@ -1,14 +1,15 @@ { - "name": "@hasna/configs", - "version": "0.2.45", - "description": "AI coding agent configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + REST API + Dashboard.", + "name": "@hasna/instructions", + "version": "0.3.0", + "description": "AI coding agent instruction & configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.", "type": "module", "main": "dist/index.js", "types": "dist/index.d.ts", "bin": { - "configs": "dist/cli/index.js", - "configs-mcp": "dist/mcp/index.js", - "configs-serve": "dist/server/index.js" + "instructions": "dist/cli/index.js", + "instructions-mcp": "dist/mcp/index.js", + "instructions-serve": "dist/server/index.js", + "configs-mcp": "dist/mcp/index.js" }, "exports": { ".": { @@ -29,7 +30,11 @@ "scripts": { "clean": "rm -rf dist", "build": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts src/storage.ts --outdir dist --target bun --external pg && tsc --emitDeclarationOnly --outDir dist", + "build:server": "bun run clean && bun build src/cli/index.tsx --outdir dist/cli --target bun --external ink --external react --external chalk --external pg --external @modelcontextprotocol/sdk && bun build src/mcp/index.ts --outdir dist/mcp --target bun --external pg --external @modelcontextprotocol/sdk && bun build src/server/index.ts --outdir dist/server --target bun --external pg && bun build src/index.ts src/storage.ts --outdir dist --target bun --external pg", "build:dashboard": "cd dashboard && bun run build", + "migrate": "bun run src/server/index.ts migrate", + "generate:sdk": "bun run scripts/generate-sdk.ts", + "kit:check": "bunx @hasna/contracts vendor-kit --check", "typecheck": "tsc --noEmit", "test": "bun test", "dev:cli": "bun run src/cli/index.tsx", @@ -37,9 +42,10 @@ "dev:serve": "bun run src/server/index.ts", "seed": "bun run scripts/seed.ts", "prepublishOnly": "bun run build", - "postinstall": "mkdir -p $HOME/.hasna/configs $HOME/.hasna/configs/backups 2>/dev/null || true" + "postinstall": "mkdir -p $HOME/.hasna/instructions $HOME/.hasna/instructions/backups 2>/dev/null || true" }, "keywords": [ + "instructions", "configs", "dotfiles", "agent-config", @@ -58,11 +64,11 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/hasna/open-configs.git" + "url": "git+https://github.com/hasna/instructions.git" }, - "homepage": "https://github.com/hasna/open-configs", + "homepage": "https://github.com/hasna/instructions", "bugs": { - "url": "https://github.com/hasna/open-configs/issues" + "url": "https://github.com/hasna/instructions/issues" }, "engines": { "bun": ">=1.0.0" @@ -70,6 +76,7 @@ "author": "Andrei Hasna ", "license": "Apache-2.0", "dependencies": { + "@hasna/contracts": "^0.4.1", "@hasna/events": "^0.1.6", "@modelcontextprotocol/sdk": "^1.12.1", "chalk": "^5.4.1", diff --git a/scripts/generate-sdk.ts b/scripts/generate-sdk.ts new file mode 100644 index 0000000..1ee3ec7 --- /dev/null +++ b/scripts/generate-sdk.ts @@ -0,0 +1,31 @@ +#!/usr/bin/env bun +/** + * Generate the typed `/v1` SDK client from the serve OpenAPI document. + * + * Source of truth: src/server/openapi.ts (also served at GET /openapi.json). + * Output: sdk/src/v1.generated.ts — a dependency-free typed fetch client. + * + * Usage: bun run scripts/generate-sdk.ts + */ +import { writeFileSync } from "node:fs"; +import { join, dirname } from "node:path"; +import { fileURLToPath } from "node:url"; +import { generateSdkFromOpenApi } from "@hasna/contracts/sdk"; +import { buildV1OpenApiDocument } from "../src/server/openapi.js"; + +const root = join(dirname(fileURLToPath(import.meta.url)), ".."); +const spec = buildV1OpenApiDocument(); +const { code, operations, warnings } = generateSdkFromOpenApi(spec as never, { + className: "InstructionsV1Client", + apiKeyHeader: "x-api-key", +}); + +const header = + "// AUTO-GENERATED by scripts/generate-sdk.ts from src/server/openapi.ts — DO NOT EDIT BY HAND.\n" + + "// Regenerate: bun run scripts/generate-sdk.ts\n\n"; +const outPath = join(root, "sdk/src/v1.generated.ts"); +writeFileSync(outPath, header + code); + +console.log(`Wrote ${outPath}`); +console.log(`Operations: ${operations.map((o) => o.functionName).join(", ")}`); +if (warnings.length) console.log(`Warnings:\n ${warnings.join("\n ")}`); diff --git a/sdk/README.md b/sdk/README.md index de13c71..46da39c 100644 --- a/sdk/README.md +++ b/sdk/README.md @@ -1,17 +1,17 @@ -# @hasna/configs-sdk +# @hasna/instructions-sdk -Zero-dependency TypeScript client for the `@hasna/configs` REST API. Works in Node, Bun, Deno, and browser. +Zero-dependency TypeScript client for the `@hasna/instructions` REST API. Works in Node, Bun, Deno, and browser. ## Install ```bash -bun add @hasna/configs-sdk +bun add @hasna/instructions-sdk ``` ## Quick Start ```typescript -import { ConfigsClient } from "@hasna/configs-sdk"; +import { ConfigsClient } from "@hasna/instructions-sdk"; const client = new ConfigsClient({ baseUrl: "http://localhost:3457" }); // Or: reads CONFIGS_URL env var @@ -77,7 +77,7 @@ const snaps = await client.getSnapshots("claude-claude-md"); ## Part of the @hasna ecosystem -- [`@hasna/configs`](https://npm.im/@hasna/configs) — CLI + MCP + REST server +- [`@hasna/instructions`](https://npm.im/@hasna/instructions) — CLI + MCP + REST server - [`@hasna/todos`](https://npm.im/@hasna/todos) — task management - [`@hasna/mementos`](https://npm.im/@hasna/mementos) — persistent memory - [`@hasna/sessions`](https://npm.im/@hasna/sessions) — session search diff --git a/sdk/bun.lock b/sdk/bun.lock new file mode 100644 index 0000000..1fb166c --- /dev/null +++ b/sdk/bun.lock @@ -0,0 +1,24 @@ +{ + "lockfileVersion": 1, + "configVersion": 1, + "workspaces": { + "": { + "name": "@hasna/instructions-sdk", + "devDependencies": { + "@types/bun": "^1.2.4", + "typescript": "^5.7.3", + }, + }, + }, + "packages": { + "@types/bun": ["@types/bun@1.3.14", "", { "dependencies": { "bun-types": "1.3.14" } }, "sha512-h1hFqFVcvAvD9j9K7ZW7vd82aSA+rTdznZa+5bwvCwqSB1jmmfLcbIWhOLx1/+boy/xmjgCs/OMUL8hRJSmnPw=="], + + "@types/node": ["@types/node@26.0.1", "", { "dependencies": { "undici-types": "~8.3.0" } }, "sha512-fc3KiUoBt6kie0N9bIW3E47vZsuaMf0PM2AaUpLCLT0s/LvX1nxAim6Fc049cNxODPpGm6qRAuUOB86SkRuPQw=="], + + "bun-types": ["bun-types@1.3.14", "", { "dependencies": { "@types/node": "*" } }, "sha512-4N0ig0fEomHt5R0KCFWjovxow98rIoRwKolrYdCcknNwMekCXRnWEUvgu5soYV8QXtVsrUD8B95MBOZGPvr6KQ=="], + + "typescript": ["typescript@5.9.3", "", { "bin": { "tsc": "bin/tsc", "tsserver": "bin/tsserver" } }, "sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw=="], + + "undici-types": ["undici-types@8.3.0", "", {}, "sha512-j375ScV60dom+YkPFIfTLcOiPxkN/buHz5GobjLhixFuANaNs3C9l4GmrWqejgXWJ7BbJcFYpTEUkS1Ge8bpZQ=="], + } +} diff --git a/sdk/package.json b/sdk/package.json index ff068f4..b61230e 100644 --- a/sdk/package.json +++ b/sdk/package.json @@ -1,7 +1,7 @@ { - "name": "@hasna/configs-sdk", - "version": "0.1.3", - "description": "Zero-dependency TypeScript client for @hasna/configs REST API", + "name": "@hasna/instructions-sdk", + "version": "0.2.0", + "description": "Zero-dependency TypeScript client for the @hasna/instructions REST + /v1 API", "type": "module", "main": "dist/index.js", "types": "dist/index.d.ts", diff --git a/sdk/src/index.ts b/sdk/src/index.ts index ce8cd71..afca649 100644 --- a/sdk/src/index.ts +++ b/sdk/src/index.ts @@ -1,4 +1,4 @@ -// @hasna/configs-sdk — zero-dependency TypeScript client for the configs REST API +// @hasna/instructions-sdk — zero-dependency TypeScript client for the instructions REST API // Works in Node, Bun, Deno, and browser environments. export interface Config { @@ -248,3 +248,16 @@ export class ConfigsClient { } export default ConfigsClient; + +// ── Versioned /v1 cloud client ─────────────────────────────────────────────── +// Generated from the serve OpenAPI document (src/server/openapi.ts). +// Regenerate with `bun run scripts/generate-sdk.ts`. +export { InstructionsV1Client, ApiError as InstructionsV1ApiError } from "./v1.generated.js"; +export type { + InstructionsV1ClientOptions, + Config as InstructionsV1Config, + Profile as InstructionsV1Profile, + CreateConfigInput as InstructionsV1CreateConfigInput, + UpdateConfigInput as InstructionsV1UpdateConfigInput, + CreateProfileInput as InstructionsV1CreateProfileInput, +} from "./v1.generated.js"; diff --git a/sdk/src/v1.generated.ts b/sdk/src/v1.generated.ts new file mode 100644 index 0000000..92db009 --- /dev/null +++ b/sdk/src/v1.generated.ts @@ -0,0 +1,179 @@ +// AUTO-GENERATED by scripts/generate-sdk.ts from src/server/openapi.ts — DO NOT EDIT BY HAND. +// Regenerate: bun run scripts/generate-sdk.ts + +// @generated from OpenAPI by @hasna/contracts SDK generator — DO NOT EDIT. +// Source: Instructions V1 API 0.3.0 + +export interface Config { "id"?: string; "name"?: string; "slug"?: string; "kind"?: string; "category"?: string; "agent"?: string; "target_path"?: string | null; "outputs"?: Array>; "format"?: string; "content"?: string; "description"?: string | null; "tags"?: Array; "is_template"?: boolean; "version"?: number; "created_at"?: string; "updated_at"?: string; "synced_at"?: string | null } + +export interface Profile { "id"?: string; "name"?: string; "slug"?: string; "description"?: string | null; "selectors"?: Record; "variables"?: Record; "created_at"?: string; "updated_at"?: string } + +export interface CreateConfigInput { "name": string; "category": string; "content": string; "kind"?: string; "agent"?: string; "target_path"?: string; "format"?: string; "description"?: string; "tags"?: Array; "is_template"?: boolean } + +export interface UpdateConfigInput { "name"?: string; "category"?: string; "agent"?: string; "content"?: string; "description"?: string; "tags"?: Array; "is_template"?: boolean } + +export interface CreateProfileInput { "name": string; "description"?: string; "selectors"?: Record; "variables"?: Record } + +export interface InstructionsV1ClientOptions { + /** Base URL, e.g. process.env.APP_API_URL. */ + baseUrl: string; + /** API key, e.g. process.env.APP_API_KEY. Sent as the 'x-api-key' header. */ + apiKey?: string; + /** Custom fetch (defaults to global fetch). */ + fetch?: typeof fetch; + /** Extra headers merged into every request. */ + headers?: Record; +} + +export class ApiError extends Error { + constructor(readonly status: number, message: string, readonly body: unknown) { + super(message); + this.name = "ApiError"; + } +} + +export class InstructionsV1Client { + private readonly baseUrl: string; + private readonly apiKey: string | undefined; + private readonly fetchImpl: typeof fetch; + private readonly baseHeaders: Record; + + constructor(options: InstructionsV1ClientOptions) { + if (!options.baseUrl) throw new Error("InstructionsV1Client requires a baseUrl."); + this.baseUrl = options.baseUrl.replace(/\/$/, ""); + this.apiKey = options.apiKey; + this.fetchImpl = options.fetch ?? globalThis.fetch; + this.baseHeaders = options.headers ?? {}; + } + + private async request(method: string, path: string, opts: { body?: unknown; query?: Record; init?: RequestInit }): Promise { + const url = new URL(this.baseUrl + path); + if (opts.query) { + for (const [key, value] of Object.entries(opts.query)) { + if (value !== undefined && value !== null) url.searchParams.set(key, String(value)); + } + } + const headers: Record = { Accept: "application/json", ...this.baseHeaders, ...(opts.init?.headers as Record | undefined) }; + if (this.apiKey) headers["x-api-key"] = this.apiKey; + let payload: BodyInit | undefined; + if (opts.body !== undefined) { + headers["Content-Type"] = "application/json"; + payload = JSON.stringify(opts.body); + } + const response = await this.fetchImpl(url.toString(), { ...opts.init, method, headers, body: payload }); + const text = await response.text(); + const data = text ? (() => { try { return JSON.parse(text); } catch { return text; } })() : undefined; + if (!response.ok) { + throw new ApiError(response.status, `${method} ${path} failed: ${response.status}`, data); + } + return data as T; + } + + /** List configs */ + async listConfigs(query?: { "category"?: string; "agent"?: string; "kind"?: string; "search"?: string }, init?: RequestInit): Promise<{ "configs"?: Array; "count"?: number }> { + return this.request("GET", `/v1/configs`, { + body: undefined, + query, + init, + }); + } + + /** Create a config */ + async createConfig(body: CreateConfigInput, init?: RequestInit): Promise<{ "config"?: Config }> { + return this.request("POST", `/v1/configs`, { + body, + query: undefined, + init, + }); + } + + /** Get a config by id or slug */ + async getConfig(id: string, init?: RequestInit): Promise<{ "config"?: Config }> { + return this.request("GET", `/v1/configs/${encodeURIComponent(String(id))}`, { + body: undefined, + query: undefined, + init, + }); + } + + /** Delete a config */ + async deleteConfig(id: string, init?: RequestInit): Promise<{ "deleted"?: boolean; "id"?: string }> { + return this.request("DELETE", `/v1/configs/${encodeURIComponent(String(id))}`, { + body: undefined, + query: undefined, + init, + }); + } + + /** Update a config */ + async updateConfig(id: string, body: UpdateConfigInput, init?: RequestInit): Promise<{ "config"?: Config }> { + return this.request("PATCH", `/v1/configs/${encodeURIComponent(String(id))}`, { + body, + query: undefined, + init, + }); + } + + /** List a config's version snapshots */ + async listSnapshots(id: string, init?: RequestInit): Promise<{ "snapshots"?: Array>; "count"?: number }> { + return this.request("GET", `/v1/configs/${encodeURIComponent(String(id))}/snapshots`, { + body: undefined, + query: undefined, + init, + }); + } + + /** Snapshot a config's current content */ + async createSnapshot(id: string, init?: RequestInit): Promise<{ "snapshot"?: Record }> { + return this.request("POST", `/v1/configs/${encodeURIComponent(String(id))}/snapshots`, { + body: undefined, + query: undefined, + init, + }); + } + + /** List profiles */ + async listProfiles(init?: RequestInit): Promise<{ "profiles"?: Array; "count"?: number }> { + return this.request("GET", `/v1/profiles`, { + body: undefined, + query: undefined, + init, + }); + } + + /** Create a profile */ + async createProfile(body: CreateProfileInput, init?: RequestInit): Promise<{ "profile"?: Profile }> { + return this.request("POST", `/v1/profiles`, { + body, + query: undefined, + init, + }); + } + + /** Get a profile (with its configs) by id or slug */ + async getProfile(id: string, init?: RequestInit): Promise<{ "profile"?: Profile }> { + return this.request("GET", `/v1/profiles/${encodeURIComponent(String(id))}`, { + body: undefined, + query: undefined, + init, + }); + } + + /** Delete a profile */ + async deleteProfile(id: string, init?: RequestInit): Promise<{ "deleted"?: boolean; "id"?: string }> { + return this.request("DELETE", `/v1/profiles/${encodeURIComponent(String(id))}`, { + body: undefined, + query: undefined, + init, + }); + } + + /** Aggregate config counts by category */ + async getStats(init?: RequestInit): Promise<{ "total"?: number }> { + return this.request("GET", `/v1/stats`, { + body: undefined, + query: undefined, + init, + }); + } +} diff --git a/src/cli/index.tsx b/src/cli/index.tsx index 4c076d6..e7bcec8 100644 --- a/src/cli/index.tsx +++ b/src/cli/index.tsx @@ -1530,7 +1530,7 @@ program console.log(chalk.green("✓") + " Feedback saved. Thank you!"); }); -program.version(pkg.version).name("configs"); +program.version(pkg.version).name("instructions"); registerStorageCommands(program); registerEventsCommands(program, { source: "configs" }); program.parse(process.argv); diff --git a/src/generated/storage-kit/.storage-kit-manifest.json b/src/generated/storage-kit/.storage-kit-manifest.json new file mode 100644 index 0000000..2bf0841 --- /dev/null +++ b/src/generated/storage-kit/.storage-kit-manifest.json @@ -0,0 +1,14 @@ +{ + "generator": "@hasna/contracts vendor-kit", + "kitVersion": "0.4.1", + "files": { + "mode.ts": "sha256:b02ba62fdef2dc940068ab52c560ec0df19d451daadc1685ed56d5be841de5ab", + "tls.ts": "sha256:dc04078ca56a8d731080f5e7b508d7e8b4b918db9a6fe9adc6f464d716d2fb82", + "query.ts": "sha256:648a7b8299e6b21100377cbea7410d9909c337ca0235242af4ef89efe404d339", + "pool.ts": "sha256:906422231514a293ff4147a5651850345d4e51a9823305d7d13be62abba9cc5b", + "migrations.ts": "sha256:2c5d1ba736e128a8e6b8e889171c240ebf76ce34b682b8d289e9cd1ae76c13cc", + "health.ts": "sha256:43c5661eb95a4d28544b9ac371797852bb9b15c9be77a900975dc2b70848e56d", + "index.ts": "sha256:80900e5bb7092df6e5875e2a8da50902806cc0a36952bca27cb2cd6deaead1a5", + "README.md": "sha256:0886dbdf751597bfc8f23d2e72f233d6c3516b478925c8118b93d9d06a4eaa66" + } +} diff --git a/src/generated/storage-kit/README.md b/src/generated/storage-kit/README.md new file mode 100644 index 0000000..e03e92c --- /dev/null +++ b/src/generated/storage-kit/README.md @@ -0,0 +1,41 @@ +# Vendored Hasna storage kit + +**Generated — do not edit.** This directory is stamped into the repo by +[`@hasna/contracts`](https://github.com/hasna/contracts) and verified in CI. + +- Regenerate: `bunx @hasna/contracts vendor-kit` +- Verify (CI): `bunx @hasna/contracts vendor-kit --check` — fails on stale or hand-edited files. + +## What it is + +A canonical Postgres storage kit shared across the Hasna fleet: + +| File | Purpose | +| --------------- | ------------------------------------------------------------------- | +| `mode.ts` | Storage-mode + env resolution (`local` \| `cloud`), per the contract | +| `tls.ts` | The one correct TLS approach (libpq `sslmode` semantics + RDS CA) | +| `pool.ts` | `pg.Pool` factory with fleet-standard TLS | +| `query.ts` | Typed query wrapper (`query` / `many` / `get` / `one` / `execute`) | +| `migrations.ts` | `schema_migrations` ledger with sha256 checksums | +| `health.ts` | `checkHealth` (SELECT 1) and `checkReady` (migrated?) probes | + +## PURE REMOTE (Amendment A1) + +Cloud mode = reads **and** writes go directly to cloud Postgres. This kit +contains **no sync engine, no cache-as-mode, and no merge logic**. In `local` +mode there is no Postgres pool at all; SQLite is authoritative. + +## TLS + +`tls.ts` follows libpq `sslmode` semantics exactly: + +- `require` — encrypt, do not verify (RDS default without a bundle) +- `verify-ca` / `verify-full` — encrypt **and** verify against a CA bundle + (mandatory; throws if none is available) + +Point `PGSSLROOTCERT` at the Amazon RDS global bundle to verify: + + +## Peer dependency + +Requires `pg` (and `@types/pg` for TypeScript) in the host repo. diff --git a/src/generated/storage-kit/health.ts b/src/generated/storage-kit/health.ts new file mode 100644 index 0000000..303d570 --- /dev/null +++ b/src/generated/storage-kit/health.ts @@ -0,0 +1,67 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// Health / readiness helpers for the vendored Hasna storage kit. +// +// `checkHealth` proves the database is reachable (a cheap `SELECT 1`). +// `checkReady` additionally proves the schema is migrated up to date, so a +// service can gate its `/ready` probe on pending migrations. These map to the +// contract's health/ready/version response shapes. +// +// PURE REMOTE (Amendment A1): health checks the cloud Postgres directly. + +import type { TypedQueryClient } from "./query.js"; +import { MigrationLedger, type Migration, type MigrationRunnerOptions } from "./migrations.js"; + +export interface HealthResult { + ok: boolean; + /** Round-trip latency of the probe query, in milliseconds. */ + latencyMs: number; + error?: string; +} + +/** Cheap reachability probe: `SELECT 1`. Never throws — reports `ok: false`. */ +export async function checkHealth(client: TypedQueryClient): Promise { + const start = Date.now(); + try { + await client.get<{ ok: number }>("SELECT 1 AS ok"); + return { ok: true, latencyMs: Date.now() - start }; + } catch (error) { + return { + ok: false, + latencyMs: Date.now() - start, + error: error instanceof Error ? error.message : String(error), + }; + } +} + +export interface ReadyResult extends HealthResult { + /** Migration ids that are defined but not yet applied. */ + pendingMigrations: string[]; +} + +/** + * Readiness probe: reachable AND fully migrated. Reports `ok: false` with the + * list of pending migration ids when the schema is behind. + */ +export async function checkReady( + client: TypedQueryClient, + migrations: readonly Migration[], + options: MigrationRunnerOptions = {}, +): Promise { + const start = Date.now(); + try { + const ledger = new MigrationLedger(client, migrations, options); + const result = await ledger.migrate({ dryRun: true }); + const pending = result.plan.filter((item) => item.state === "pending").map((item) => item.migration.id); + return { ok: pending.length === 0, latencyMs: Date.now() - start, pendingMigrations: pending }; + } catch (error) { + return { + ok: false, + latencyMs: Date.now() - start, + pendingMigrations: [], + error: error instanceof Error ? error.message : String(error), + }; + } +} diff --git a/src/generated/storage-kit/index.ts b/src/generated/storage-kit/index.ts new file mode 100644 index 0000000..57c4048 --- /dev/null +++ b/src/generated/storage-kit/index.ts @@ -0,0 +1,23 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// Public surface of the vendored Hasna storage kit. +// +// This is a canonical Postgres storage kit generated by `@hasna/contracts`. +// It is PURE REMOTE per Amendment A1: cloud mode reads AND writes go directly +// to cloud Postgres. There is NO sync engine, NO cache-as-mode, and NO merge +// logic anywhere in this kit. +// +// Do not hand-edit files in this directory — CI verifies them against the +// generator with `contracts vendor-kit --check`. Regenerate with +// `bunx @hasna/contracts vendor-kit`. + +export const KIT_VERSION = "0.4.1"; + +export * from "./mode.js"; +export * from "./tls.js"; +export * from "./query.js"; +export * from "./pool.js"; +export * from "./migrations.js"; +export * from "./health.js"; diff --git a/src/generated/storage-kit/migrations.ts b/src/generated/storage-kit/migrations.ts new file mode 100644 index 0000000..3b5b82c --- /dev/null +++ b/src/generated/storage-kit/migrations.ts @@ -0,0 +1,163 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// Migration-ledger helper for the vendored Hasna storage kit. +// +// A `schema_migrations` ledger with per-migration sha256 checksums, modeled on +// open-loops' storage ledger. Guarantees: +// - each migration runs at most once (idempotent by id), +// - a migration whose SQL changed after being applied is detected as a +// checksum mismatch and refuses to proceed (no silent drift), +// - an applied migration unknown to this binary is detected (downgrade +// guard), +// - `dryRun` reports the plan without mutating anything. +// +// PURE REMOTE (Amendment A1): migrations run against the cloud Postgres. There +// is no local schema and no sync of ledger rows between machines. + +import { createHash } from "node:crypto"; +import type { TypedQueryClient } from "./query.js"; + +/** Default ledger table name. Override per app if a legacy name exists. */ +export const DEFAULT_MIGRATION_LEDGER_TABLE = "schema_migrations"; + +export interface Migration { + readonly id: string; + readonly sql: string; + readonly checksum: string; +} + +export type MigrationState = "already_applied" | "pending"; + +export interface MigrationPlanItem { + readonly migration: Migration; + readonly state: MigrationState; +} + +export interface AppliedMigration { + readonly id: string; + readonly checksum: string; + readonly appliedAt: string; +} + +export interface MigrationResult { + readonly dryRun: boolean; + readonly applied: AppliedMigration[]; + readonly plan: MigrationPlanItem[]; +} + +/** Stable sha256 checksum for a migration's SQL text. */ +export function checksumSql(sql: string): string { + const normalized = sql.trim().replace(/\r\n/g, "\n"); + return `sha256:${createHash("sha256").update(normalized).digest("hex")}`; +} + +/** Freeze a migration definition, computing its checksum from the SQL. */ +export function defineMigration(id: string, sql: string): Migration { + return Object.freeze({ id, sql: sql.trim(), checksum: checksumSql(sql) }); +} + +interface LedgerRow { + id: string; + checksum: string; + applied_at: string | Date; +} + +export interface MigrationRunnerOptions { + ledgerTable?: string; +} + +export class MigrationLedger { + private readonly ledgerTable: string; + + constructor( + private readonly client: TypedQueryClient, + private readonly migrations: readonly Migration[], + options: MigrationRunnerOptions = {}, + ) { + this.ledgerTable = options.ledgerTable ?? DEFAULT_MIGRATION_LEDGER_TABLE; + const seen = new Set(); + for (const migration of migrations) { + if (seen.has(migration.id)) throw new Error(`Duplicate migration id: ${migration.id}`); + seen.add(migration.id); + } + } + + async ensureLedger(): Promise { + await this.client.execute( + `CREATE TABLE IF NOT EXISTS ${this.ledgerTable} ( + id TEXT PRIMARY KEY, + checksum TEXT NOT NULL, + applied_at TIMESTAMPTZ NOT NULL DEFAULT now() + )`, + ); + } + + async listApplied(): Promise { + await this.ensureLedger(); + return this.readApplied(); + } + + private async readApplied(): Promise { + const rows = await this.client.many( + `SELECT id, checksum, applied_at FROM ${this.ledgerTable} ORDER BY id ASC`, + ); + return rows.map((row) => ({ + id: row.id, + checksum: row.checksum, + appliedAt: row.applied_at instanceof Date ? row.applied_at.toISOString() : String(row.applied_at), + })); + } + + /** Compute the migration plan and guard against drift/downgrade. */ + private buildPlan(applied: AppliedMigration[]): MigrationPlanItem[] { + const known = new Set(this.migrations.map((m) => m.id)); + for (const row of applied) { + if (!known.has(row.id)) { + throw new Error(`Applied migration '${row.id}' is not recognized by this build (downgrade?).`); + } + } + const appliedById = new Map(applied.map((row) => [row.id, row])); + for (const migration of this.migrations) { + const existing = appliedById.get(migration.id); + if (existing && existing.checksum !== migration.checksum) { + throw new Error( + `Migration checksum mismatch for '${migration.id}': the SQL changed after it was applied.`, + ); + } + } + return this.migrations.map((migration) => ({ + migration, + state: appliedById.has(migration.id) ? "already_applied" : "pending", + })); + } + + /** Apply all pending migrations. With `dryRun`, report the plan only. */ + async migrate(opts: { dryRun?: boolean } = {}): Promise { + const dryRun = opts.dryRun === true; + await this.ensureLedger(); + const applied = await this.readApplied(); + const plan = this.buildPlan(applied); + if (dryRun) return { dryRun, applied, plan }; + + for (const item of plan) { + if (item.state === "already_applied") continue; + await this.client.execute(item.migration.sql); + await this.client.execute( + `INSERT INTO ${this.ledgerTable} (id, checksum, applied_at) VALUES ($1, $2, now())`, + [item.migration.id, item.migration.checksum], + ); + } + return { dryRun, applied: await this.readApplied(), plan }; + } +} + +/** Convenience: build a ledger and run all pending migrations. */ +export function createMigrationLedger( + client: TypedQueryClient, + migrations: readonly Migration[], + options: MigrationRunnerOptions = {}, +): MigrationLedger { + return new MigrationLedger(client, migrations, options); +} diff --git a/src/generated/storage-kit/mode.ts b/src/generated/storage-kit/mode.ts new file mode 100644 index 0000000..711c533 --- /dev/null +++ b/src/generated/storage-kit/mode.ts @@ -0,0 +1,146 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// Storage-mode resolution for the vendored Hasna storage kit. +// +// Self-contained copy of the @hasna/contracts `mode.ts` contract so the +// generated kit has zero runtime dependency on the contracts package. Keep +// this in lockstep with the contract; regenerate the kit to pick up changes. +// +// Amendment A1 (PURE REMOTE): there are exactly two runtime modes. +// - `local` : SQLite at ~/.hasna//.db is authoritative. +// - `cloud` : reads AND writes go directly to the app's cloud Postgres. +// There is NO sync engine, NO cache-as-mode, and NO hybrid/remote/self_hosted +// runtime. The legacy words `remote`, `hybrid`, and `self_hosted` are accepted +// only as deprecated *aliases* that normalize to `cloud`. + +export const STORAGE_MODES = ["local", "cloud"] as const; +export type StorageMode = (typeof STORAGE_MODES)[number]; + +export const DEPRECATED_STORAGE_MODE_ALIASES = [ + "remote", + "hybrid", + "self_hosted", +] as const; + +export type Env = Record; + +export interface StorageModeNormalization { + mode: StorageMode; + /** The deprecated alias that was normalized to `cloud`, if any. */ + deprecatedAlias: string | null; +} + +/** + * Normalize a raw storage-mode string to the `local | cloud` runtime enum. + * Accepts deprecated aliases (`remote`, `hybrid`, `self_hosted`) and maps them + * to `cloud`. Throws on any other value. + */ +export function normalizeStorageMode(value: string): StorageModeNormalization { + const normalized = value.trim().toLowerCase().replace(/-/g, "_"); + if (normalized === "local") return { mode: "local", deprecatedAlias: null }; + if (normalized === "cloud") return { mode: "cloud", deprecatedAlias: null }; + if ((DEPRECATED_STORAGE_MODE_ALIASES as readonly string[]).includes(normalized)) { + return { mode: "cloud", deprecatedAlias: normalized }; + } + throw new Error(`Unknown storage mode: ${value}. Use local or cloud.`); +} + +/** Upper-snake env token for an app name, e.g. `todos` -> `TODOS`. */ +export function envToken(name: string): string { + return name.toUpperCase().replace(/-/g, "_"); +} + +export interface StorageEnvKeys { + /** `HASNA__STORAGE_MODE` then the optional `_STORAGE_MODE` alias. */ + modeKeys: string[]; + /** `HASNA__DATABASE_URL` then the optional `_DATABASE_URL` alias. */ + databaseUrlKeys: string[]; +} + +/** Resolve the canonical env-key spec for an app's storage config. */ +export function storageEnvKeys(name: string): StorageEnvKeys { + const token = envToken(name); + return { + modeKeys: [`HASNA_${token}_STORAGE_MODE`, `${token}_STORAGE_MODE`], + databaseUrlKeys: [`HASNA_${token}_DATABASE_URL`, `${token}_DATABASE_URL`], + }; +} + +function firstEnv(env: Env, keys: readonly string[]): { key: string; value: string } | null { + for (const key of keys) { + const value = env[key]?.trim(); + if (value) return { key, value }; + } + return null; +} + +export interface StorageModeResolution { + mode: StorageMode; + /** Env key the mode came from, or `"default"`. */ + source: string; + deprecatedAlias: string | null; + databaseUrlPresent: boolean; + /** Env key the database URL came from, or `null`. */ + databaseUrlSource: string | null; + warning: string | null; +} + +/** + * Resolve an app's storage mode from the environment per the contract env spec. + * Precedence: `HASNA__STORAGE_MODE`, then `_STORAGE_MODE`, else + * `local`. Never reads secret values — only detects DATABASE_URL presence. + */ +export function resolveStorageMode(name: string, env: Env = process.env): StorageModeResolution { + const { modeKeys, databaseUrlKeys } = storageEnvKeys(name); + const dbHit = firstEnv(env, databaseUrlKeys); + const databaseUrlPresent = Boolean(dbHit); + const databaseUrlSource = dbHit ? dbHit.key : null; + + const modeHit = firstEnv(env, modeKeys); + if (!modeHit) { + return { + mode: "local", + source: "default", + deprecatedAlias: null, + databaseUrlPresent, + databaseUrlSource, + warning: null, + }; + } + + const { mode, deprecatedAlias } = normalizeStorageMode(modeHit.value); + const warnings: string[] = []; + if (deprecatedAlias) { + warnings.push( + `Deprecated storage mode '${deprecatedAlias}' from ${modeHit.key} is treated as 'cloud'. Set ${modeKeys[0]}=cloud instead.`, + ); + } + if (mode === "cloud" && !databaseUrlPresent) { + warnings.push(`cloud mode needs ${databaseUrlKeys[0]} (PURE REMOTE: reads and writes go to cloud Postgres).`); + } + if (modeHit.key !== modeKeys[0]) { + warnings.push(`Using alias env ${modeHit.key}; the canonical key is ${modeKeys[0]}.`); + } + + return { + mode, + source: modeHit.key, + deprecatedAlias, + databaseUrlPresent, + databaseUrlSource, + warning: warnings.length > 0 ? warnings.join(" ") : null, + }; +} + +/** + * Resolve the database URL value for an app, honoring the canonical then alias + * env keys. Returns `null` when unset. The caller is responsible for never + * logging the returned value. + */ +export function resolveDatabaseUrl(name: string, env: Env = process.env): string | null { + const { databaseUrlKeys } = storageEnvKeys(name); + const hit = firstEnv(env, databaseUrlKeys); + return hit ? hit.value : null; +} diff --git a/src/generated/storage-kit/pool.ts b/src/generated/storage-kit/pool.ts new file mode 100644 index 0000000..491416e --- /dev/null +++ b/src/generated/storage-kit/pool.ts @@ -0,0 +1,101 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// Postgres pool factory for the vendored Hasna storage kit. +// +// The single sanctioned way to open a cloud Postgres connection. TLS is +// resolved through `tls.ts` (one correct approach), and env/mode resolution +// runs through `mode.ts` (the contract). PURE REMOTE (Amendment A1): a Pool is +// only ever built for `cloud` mode; there is no local/hybrid Postgres path. + +import pg from "pg"; +import type { Pool, PoolConfig } from "pg"; +import { resolveStorageMode, resolveDatabaseUrl } from "./mode.js"; +import { resolveTlsConfig, type TlsResolveOptions } from "./tls.js"; +import { createQueryClient, type PoolQueryClient } from "./query.js"; + +export interface CreatePgPoolOptions extends TlsResolveOptions { + connectionString: string; + /** Max clients in the pool. Defaults to pg's default (10). */ + max?: number; + /** Idle client timeout (ms). */ + idleTimeoutMillis?: number; + /** Connection acquisition timeout (ms). */ + connectionTimeoutMillis?: number; + /** Application name reported to Postgres (shows in pg_stat_activity). */ + applicationName?: string; +} + +/** Build a `pg.Pool` with fleet-standard TLS handling. */ +export function createPgPool(options: CreatePgPoolOptions): Pool { + const ssl = resolveTlsConfig(options.connectionString, { + ...(options.ca !== undefined ? { ca: options.ca } : {}), + ...(options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {}), + ...(options.env !== undefined ? { env: options.env } : {}), + }); + + const config: PoolConfig = { connectionString: options.connectionString }; + if (ssl !== undefined) config.ssl = ssl; + if (options.max !== undefined) config.max = options.max; + if (options.idleTimeoutMillis !== undefined) config.idleTimeoutMillis = options.idleTimeoutMillis; + if (options.connectionTimeoutMillis !== undefined) config.connectionTimeoutMillis = options.connectionTimeoutMillis; + if (options.applicationName !== undefined) config.application_name = options.applicationName; + + return new pg.Pool(config); +} + +export interface CreateCloudPoolFromEnvOptions extends TlsResolveOptions { + max?: number; + idleTimeoutMillis?: number; + connectionTimeoutMillis?: number; + applicationName?: string; +} + +export interface CloudPoolFromEnv { + client: PoolQueryClient; + connectionSource: string; +} + +/** + * Resolve mode + database URL from the environment and build a cloud pool. + * + * Throws when the resolved mode is not `cloud` (PURE REMOTE has no Postgres in + * `local` mode) or when the database URL is missing. Never logs the URL. + */ +export function createCloudPoolFromEnv( + appName: string, + options: CreateCloudPoolFromEnvOptions = {}, +): CloudPoolFromEnv { + const env = options.env ?? process.env; + const resolution = resolveStorageMode(appName, env); + if (resolution.mode !== "cloud") { + throw new Error( + `createCloudPoolFromEnv requires ${appName} storage mode 'cloud', got '${resolution.mode}'. ` + + `Set HASNA_${appName.toUpperCase().replace(/-/g, "_")}_STORAGE_MODE=cloud.`, + ); + } + const connectionString = resolveDatabaseUrl(appName, env); + if (!connectionString) { + throw new Error( + `cloud mode for ${appName} needs a database URL. Set ` + + `HASNA_${appName.toUpperCase().replace(/-/g, "_")}_DATABASE_URL.`, + ); + } + const pool = createPgPool({ + connectionString, + ...(options.ca !== undefined ? { ca: options.ca } : {}), + ...(options.caCertPath !== undefined ? { caCertPath: options.caCertPath } : {}), + env, + ...(options.max !== undefined ? { max: options.max } : {}), + ...(options.idleTimeoutMillis !== undefined ? { idleTimeoutMillis: options.idleTimeoutMillis } : {}), + ...(options.connectionTimeoutMillis !== undefined + ? { connectionTimeoutMillis: options.connectionTimeoutMillis } + : {}), + ...(options.applicationName !== undefined ? { applicationName: options.applicationName } : {}), + }); + return { + client: createQueryClient(pool), + connectionSource: resolution.databaseUrlSource ?? "unknown", + }; +} diff --git a/src/generated/storage-kit/query.ts b/src/generated/storage-kit/query.ts new file mode 100644 index 0000000..e59ee76 --- /dev/null +++ b/src/generated/storage-kit/query.ts @@ -0,0 +1,114 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// Typed query wrapper for the vendored Hasna storage kit. +// +// A thin, typed surface over a `pg.Pool` (or any compatible executor). It fixes +// the drift found in the audit where open-knowledge's async adapter dropped the +// single-row `get()` helper, leaving callers to hand-roll `rows[0] ?? null` +// inconsistently. Every kit consumer gets the same small, safe vocabulary: +// +// query -> full result (rows + rowCount) +// many -> T[] (all rows) +// get -> T | null (first row or null) <- restored +// one -> T (exactly one row, else throws) +// execute -> void (DDL / writes where rows are ignored) +// +// PURE REMOTE (Amendment A1): this wrapper reads and writes the same cloud +// Postgres. There is no cache, no local mirror, and no merge — a `get()` hits +// the database every time. + +import type { Pool, PoolClient, QueryResultRow } from "pg"; + +export interface QueryResult { + rows: T[]; + rowCount: number; +} + +/** + * Minimal executor contract. `pg.Pool` and `pg.PoolClient` both satisfy the + * `query` method; the wrapper builds the rest on top so tests can substitute a + * lightweight shim without pulling in a live Postgres. + */ +export interface PgExecutor { + query( + sql: string, + params?: readonly unknown[], + ): Promise<{ rows: T[]; rowCount: number | null }>; +} + +export interface TypedQueryClient { + query(sql: string, params?: readonly unknown[]): Promise>; + many(sql: string, params?: readonly unknown[]): Promise; + /** First row or `null`. Restored here after open-knowledge dropped it. */ + get(sql: string, params?: readonly unknown[]): Promise; + /** Exactly one row; throws if zero or more than one row is returned. */ + one(sql: string, params?: readonly unknown[]): Promise; + execute(sql: string, params?: readonly unknown[]): Promise; +} + +/** Wrap any `PgExecutor` (a Pool, a PoolClient, or a test shim) with the typed vocabulary. */ +export function wrapExecutor(executor: PgExecutor): TypedQueryClient { + return { + async query(sql: string, params?: readonly unknown[]): Promise> { + const result = await executor.query(sql, params); + return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length }; + }, + async many(sql: string, params?: readonly unknown[]): Promise { + const result = await executor.query(sql, params); + return result.rows; + }, + async get(sql: string, params?: readonly unknown[]): Promise { + const result = await executor.query(sql, params); + return result.rows[0] ?? null; + }, + async one(sql: string, params?: readonly unknown[]): Promise { + const result = await executor.query(sql, params); + if (result.rows.length !== 1) { + throw new Error(`Expected exactly one row, got ${result.rows.length}.`); + } + return result.rows[0] as T; + }, + async execute(sql: string, params?: readonly unknown[]): Promise { + await executor.query(sql, params); + }, + }; +} + +export interface PoolQueryClient extends TypedQueryClient { + readonly pool: Pool; + /** Run a callback inside a `BEGIN`/`COMMIT` transaction on a dedicated client. */ + transaction(fn: (client: TypedQueryClient) => Promise): Promise; + close(): Promise; +} + +/** Build a `PoolQueryClient` around a live `pg.Pool`. */ +export function createQueryClient(pool: Pool): PoolQueryClient { + const base = wrapExecutor(pool); + return { + ...base, + pool, + async transaction(fn: (client: TypedQueryClient) => Promise): Promise { + const client: PoolClient = await pool.connect(); + try { + await client.query("BEGIN"); + const result = await fn(wrapExecutor(client)); + await client.query("COMMIT"); + return result; + } catch (error) { + try { + await client.query("ROLLBACK"); + } catch { + // ignore rollback failure; surface the original error + } + throw error; + } finally { + client.release(); + } + }, + async close(): Promise { + await pool.end(); + }, + }; +} diff --git a/src/generated/storage-kit/tls.ts b/src/generated/storage-kit/tls.ts new file mode 100644 index 0000000..5e2ce35 --- /dev/null +++ b/src/generated/storage-kit/tls.ts @@ -0,0 +1,122 @@ +// @generated by @hasna/contracts vendor-kit — DO NOT EDIT. +// KIT_VERSION: 0.4.1 +// Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check + +// TLS resolution for the vendored Hasna storage kit. +// +// ONE correct TLS approach for the whole fleet. This replaces the three drifted +// variants that previously existed across repos, all of which hardcoded +// `{ rejectUnauthorized: false }` for any TLS connection — that silently +// disables certificate verification even when the caller asked for +// `verify-full`, which defeats the point of TLS against a cloud database. +// +// The rule here follows libpq `sslmode` semantics exactly: +// - disable / (no ssl param) -> no TLS (ssl: undefined) +// - prefer / require -> encrypt, do NOT verify the server cert +// (rejectUnauthorized: false) — this matches +// what libpq `require` means and is the AWS +// RDS default when no CA bundle is supplied. +// - verify-ca / verify-full -> encrypt AND verify against a CA bundle +// (rejectUnauthorized: true, ca: ). +// A CA bundle is REQUIRED; we throw if none is +// available so verification can never silently +// downgrade. +// +// The RDS CA bundle is loaded (in priority order) from: +// 1. an explicit `ca` string passed by the caller, +// 2. an explicit `caCertPath` passed by the caller, +// 3. `PGSSLROOTCERT` (libpq's standard env var), +// 4. `NODE_EXTRA_CA_CERTS`. +// Download the Amazon RDS global bundle to one of those paths: +// https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem + +import { readFileSync } from "node:fs"; + +/** The `ssl` field shape accepted by `pg.Pool` / `pg.Client`. */ +export type PgSslConfig = boolean | { rejectUnauthorized: boolean; ca?: string }; + +export interface TlsResolveOptions { + /** Inline CA bundle (PEM). Wins over every other CA source. */ + ca?: string; + /** Path to a CA bundle PEM file, e.g. the Amazon RDS global bundle. */ + caCertPath?: string; + /** Environment used to discover PGSSLROOTCERT / NODE_EXTRA_CA_CERTS. */ + env?: Record; +} + +export type SslMode = "disable" | "prefer" | "require" | "verify-ca" | "verify-full"; + +/** + * Extract the effective `sslmode` from a Postgres connection string. Honors the + * `sslmode` query param and the legacy `ssl=true` boolean. Returns `disable` + * when TLS is not requested. + */ +export function sslModeFromConnectionString(connectionString: string): SslMode { + const queryStart = connectionString.indexOf("?"); + const params = new URLSearchParams(queryStart === -1 ? "" : connectionString.slice(queryStart + 1)); + + const sslmode = params.get("sslmode")?.trim().toLowerCase(); + if (sslmode) { + switch (sslmode) { + case "disable": + case "prefer": + case "require": + case "verify-ca": + case "verify-full": + return sslmode; + case "allow": + return "prefer"; + default: + throw new Error(`Unknown sslmode '${sslmode}' in connection string.`); + } + } + + const ssl = params.get("ssl")?.trim().toLowerCase(); + if (ssl && ["1", "true", "yes", "on", "require"].includes(ssl)) return "require"; + + return "disable"; +} + +function loadCaBundle(options: TlsResolveOptions): string | null { + const env = options.env ?? process.env; + if (options.ca && options.ca.trim()) return options.ca; + const path = options.caCertPath ?? env.PGSSLROOTCERT ?? env.NODE_EXTRA_CA_CERTS; + if (path && path.trim()) return readFileSync(path.trim(), "utf8"); + return null; +} + +/** + * Resolve the `pg` ssl config for a connection string. See the module header + * for the full mode table. Returns `undefined` when TLS should be off. + */ +export function resolveTlsConfig( + connectionString: string, + options: TlsResolveOptions = {}, +): PgSslConfig | undefined { + const mode = sslModeFromConnectionString(connectionString); + + if (mode === "disable" || mode === "prefer") { + // `prefer` still lets pg negotiate TLS opportunistically without a config, + // but we only force TLS at `require` and above. Treat both as no explicit + // ssl config so a plain local Postgres keeps working. + return undefined; + } + + const ca = loadCaBundle(options); + + if (mode === "require") { + // Encrypt but do not verify — libpq `require` semantics. If a CA bundle is + // available we still pin it (strictly better) while keeping verification + // relaxed so a rotated/regional RDS cert cannot hard-fail a `require` DSN. + return ca ? { rejectUnauthorized: false, ca } : { rejectUnauthorized: false }; + } + + // verify-ca / verify-full: verification is mandatory. + if (!ca) { + throw new Error( + `sslmode=${mode} requires a CA bundle. Set PGSSLROOTCERT (or pass caCertPath/ca) to the ` + + `Amazon RDS global bundle: https://truststore.pki.rds.amazonaws.com/global/global-bundle.pem`, + ); + } + return { rejectUnauthorized: true, ca }; +} diff --git a/src/lib/package-version.ts b/src/lib/package-version.ts new file mode 100644 index 0000000..1163008 --- /dev/null +++ b/src/lib/package-version.ts @@ -0,0 +1,30 @@ +/** Resolve this package's version from package.json, with a safe fallback. */ +import { existsSync, readFileSync } from "node:fs"; +import { dirname, join } from "node:path"; +import { fileURLToPath } from "node:url"; + +let cached: string | null = null; + +export function getPackageVersion(): string { + if (cached) return cached; + try { + let dir = dirname(fileURLToPath(import.meta.url)); + for (let i = 0; i < 8; i++) { + const pkgPath = join(dir, "package.json"); + if (existsSync(pkgPath)) { + const pkg = JSON.parse(readFileSync(pkgPath, "utf8")) as { name?: string; version?: string }; + if (pkg.name === "@hasna/instructions" && pkg.version) { + cached = pkg.version; + return cached; + } + } + const parent = dirname(dir); + if (parent === dir) break; + dir = parent; + } + } catch { + // fall through + } + cached = "0.0.0"; + return cached; +} diff --git a/src/server/cloud.ts b/src/server/cloud.ts new file mode 100644 index 0000000..fa81257 --- /dev/null +++ b/src/server/cloud.ts @@ -0,0 +1,172 @@ +/** + * Cloud (A1 pure-remote) service wiring for `instructions-serve`. + * + * Powers the versioned `/v1` API and its API-key auth. Per Amendment A1 the + * serve process reads and writes the shared RDS Postgres DIRECTLY through the + * vendored storage kit — there is NO local sync/cache in the service. + * Everything is lazy: nothing touches Postgres or crypto until the first `/v1` + * (or `/ready`) request, so the local-first CLI/MCP paths keep ZERO cloud deps. + */ +import { verifyApiKey, honoApiKey, type ApiKeyVerifier, ApiKeyStore, type AuthQueryClient } from "@hasna/contracts/auth"; +import { createPgPool, createQueryClient, type PoolQueryClient } from "../generated/storage-kit/index.js"; +import { instructionsSchemaSql } from "../storage/schema.js"; + +export const INSTRUCTIONS_APP_SLUG = "instructions"; + +/** Resolve the remote DATABASE_URL from the supported env vars (priority order). */ +export function resolveCloudDatabaseUrl(env: NodeJS.ProcessEnv = process.env): string | undefined { + return ( + env.HASNA_INSTRUCTIONS_DATABASE_URL || + env.INSTRUCTIONS_DATABASE_URL || + env.DATABASE_URL || + undefined + ); +} + +/** Resolve the HMAC signing secret used to verify API keys. */ +export function resolveSigningSecret(env: NodeJS.ProcessEnv = process.env): string | undefined { + return ( + env.HASNA_INSTRUCTIONS_API_SIGNING_KEY || + env.HASNA_API_SIGNING_KEY || + env.API_KEY_SIGNING_SECRET || + undefined + ); +} + +/** True when this process is configured to serve the cloud `/v1` API. */ +export function isCloudModeEnabled(env: NodeJS.ProcessEnv = process.env): boolean { + return Boolean(resolveCloudDatabaseUrl(env)); +} + +let cachedClient: PoolQueryClient | null = null; +let cachedStore: ApiKeyStore | null = null; +let cachedVerifier: ApiKeyVerifier | null = null; +let schemaEnsured: Promise | null = null; + +function getClient(): PoolQueryClient { + if (cachedClient) return cachedClient; + const url = resolveCloudDatabaseUrl(); + if (!url) { + throw new Error( + "Cloud /v1 requires a remote database URL (HASNA_INSTRUCTIONS_DATABASE_URL / INSTRUCTIONS_DATABASE_URL / DATABASE_URL).", + ); + } + const pool = createPgPool({ + connectionString: url, + max: 6, + idleTimeoutMillis: 30_000, + connectionTimeoutMillis: 15_000, + applicationName: "instructions-serve", + }); + cachedClient = createQueryClient(pool); + return cachedClient; +} + +/** The vendored-kit query client backing every `/v1` handler (pure remote). */ +export function getCloudClient(): PoolQueryClient { + return getClient(); +} + +/** Bridge the kit's typed client to the contracts auth `AuthQueryClient`. */ +function authClient(): AuthQueryClient { + const client = getClient(); + return { + async many>(sql: string, params: readonly unknown[] = []): Promise { + return client.many(sql, params); + }, + async get>(sql: string, params: readonly unknown[] = []): Promise { + return client.get(sql, params); + }, + async execute(sql: string, params: readonly unknown[] = []): Promise { + await client.execute(sql, params); + }, + }; +} + +export function getApiKeyStore(): ApiKeyStore { + if (cachedStore) return cachedStore; + cachedStore = new ApiKeyStore(authClient()); + return cachedStore; +} + +/** + * The framework-agnostic API-key verifier for `/v1`. Tokens are stateless, + * HMAC-signed by the contracts issuer; revocation is checked against the RDS + * `api_keys` table. Fails closed when no signing secret is configured. + */ +export function getCloudVerifier(): ApiKeyVerifier { + if (cachedVerifier) return cachedVerifier; + const signingSecret = resolveSigningSecret(); + if (!signingSecret) { + throw new Error( + "Cloud /v1 auth requires a signing secret (HASNA_INSTRUCTIONS_API_SIGNING_KEY / HASNA_API_SIGNING_KEY / API_KEY_SIGNING_SECRET).", + ); + } + const store = getApiKeyStore(); + cachedVerifier = verifyApiKey({ + app: INSTRUCTIONS_APP_SLUG, + signingSecret, + isRevoked: store.isRevoked, + }); + return cachedVerifier; +} + +/** + * Ensure the remote schema exists: the instructions domain tables plus the + * contracts api-keys table. Idempotent, run once per process and by the + * migration runner. NEVER drops or rewrites existing tables. + */ +export async function ensureCloudSchema(): Promise { + if (schemaEnsured) return schemaEnsured; + schemaEnsured = (async () => { + const client = getClient(); + for (const sql of instructionsSchemaSql()) { + await client.execute(sql); + } + await getApiKeyStore().ensureSchema(); + })(); + return schemaEnsured; +} + +/** + * Build the contracts Hono API-key middleware for `/v1`, gated to the given + * scopes. Cached per scope-set. Fails closed (throws) when unconfigured; the + * caller converts that into a 503 so `/v1` is never an unauthenticated backdoor. + */ +const honoMiddlewareCache = new Map>(); +export function getHonoAuthMiddleware(requiredScopes: string[]): ReturnType { + const key = requiredScopes.join(","); + const cached = honoMiddlewareCache.get(key); + if (cached) return cached; + const signingSecret = resolveSigningSecret(); + if (!signingSecret) { + throw new Error( + "Cloud /v1 auth requires a signing secret (HASNA_INSTRUCTIONS_API_SIGNING_KEY / HASNA_API_SIGNING_KEY / API_KEY_SIGNING_SECRET).", + ); + } + const store = getApiKeyStore(); + const mw = honoApiKey({ + app: INSTRUCTIONS_APP_SLUG, + signingSecret, + isRevoked: store.isRevoked, + requiredScopes, + }); + honoMiddlewareCache.set(key, mw); + return mw; +} + +/** Cheap readiness probe: round-trips a trivial query to RDS. */ +export async function pingCloud(): Promise { + const client = getClient(); + const row = await client.get<{ ok: number }>("SELECT 1 AS ok"); + return row?.ok === 1; +} + +/** Test/shutdown helper. */ +export async function closeCloud(): Promise { + if (cachedClient) await cachedClient.close(); + cachedClient = null; + cachedStore = null; + cachedVerifier = null; + schemaEnsured = null; +} diff --git a/src/server/index.ts b/src/server/index.ts index e605d43..29a8c58 100644 --- a/src/server/index.ts +++ b/src/server/index.ts @@ -11,8 +11,42 @@ import { syncFromDir, syncToDir } from "../lib/sync-dir.js"; import { detectMachineContext, resolveProfileVariables } from "../lib/machine.js"; import type { ConfigAgent, ConfigCategory, ConfigFormat, ConfigKind } from "../types/index.js"; import { mountMcpHttpRoutes } from "../mcp/http.js"; +import { getPackageVersion } from "../lib/package-version.js"; +import { handleV1Request } from "./v1.js"; +import { + getHonoAuthMiddleware, + isCloudModeEnabled, + pingCloud, + resolveCloudDatabaseUrl, + ensureCloudSchema, + closeCloud, +} from "./cloud.js"; +import { buildV1OpenApiDocument } from "./openapi.js"; + +// ── One-shot schema migration (used by the ECS migration task) ─────────────── +// instructions-serve migrate | instructions db migrate +if (process.argv.includes("migrate")) { + if (!resolveCloudDatabaseUrl()) { + console.error("migrate: no database URL (HASNA_INSTRUCTIONS_DATABASE_URL / INSTRUCTIONS_DATABASE_URL / DATABASE_URL)"); + process.exit(2); + } + console.log("migrate: connecting…"); + await pingCloud(); + console.log("migrate: applying schema (instructions tables + api_keys)…"); + await ensureCloudSchema(); + console.log("migrate: done"); + await closeCloud(); + process.exit(0); +} -const PORT = Number(process.env["CONFIGS_PORT"] ?? 3457); +if (process.argv.includes("--version") || process.argv.includes("-V")) { + console.log(getPackageVersion()); + process.exit(0); +} + +const PORT = Number( + process.env["PORT"] ?? process.env["INSTRUCTIONS_PORT"] ?? process.env["CONFIGS_PORT"] ?? 3457, +); function pickFields(obj: T, fields?: string): Partial | T { if (!fields) return obj; @@ -24,6 +58,52 @@ function pickFields(obj: T, fields?: string): Partial | T { const app = new Hono(); app.use("*", cors()); +// ── Service surface probes (unauthenticated): /health /ready /version ───────── +function serviceMode(): "cloud" | "local" { + return isCloudModeEnabled() ? "cloud" : "local"; +} + +app.get("/health", (c) => c.json({ status: "ok", version: getPackageVersion(), mode: serviceMode(), name: "instructions" })); + +app.get("/version", (c) => c.json({ status: "ok", version: getPackageVersion(), mode: serviceMode(), name: "instructions" })); + +app.get("/ready", async (c) => { + const version = getPackageVersion(); + const mode = serviceMode(); + if (mode === "cloud") { + try { + await pingCloud(); + } catch (e) { + return c.json({ status: "unavailable", version, mode, error: (e as Error).message }, 503); + } + } + return c.json({ status: "ready", version, mode }); +}); + +// ── OpenAPI document (unauthenticated; the SDK's source of truth) ───────────── +app.get("/openapi.json", (c) => c.json(buildV1OpenApiDocument())); +app.get("/v1/openapi.json", (c) => c.json(buildV1OpenApiDocument())); + +// ── Versioned cloud API (/v1/*): A1 pure-remote, contracts API-key auth ─────── +// Auth is the contracts `honoApiKey` middleware; reads need `instructions:read`, +// writes need `instructions:write` (an `instructions:*` key satisfies both). +app.use("/v1/*", async (c, next) => { + const isWrite = c.req.method !== "GET" && c.req.method !== "HEAD"; + let mw; + try { + mw = getHonoAuthMiddleware([isWrite ? "instructions:write" : "instructions:read"]); + } catch (e) { + // Fail closed: /v1 is never an unauthenticated backdoor. + return c.json({ error: (e as Error).message }, 503); + } + return mw(c, next); +}); + +app.all("/v1/*", async (c) => { + const res = await handleV1Request(c.req.raw, new URL(c.req.url)); + return res ?? c.json({ error: "Not found" }, 404); +}); + // ── Status + Stats ──────────────────────────────────────────────────────────── app.get("/api/stats", (c) => c.json(getConfigStats())); @@ -378,6 +458,6 @@ if (dashDir) { }); } -const HOST = process.env["CONFIGS_HOST"] ?? "localhost"; -console.log(`configs-serve listening on http://${HOST}:${PORT}${dashDir ? " (dashboard: /" : " (no dashboard found)"}`); +const HOST = process.env["HOST"] ?? process.env["INSTRUCTIONS_HOST"] ?? process.env["CONFIGS_HOST"] ?? "localhost"; +console.log(`instructions-serve listening on http://${HOST}:${PORT} (mode: ${serviceMode()})${dashDir ? " (dashboard: /)" : " (no dashboard)"}`); export default { port: PORT, hostname: HOST, fetch: app.fetch }; diff --git a/src/server/openapi.ts b/src/server/openapi.ts new file mode 100644 index 0000000..9686a22 --- /dev/null +++ b/src/server/openapi.ts @@ -0,0 +1,263 @@ +/** + * OpenAPI 3.1 document for the versioned `/v1` cloud API. This is the SINGLE + * source of truth the typed SDK is generated from (see scripts/generate-sdk.ts) + * and is served live at `GET /openapi.json` and `GET /v1/openapi.json`. + */ +import { getPackageVersion } from "../lib/package-version.js"; + +const configSchema = { + type: "object", + properties: { + id: { type: "string" }, + name: { type: "string" }, + slug: { type: "string" }, + kind: { type: "string" }, + category: { type: "string" }, + agent: { type: "string" }, + target_path: { type: "string", nullable: true }, + outputs: { type: "array", items: { type: "object" } }, + format: { type: "string" }, + content: { type: "string" }, + description: { type: "string", nullable: true }, + tags: { type: "array", items: { type: "string" } }, + is_template: { type: "boolean" }, + version: { type: "number" }, + created_at: { type: "string" }, + updated_at: { type: "string" }, + synced_at: { type: "string", nullable: true }, + }, +} as const; + +const profileSchema = { + type: "object", + properties: { + id: { type: "string" }, + name: { type: "string" }, + slug: { type: "string" }, + description: { type: "string", nullable: true }, + selectors: { type: "object" }, + variables: { type: "object" }, + created_at: { type: "string" }, + updated_at: { type: "string" }, + }, +} as const; + +export function buildV1OpenApiDocument(version = getPackageVersion()) { + return { + openapi: "3.1.0", + info: { + title: "Instructions V1 API", + version, + description: + "Versioned cloud API for @hasna/instructions (A1 pure-remote). Authenticate with an API key via the `x-api-key` header or `Authorization: Bearer `. Reads require `instructions:read`, writes require `instructions:write` (an `instructions:*` key satisfies both).", + }, + servers: [{ url: "/" }], + components: { + securitySchemes: { + apiKey: { type: "apiKey", in: "header", name: "x-api-key" }, + }, + schemas: { + Config: configSchema, + Profile: profileSchema, + CreateConfigInput: { + type: "object", + required: ["name", "category", "content"], + properties: { + name: { type: "string" }, + category: { type: "string" }, + content: { type: "string" }, + kind: { type: "string" }, + agent: { type: "string" }, + target_path: { type: "string" }, + format: { type: "string" }, + description: { type: "string" }, + tags: { type: "array", items: { type: "string" } }, + is_template: { type: "boolean" }, + }, + }, + UpdateConfigInput: { + type: "object", + properties: { + name: { type: "string" }, + category: { type: "string" }, + agent: { type: "string" }, + content: { type: "string" }, + description: { type: "string" }, + tags: { type: "array", items: { type: "string" } }, + is_template: { type: "boolean" }, + }, + }, + CreateProfileInput: { + type: "object", + required: ["name"], + properties: { + name: { type: "string" }, + description: { type: "string" }, + selectors: { type: "object" }, + variables: { type: "object" }, + }, + }, + }, + }, + security: [{ apiKey: [] }], + paths: { + "/v1/configs": { + get: { + operationId: "listConfigs", + summary: "List configs", + parameters: [ + { name: "category", in: "query", schema: { type: "string" } }, + { name: "agent", in: "query", schema: { type: "string" } }, + { name: "kind", in: "query", schema: { type: "string" } }, + { name: "search", in: "query", schema: { type: "string" } }, + ], + responses: { + "200": { + content: { + "application/json": { + schema: { + type: "object", + properties: { + configs: { type: "array", items: { $ref: "#/components/schemas/Config" } }, + count: { type: "number" }, + }, + }, + }, + }, + }, + }, + }, + post: { + operationId: "createConfig", + summary: "Create a config", + requestBody: { + required: true, + content: { "application/json": { schema: { $ref: "#/components/schemas/CreateConfigInput" } } }, + }, + responses: { + "201": { + content: { + "application/json": { + schema: { type: "object", properties: { config: { $ref: "#/components/schemas/Config" } } }, + }, + }, + }, + }, + }, + }, + "/v1/configs/{id}": { + get: { + operationId: "getConfig", + summary: "Get a config by id or slug", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + responses: { + "200": { + content: { + "application/json": { + schema: { type: "object", properties: { config: { $ref: "#/components/schemas/Config" } } }, + }, + }, + }, + }, + }, + patch: { + operationId: "updateConfig", + summary: "Update a config", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + requestBody: { + required: true, + content: { "application/json": { schema: { $ref: "#/components/schemas/UpdateConfigInput" } } }, + }, + responses: { + "200": { + content: { + "application/json": { + schema: { type: "object", properties: { config: { $ref: "#/components/schemas/Config" } } }, + }, + }, + }, + }, + }, + delete: { + operationId: "deleteConfig", + summary: "Delete a config", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + responses: { + "200": { + content: { + "application/json": { + schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } }, + }, + }, + }, + }, + }, + }, + "/v1/configs/{id}/snapshots": { + get: { + operationId: "listSnapshots", + summary: "List a config's version snapshots", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { snapshots: { type: "array", items: { type: "object" } }, count: { type: "number" } } } } } } }, + }, + post: { + operationId: "createSnapshot", + summary: "Snapshot a config's current content", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + responses: { "201": { content: { "application/json": { schema: { type: "object", properties: { snapshot: { type: "object" } } } } } } }, + }, + }, + "/v1/profiles": { + get: { + operationId: "listProfiles", + summary: "List profiles", + responses: { + "200": { + content: { + "application/json": { + schema: { + type: "object", + properties: { + profiles: { type: "array", items: { $ref: "#/components/schemas/Profile" } }, + count: { type: "number" }, + }, + }, + }, + }, + }, + }, + }, + post: { + operationId: "createProfile", + summary: "Create a profile", + requestBody: { + required: true, + content: { "application/json": { schema: { $ref: "#/components/schemas/CreateProfileInput" } } }, + }, + responses: { "201": { content: { "application/json": { schema: { type: "object", properties: { profile: { $ref: "#/components/schemas/Profile" } } } } } } }, + }, + }, + "/v1/profiles/{id}": { + get: { + operationId: "getProfile", + summary: "Get a profile (with its configs) by id or slug", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { profile: { $ref: "#/components/schemas/Profile" } } } } } } }, + }, + delete: { + operationId: "deleteProfile", + summary: "Delete a profile", + parameters: [{ name: "id", in: "path", required: true, schema: { type: "string" } }], + responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { deleted: { type: "boolean" }, id: { type: "string" } } } } } } }, + }, + }, + "/v1/stats": { + get: { + operationId: "getStats", + summary: "Aggregate config counts by category", + responses: { "200": { content: { "application/json": { schema: { type: "object", properties: { total: { type: "number" } } } } } } }, + }, + }, + }, + }; +} diff --git a/src/server/v1.ts b/src/server/v1.ts new file mode 100644 index 0000000..ae129cb --- /dev/null +++ b/src/server/v1.ts @@ -0,0 +1,166 @@ +/** + * Versioned `/v1` HTTP API for `instructions-serve` (A1 pure-remote). + * + * Every handler goes through the vendored storage kit client (`getCloudClient`) + * which reads/writes the shared RDS directly. Auth is enforced by the contracts + * API-key verifier: reads require `instructions:read`, writes require + * `instructions:write` (an `instructions:*` key satisfies both). This is a real + * wrapper over the configs/profiles store — there are NO stubs; unknown routes + * 404 and unimplemented operations throw a clear error. + */ +import { ConfigNotFoundError, ProfileNotFoundError } from "../types/index.js"; +import { getCloudClient, ensureCloudSchema } from "./cloud.js"; +import * as store from "../storage/cloud-store.js"; + +const JSON_HEADERS = { "Content-Type": "application/json" } as const; + +function json(body: unknown, status = 200): Response { + return new Response(JSON.stringify(body), { status, headers: JSON_HEADERS }); +} + +function errorResponse(status: number, message: string, extra?: Record): Response { + return json({ error: message, ...(extra ?? {}) }, status); +} + +async function readJson(req: Request): Promise { + try { + const text = await req.text(); + if (!text) return {} as T; + return JSON.parse(text) as T; + } catch { + return null; + } +} + +/** + * Handle a `/v1/*` request. Authentication + read/write scope enforcement is + * performed UPSTREAM by the contracts `honoApiKey` middleware (see + * server/index.ts); by the time this runs the caller is an authorized principal. + * Returns `null` when the path is not a `/v1` route so the caller can fall + * through to other handlers. + */ +export async function handleV1Request(req: Request, url: URL): Promise { + const path = url.pathname; + if (path !== "/v1" && !path.startsWith("/v1/")) return null; + + const method = req.method.toUpperCase(); + + // Schema is idempotently ensured on the first authenticated request. + try { + await ensureCloudSchema(); + } catch (e) { + return errorResponse(503, `database unavailable: ${(e as Error).message}`); + } + const client = getCloudClient(); + + const segments = path.split("/").filter(Boolean); // ["v1", resource, id?, action?] + const resource = segments[1]; + const id = segments[2] ? decodeURIComponent(segments[2]) : undefined; + const action = segments[3]; + + try { + // ── /v1/configs ── + if (resource === "configs") { + if (!id) { + if (method === "GET") { + const filter = { + ...(url.searchParams.get("category") ? { category: url.searchParams.get("category") as never } : {}), + ...(url.searchParams.get("agent") ? { agent: url.searchParams.get("agent") as never } : {}), + ...(url.searchParams.get("kind") ? { kind: url.searchParams.get("kind") as never } : {}), + ...(url.searchParams.get("search") ? { search: url.searchParams.get("search")! } : {}), + }; + const configs = await store.listConfigs(client, filter); + return json({ configs, count: configs.length }); + } + if (method === "POST") { + const body = await readJson[1]>(req); + if (!body) return errorResponse(400, "invalid JSON body"); + try { + const config = await store.createConfig(client, body); + return json({ config }, 201); + } catch (e) { + return errorResponse(400, (e as Error).message); + } + } + return errorResponse(405, `method ${method} not allowed on /v1/configs`); + } + // /v1/configs/:id/snapshots + if (action === "snapshots") { + if (method === "GET") { + const snapshots = await store.listSnapshots(client, id); + return json({ snapshots, count: snapshots.length }); + } + if (method === "POST") { + const snapshot = await store.createSnapshot(client, id); + return json({ snapshot }, 201); + } + return errorResponse(405, `method ${method} not allowed on /v1/configs/:id/snapshots`); + } + if (action) return errorResponse(404, `unknown config action: ${action}`); + if (method === "GET") { + const config = await store.getConfig(client, id); + return json({ config }); + } + if (method === "PATCH" || method === "PUT") { + const body = await readJson[2]>(req); + if (!body) return errorResponse(400, "invalid JSON body"); + const config = await store.updateConfig(client, id, body); + return json({ config }); + } + if (method === "DELETE") { + await store.deleteConfig(client, id); + return json({ deleted: true, id }); + } + return errorResponse(405, `method ${method} not allowed on /v1/configs/:id`); + } + + // ── /v1/profiles ── + if (resource === "profiles") { + if (!id) { + if (method === "GET") { + const profiles = await store.listProfiles(client); + return json({ profiles, count: profiles.length }); + } + if (method === "POST") { + const body = await readJson[1]>(req); + if (!body) return errorResponse(400, "invalid JSON body"); + try { + const profile = await store.createProfile(client, body); + return json({ profile }, 201); + } catch (e) { + return errorResponse(400, (e as Error).message); + } + } + return errorResponse(405, `method ${method} not allowed on /v1/profiles`); + } + if (method === "GET") { + const profile = await store.getProfile(client, id); + const configs = await store.getProfileConfigs(client, id); + return json({ profile: { ...profile, configs } }); + } + if (method === "PATCH" || method === "PUT") { + const body = await readJson[2]>(req); + if (!body) return errorResponse(400, "invalid JSON body"); + const profile = await store.updateProfile(client, id, body); + return json({ profile }); + } + if (method === "DELETE") { + await store.deleteProfile(client, id); + return json({ deleted: true, id }); + } + return errorResponse(405, `method ${method} not allowed on /v1/profiles/:id`); + } + + // ── /v1/stats ── + if (resource === "stats" && method === "GET") { + return json(await store.getConfigStats(client)); + } + + return errorResponse(404, `unknown /v1 resource: ${resource ?? "(root)"}`); + } catch (e) { + if (e instanceof ConfigNotFoundError || e instanceof ProfileNotFoundError) { + return errorResponse(404, e.message); + } + return errorResponse(500, (e as Error).message || "internal error"); + } +} diff --git a/src/status.ts b/src/status.ts index 054d600..e2ce09a 100644 --- a/src/status.ts +++ b/src/status.ts @@ -7,8 +7,8 @@ import { listMachines } from "./db/machines.js"; import { expandPath } from "./lib/apply.js"; import { redactContent, scanSecrets, type RedactFormat } from "./lib/redact.js"; -const PACKAGE_NAME = "@hasna/configs"; -const PACKAGE_VERSION = "0.2.38"; +const PACKAGE_NAME = "@hasna/instructions"; +const PACKAGE_VERSION = "0.3.0"; type ActiveDbEnv = "HASNA_CONFIGS_DB_PATH" | "CONFIGS_DB_PATH" | null; type DatabaseKind = "memory" | "file"; diff --git a/src/storage/cloud-store.ts b/src/storage/cloud-store.ts new file mode 100644 index 0000000..622b428 --- /dev/null +++ b/src/storage/cloud-store.ts @@ -0,0 +1,398 @@ +/** + * Pure-remote (Amendment A1) Postgres store for the instructions `/v1` API. + * + * Every function reads/writes the shared RDS Postgres DIRECTLY through the + * vendored storage kit's typed query client — there is NO local cache or sync + * in the service. This is a real wrapper over the configs/profiles domain + * (slug uniqueness, optimistic version bumps, JSONB (de)serialization); it + * throws clear errors rather than returning fake no-ops. + */ +import { randomUUID } from "node:crypto"; +import type { TypedQueryClient } from "../generated/storage-kit/index.js"; +import { + ConfigNotFoundError, + ProfileNotFoundError, + type Config, + type ConfigFilter, + type ConfigOutput, + type ConfigSnapshot, + type CreateConfigInput, + type CreateProfileInput, + type Profile, + type ProfileSelector, + type ProfileVariables, + type UpdateConfigInput, + type UpdateProfileInput, +} from "../types/index.js"; + +function slugify(name: string): string { + return name + .toLowerCase() + .replace(/[^a-z0-9]+/g, "-") + .replace(/^-|-$/g, ""); +} + +function toIso(value: unknown): string { + if (value instanceof Date) return value.toISOString(); + return value == null ? "" : String(value); +} + +/** Parse a value the pg driver may hand back either as JSON string or object. */ +function asArray(value: unknown): T[] { + if (Array.isArray(value)) return value as T[]; + if (typeof value === "string") { + try { + const p = JSON.parse(value); + return Array.isArray(p) ? (p as T[]) : []; + } catch { + return []; + } + } + return []; +} + +function asObject(value: unknown): T { + if (value && typeof value === "object" && !Array.isArray(value)) return value as T; + if (typeof value === "string") { + try { + const p = JSON.parse(value); + return p && typeof p === "object" ? (p as T) : ({} as T); + } catch { + return {} as T; + } + } + return {} as T; +} + +interface ConfigDbRow { + id: string; + name: string; + slug: string; + kind: string; + category: string; + agent: string; + target_path: string | null; + outputs: unknown; + format: string; + content: string; + description: string | null; + tags: unknown; + is_template: boolean; + version: number; + created_at: unknown; + updated_at: unknown; + synced_at: unknown; +} + +function rowToConfig(row: ConfigDbRow): Config { + return { + id: row.id, + name: row.name, + slug: row.slug, + kind: row.kind as Config["kind"], + category: row.category as Config["category"], + agent: row.agent as Config["agent"], + target_path: row.target_path, + outputs: asArray(row.outputs), + format: row.format as Config["format"], + content: row.content, + description: row.description, + tags: asArray(row.tags), + is_template: Boolean(row.is_template), + version: Number(row.version), + created_at: toIso(row.created_at), + updated_at: toIso(row.updated_at), + synced_at: row.synced_at == null ? null : toIso(row.synced_at), + }; +} + +async function uniqueSlug( + client: TypedQueryClient, + name: string, + excludeId?: string, +): Promise { + const base = slugify(name) || "config"; + let slug = base; + let i = 1; + // Bounded loop; a handful of collisions at most in practice. + for (let attempt = 0; attempt < 1000; attempt++) { + const existing = await client.get<{ id: string }>( + "SELECT id FROM configs WHERE slug = $1", + [slug], + ); + if (!existing || existing.id === excludeId) return slug; + slug = `${base}-${i++}`; + } + throw new Error(`could not allocate a unique slug for '${name}'`); +} + +// ── Configs ──────────────────────────────────────────────────────────────── + +export async function listConfigs( + client: TypedQueryClient, + filter: ConfigFilter = {}, +): Promise { + const conditions: string[] = []; + const params: unknown[] = []; + const add = (sql: string, value: unknown) => { + params.push(value); + conditions.push(sql.replace("$?", `$${params.length}`)); + }; + if (filter.category) add("category = $?", filter.category); + if (filter.agent) add("agent = $?", filter.agent); + if (filter.kind) add("kind = $?", filter.kind); + if (filter.is_template !== undefined) add("is_template = $?", filter.is_template); + if (filter.search) { + params.push(`%${filter.search}%`); + const p = `$${params.length}`; + conditions.push(`(name ILIKE ${p} OR description ILIKE ${p} OR content ILIKE ${p})`); + } + const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : ""; + const rows = await client.many( + `SELECT * FROM configs ${where} ORDER BY category, name`, + params, + ); + return rows.map(rowToConfig); +} + +export async function getConfig(client: TypedQueryClient, idOrSlug: string): Promise { + const row = await client.get( + "SELECT * FROM configs WHERE id = $1 OR slug = $1", + [idOrSlug], + ); + if (!row) throw new ConfigNotFoundError(idOrSlug); + return rowToConfig(row); +} + +export async function createConfig( + client: TypedQueryClient, + input: CreateConfigInput, +): Promise { + if (!input.name || !input.name.trim()) throw new Error("name is required"); + if (!input.category) throw new Error("category is required"); + const id = randomUUID(); + const slug = await uniqueSlug(client, input.name); + await client.execute( + `INSERT INTO configs + (id, name, slug, kind, category, agent, target_path, outputs, format, content, description, tags, is_template, version, created_at, updated_at) + VALUES ($1,$2,$3,$4,$5,$6,$7,$8::jsonb,$9,$10,$11,$12::jsonb,$13,1,now(),now())`, + [ + id, + input.name, + slug, + input.kind ?? "file", + input.category, + input.agent ?? "global", + input.target_path ?? null, + JSON.stringify(input.outputs ?? []), + input.format ?? "text", + input.content ?? "", + input.description ?? null, + JSON.stringify(input.tags ?? []), + input.is_template ?? false, + ], + ); + return getConfig(client, id); +} + +export async function updateConfig( + client: TypedQueryClient, + idOrSlug: string, + input: UpdateConfigInput, +): Promise { + const existing = await getConfig(client, idOrSlug); + const sets: string[] = ["updated_at = now()", "version = version + 1"]; + const params: unknown[] = []; + const set = (col: string, value: unknown, cast = "") => { + params.push(value); + sets.push(`${col} = $${params.length}${cast}`); + }; + if (input.name !== undefined) { + set("name", input.name); + set("slug", await uniqueSlug(client, input.name, existing.id)); + } + if (input.kind !== undefined) set("kind", input.kind); + if (input.category !== undefined) set("category", input.category); + if (input.agent !== undefined) set("agent", input.agent); + if (input.target_path !== undefined) set("target_path", input.target_path); + if (input.outputs !== undefined) set("outputs", JSON.stringify(input.outputs), "::jsonb"); + if (input.format !== undefined) set("format", input.format); + if (input.content !== undefined) set("content", input.content); + if (input.description !== undefined) set("description", input.description); + if (input.tags !== undefined) set("tags", JSON.stringify(input.tags), "::jsonb"); + if (input.is_template !== undefined) set("is_template", input.is_template); + if (input.synced_at !== undefined) set("synced_at", input.synced_at, "::timestamptz"); + + params.push(existing.id); + await client.execute( + `UPDATE configs SET ${sets.join(", ")} WHERE id = $${params.length}`, + params, + ); + return getConfig(client, existing.id); +} + +export async function deleteConfig(client: TypedQueryClient, idOrSlug: string): Promise { + const existing = await getConfig(client, idOrSlug); + await client.execute("DELETE FROM configs WHERE id = $1", [existing.id]); +} + +export async function getConfigStats(client: TypedQueryClient): Promise> { + const rows = await client.many<{ category: string; count: string | number }>( + "SELECT category, COUNT(*)::int AS count FROM configs GROUP BY category", + ); + const stats: Record = { total: 0 }; + for (const row of rows) { + const n = Number(row.count); + stats[row.category] = n; + stats.total += n; + } + return stats; +} + +// ── Snapshots ──────────────────────────────────────────────────────────────── + +export async function createSnapshot( + client: TypedQueryClient, + idOrSlug: string, +): Promise { + const config = await getConfig(client, idOrSlug); + const id = randomUUID(); + await client.execute( + `INSERT INTO config_snapshots (id, config_id, content, version, created_at) + VALUES ($1,$2,$3,$4,now())`, + [id, config.id, config.content, config.version], + ); + const row = await client.get<{ id: string; config_id: string; content: string; version: number; created_at: unknown }>( + "SELECT id, config_id, content, version, created_at FROM config_snapshots WHERE id = $1", + [id], + ); + if (!row) throw new Error("snapshot insert failed"); + return { id: row.id, config_id: row.config_id, content: row.content, version: Number(row.version), created_at: toIso(row.created_at) }; +} + +export async function listSnapshots( + client: TypedQueryClient, + idOrSlug: string, +): Promise { + const config = await getConfig(client, idOrSlug); + const rows = await client.many<{ id: string; config_id: string; content: string; version: number; created_at: unknown }>( + "SELECT id, config_id, content, version, created_at FROM config_snapshots WHERE config_id = $1 ORDER BY version DESC", + [config.id], + ); + return rows.map((r) => ({ id: r.id, config_id: r.config_id, content: r.content, version: Number(r.version), created_at: toIso(r.created_at) })); +} + +// ── Profiles ───────────────────────────────────────────────────────────────── + +interface ProfileDbRow { + id: string; + name: string; + slug: string; + description: string | null; + selectors: unknown; + variables: unknown; + created_at: unknown; + updated_at: unknown; +} + +function rowToProfile(row: ProfileDbRow): Profile { + return { + id: row.id, + name: row.name, + slug: row.slug, + description: row.description, + selectors: asObject(row.selectors), + variables: asObject(row.variables), + created_at: toIso(row.created_at), + updated_at: toIso(row.updated_at), + }; +} + +export async function listProfiles(client: TypedQueryClient): Promise { + const rows = await client.many("SELECT * FROM profiles ORDER BY name"); + return rows.map(rowToProfile); +} + +export async function getProfile(client: TypedQueryClient, idOrSlug: string): Promise { + const row = await client.get( + "SELECT * FROM profiles WHERE id = $1 OR slug = $1", + [idOrSlug], + ); + if (!row) throw new ProfileNotFoundError(idOrSlug); + return rowToProfile(row); +} + +export async function getProfileConfigs( + client: TypedQueryClient, + idOrSlug: string, +): Promise { + const profile = await getProfile(client, idOrSlug); + const rows = await client.many( + `SELECT c.* FROM configs c + JOIN profile_configs pc ON pc.config_id = c.id + WHERE pc.profile_id = $1 + ORDER BY pc.sort_order`, + [profile.id], + ); + return rows.map(rowToConfig); +} + +export async function createProfile( + client: TypedQueryClient, + input: CreateProfileInput, +): Promise { + if (!input.name || !input.name.trim()) throw new Error("name is required"); + const id = randomUUID(); + const slug = await uniqueProfileSlug(client, input.name); + await client.execute( + `INSERT INTO profiles (id, name, slug, description, selectors, variables, created_at, updated_at) + VALUES ($1,$2,$3,$4,$5::jsonb,$6::jsonb,now(),now())`, + [id, input.name, slug, input.description ?? null, JSON.stringify(input.selectors ?? {}), JSON.stringify(input.variables ?? {})], + ); + return getProfile(client, id); +} + +async function uniqueProfileSlug( + client: TypedQueryClient, + name: string, + excludeId?: string, +): Promise { + const base = slugify(name) || "profile"; + let slug = base; + let i = 1; + for (let attempt = 0; attempt < 1000; attempt++) { + const existing = await client.get<{ id: string }>("SELECT id FROM profiles WHERE slug = $1", [slug]); + if (!existing || existing.id === excludeId) return slug; + slug = `${base}-${i++}`; + } + throw new Error(`could not allocate a unique slug for profile '${name}'`); +} + +export async function updateProfile( + client: TypedQueryClient, + idOrSlug: string, + input: UpdateProfileInput, +): Promise { + const existing = await getProfile(client, idOrSlug); + const sets: string[] = ["updated_at = now()"]; + const params: unknown[] = []; + const set = (col: string, value: unknown, cast = "") => { + params.push(value); + sets.push(`${col} = $${params.length}${cast}`); + }; + if (input.name !== undefined) { + set("name", input.name); + set("slug", await uniqueProfileSlug(client, input.name, existing.id)); + } + if (input.description !== undefined) set("description", input.description); + if (input.selectors !== undefined) set("selectors", JSON.stringify(input.selectors), "::jsonb"); + if (input.variables !== undefined) set("variables", JSON.stringify(input.variables), "::jsonb"); + params.push(existing.id); + await client.execute(`UPDATE profiles SET ${sets.join(", ")} WHERE id = $${params.length}`, params); + return getProfile(client, existing.id); +} + +export async function deleteProfile(client: TypedQueryClient, idOrSlug: string): Promise { + const existing = await getProfile(client, idOrSlug); + await client.execute("DELETE FROM profiles WHERE id = $1", [existing.id]); +} diff --git a/src/storage/schema.ts b/src/storage/schema.ts new file mode 100644 index 0000000..a20f979 --- /dev/null +++ b/src/storage/schema.ts @@ -0,0 +1,68 @@ +/** + * Canonical Postgres schema for the instructions cloud (A1 pure-remote) DB. + * + * These statements are idempotent (`CREATE ... IF NOT EXISTS`) and NEVER drop + * or rewrite existing tables — safe to run against a populated database. The + * same DDL is committed under `migrations/0001_instructions.sql` for + * transparency; the migration runner and the serve process both apply it via + * this single, tested code path. + */ + +/** Ordered list of schema statements for the instructions domain tables. */ +export function instructionsSchemaSql(): string[] { + return [ + `CREATE TABLE IF NOT EXISTS configs ( + id TEXT PRIMARY KEY, + name TEXT NOT NULL, + slug TEXT NOT NULL UNIQUE, + kind TEXT NOT NULL DEFAULT 'file', + category TEXT NOT NULL, + agent TEXT NOT NULL DEFAULT 'global', + target_path TEXT, + outputs JSONB NOT NULL DEFAULT '[]'::jsonb, + format TEXT NOT NULL DEFAULT 'text', + content TEXT NOT NULL DEFAULT '', + description TEXT, + tags JSONB NOT NULL DEFAULT '[]'::jsonb, + is_template BOOLEAN NOT NULL DEFAULT false, + version INTEGER NOT NULL DEFAULT 1, + created_at TIMESTAMPTZ NOT NULL DEFAULT now(), + updated_at TIMESTAMPTZ NOT NULL DEFAULT now(), + synced_at TIMESTAMPTZ + )`, + `CREATE INDEX IF NOT EXISTS configs_category_idx ON configs (category)`, + `CREATE INDEX IF NOT EXISTS configs_agent_idx ON configs (agent)`, + `CREATE TABLE IF NOT EXISTS config_snapshots ( + id TEXT PRIMARY KEY, + config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE, + content TEXT NOT NULL, + version INTEGER NOT NULL, + created_at TIMESTAMPTZ NOT NULL DEFAULT now() + )`, + `CREATE INDEX IF NOT EXISTS config_snapshots_config_idx ON config_snapshots (config_id)`, + `CREATE TABLE IF NOT EXISTS profiles ( + id TEXT PRIMARY KEY, + name TEXT NOT NULL, + slug TEXT NOT NULL UNIQUE, + description TEXT, + selectors JSONB NOT NULL DEFAULT '{}'::jsonb, + variables JSONB NOT NULL DEFAULT '{}'::jsonb, + created_at TIMESTAMPTZ NOT NULL DEFAULT now(), + updated_at TIMESTAMPTZ NOT NULL DEFAULT now() + )`, + `CREATE TABLE IF NOT EXISTS profile_configs ( + profile_id TEXT NOT NULL REFERENCES profiles(id) ON DELETE CASCADE, + config_id TEXT NOT NULL REFERENCES configs(id) ON DELETE CASCADE, + sort_order INTEGER NOT NULL DEFAULT 0, + PRIMARY KEY (profile_id, config_id) + )`, + `CREATE TABLE IF NOT EXISTS machines ( + id TEXT PRIMARY KEY, + hostname TEXT NOT NULL UNIQUE, + os TEXT, + arch TEXT, + last_applied_at TIMESTAMPTZ, + created_at TIMESTAMPTZ NOT NULL DEFAULT now() + )`, + ]; +} From 3a1f812249e4e205456a6e61baad592bb40d5a58 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Mon, 6 Jul 2026 09:10:45 -0700 Subject: [PATCH 4/5] chore: align @hasna/contracts to 0.4.2 and re-vendor storage kit (#4) Bump @hasna/contracts ^0.4.1 -> ^0.4.2 (published latest), re-vendor the storage kit (KIT_VERSION 0.4.2; vendored code functionally identical), and sync hasna.contract.json kitVersion. Release 0.3.1. Verify: kit:check ok (v0.4.2), tsc --noEmit clean, bun test 265 pass / 0 fail. --- bun.lock | 4 ++-- hasna.contract.json | 9 +++++++-- package.json | 4 ++-- .../storage-kit/.storage-kit-manifest.json | 16 ++++++++-------- src/generated/storage-kit/health.ts | 2 +- src/generated/storage-kit/index.ts | 4 ++-- src/generated/storage-kit/migrations.ts | 2 +- src/generated/storage-kit/mode.ts | 2 +- src/generated/storage-kit/pool.ts | 2 +- src/generated/storage-kit/query.ts | 2 +- src/generated/storage-kit/tls.ts | 2 +- 11 files changed, 27 insertions(+), 22 deletions(-) diff --git a/bun.lock b/bun.lock index c2cb78d..5fd8ad1 100644 --- a/bun.lock +++ b/bun.lock @@ -5,7 +5,7 @@ "": { "name": "@hasna/configs", "dependencies": { - "@hasna/contracts": "^0.4.1", + "@hasna/contracts": "0.4.2", "@hasna/events": "^0.1.6", "@modelcontextprotocol/sdk": "^1.12.1", "chalk": "^5.4.1", @@ -27,7 +27,7 @@ "packages": { "@alcalzone/ansi-tokenize": ["@alcalzone/ansi-tokenize@0.1.3", "", { "dependencies": { "ansi-styles": "^6.2.1", "is-fullwidth-code-point": "^4.0.0" } }, "sha512-3yWxPTq3UQ/FY9p1ErPxIyfT64elWaMvM9lIHnaqpyft63tkxodF5aUElYHrdisWve5cETkh1+KBw1yJuW0aRw=="], - "@hasna/contracts": ["@hasna/contracts@0.4.1", "", { "dependencies": { "commander": "^13.1.0", "zod": "^3.25.76" }, "bin": { "contracts": "dist/cli/index.js", "contracts-cli": "dist/cli/index.js" } }, "sha512-oubsu1FFyVvxbt5d+85iBXEK6M81ZsaeODycoQGZuFNqQ3ecfXFujlQz3cL+NHwHJPVmy4wBGLPcaXcRTjO/IQ=="], + "@hasna/contracts": ["@hasna/contracts@0.4.2", "", { "dependencies": { "commander": "^13.1.0", "zod": "^3.25.76" }, "bin": { "contracts": "dist/cli/index.js", "contracts-cli": "dist/cli/index.js" } }, "sha512-xD7ZWQXR+AjYAJVpaMsQ+8V0SABiJSKVeI0B1WbPByYeGz6daDtgyZ6c3q0c2S6uzIEtUxlGHPundr675636ew=="], "@hasna/events": ["@hasna/events@0.1.8", "", { "dependencies": { "commander": "^13.1.0" }, "bin": { "events": "dist/cli/index.js", "hasna-events": "dist/cli/index.js" } }, "sha512-NftaVpt/Rlc81DVdyIliEqa77SB/jtOFP/5YHTNeH8c7MNM999G8noWHXWMTIeZ59NviqnxFgnHK8t/NQMH9qQ=="], diff --git a/hasna.contract.json b/hasna.contract.json index 78d9376..5abc5b6 100644 --- a/hasna.contract.json +++ b/hasna.contract.json @@ -3,9 +3,14 @@ "name": "instructions", "class": "service", "contractVersion": "v1", - "kitVersion": "0.4.1", + "kitVersion": "0.4.2", "description": "AI coding agent instruction & configuration manager (formerly @hasna/configs). CLI + MCP + HTTP API (instructions-serve) + generated SDK. Cloud mode (HASNA_INSTRUCTIONS_DATABASE_URL set) is PURE REMOTE per Amendment A1: the serve process reads/writes the shared cloud Postgres directly with API-key auth via @hasna/contracts. The MCP server keeps the legacy name 'configs' aliased for the existing fleet.", - "bins": ["instructions", "instructions-mcp", "instructions-serve", "configs-mcp"], + "bins": [ + "instructions", + "instructions-mcp", + "instructions-serve", + "configs-mcp" + ], "storage": { "mode": "local", "envPrefix": "HASNA_INSTRUCTIONS_", diff --git a/package.json b/package.json index 74913a9..47142c5 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@hasna/instructions", - "version": "0.3.0", + "version": "0.3.1", "description": "AI coding agent instruction & configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.", "type": "module", "main": "dist/index.js", @@ -76,7 +76,7 @@ "author": "Andrei Hasna ", "license": "Apache-2.0", "dependencies": { - "@hasna/contracts": "^0.4.1", + "@hasna/contracts": "0.4.2", "@hasna/events": "^0.1.6", "@modelcontextprotocol/sdk": "^1.12.1", "chalk": "^5.4.1", diff --git a/src/generated/storage-kit/.storage-kit-manifest.json b/src/generated/storage-kit/.storage-kit-manifest.json index 2bf0841..1632b30 100644 --- a/src/generated/storage-kit/.storage-kit-manifest.json +++ b/src/generated/storage-kit/.storage-kit-manifest.json @@ -1,14 +1,14 @@ { "generator": "@hasna/contracts vendor-kit", - "kitVersion": "0.4.1", + "kitVersion": "0.4.2", "files": { - "mode.ts": "sha256:b02ba62fdef2dc940068ab52c560ec0df19d451daadc1685ed56d5be841de5ab", - "tls.ts": "sha256:dc04078ca56a8d731080f5e7b508d7e8b4b918db9a6fe9adc6f464d716d2fb82", - "query.ts": "sha256:648a7b8299e6b21100377cbea7410d9909c337ca0235242af4ef89efe404d339", - "pool.ts": "sha256:906422231514a293ff4147a5651850345d4e51a9823305d7d13be62abba9cc5b", - "migrations.ts": "sha256:2c5d1ba736e128a8e6b8e889171c240ebf76ce34b682b8d289e9cd1ae76c13cc", - "health.ts": "sha256:43c5661eb95a4d28544b9ac371797852bb9b15c9be77a900975dc2b70848e56d", - "index.ts": "sha256:80900e5bb7092df6e5875e2a8da50902806cc0a36952bca27cb2cd6deaead1a5", + "mode.ts": "sha256:b9be6a682be031f4857102cf3f1d5e6fa3b9fbde96bab03bf783d708657bf04e", + "tls.ts": "sha256:5508941d2485b69fa3aa9dccbfbf062dce6ca5c546ede8610f28bf1c7f36bd1c", + "query.ts": "sha256:0733c23227076fe8e96e6237e15cd20bcf411c979e385687eef377eb129b4176", + "pool.ts": "sha256:60d25bfc95dbe9a87a02f057634b9fe51f7602651685cedec99275e9173e4ba3", + "migrations.ts": "sha256:3d723e9616215fb1ed01526d13206d8abed5607ba32e6c651f55900fa89bc860", + "health.ts": "sha256:f3dcf5d9c066bcd0012b87b0efd7706773dd98e140d927ef2f3ec30cd6a86e29", + "index.ts": "sha256:fcea7fe22fbe391a9d82ccf339775b111ea964d056cdf01f99843adb39092a2b", "README.md": "sha256:0886dbdf751597bfc8f23d2e72f233d6c3516b478925c8118b93d9d06a4eaa66" } } diff --git a/src/generated/storage-kit/health.ts b/src/generated/storage-kit/health.ts index 303d570..26ee883 100644 --- a/src/generated/storage-kit/health.ts +++ b/src/generated/storage-kit/health.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // Health / readiness helpers for the vendored Hasna storage kit. diff --git a/src/generated/storage-kit/index.ts b/src/generated/storage-kit/index.ts index 57c4048..1a3dc9b 100644 --- a/src/generated/storage-kit/index.ts +++ b/src/generated/storage-kit/index.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // Public surface of the vendored Hasna storage kit. @@ -13,7 +13,7 @@ // generator with `contracts vendor-kit --check`. Regenerate with // `bunx @hasna/contracts vendor-kit`. -export const KIT_VERSION = "0.4.1"; +export const KIT_VERSION = "0.4.2"; export * from "./mode.js"; export * from "./tls.js"; diff --git a/src/generated/storage-kit/migrations.ts b/src/generated/storage-kit/migrations.ts index 3b5b82c..9537d05 100644 --- a/src/generated/storage-kit/migrations.ts +++ b/src/generated/storage-kit/migrations.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // Migration-ledger helper for the vendored Hasna storage kit. diff --git a/src/generated/storage-kit/mode.ts b/src/generated/storage-kit/mode.ts index 711c533..1b5a83f 100644 --- a/src/generated/storage-kit/mode.ts +++ b/src/generated/storage-kit/mode.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // Storage-mode resolution for the vendored Hasna storage kit. diff --git a/src/generated/storage-kit/pool.ts b/src/generated/storage-kit/pool.ts index 491416e..84f6e45 100644 --- a/src/generated/storage-kit/pool.ts +++ b/src/generated/storage-kit/pool.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // Postgres pool factory for the vendored Hasna storage kit. diff --git a/src/generated/storage-kit/query.ts b/src/generated/storage-kit/query.ts index e59ee76..f96ee41 100644 --- a/src/generated/storage-kit/query.ts +++ b/src/generated/storage-kit/query.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // Typed query wrapper for the vendored Hasna storage kit. diff --git a/src/generated/storage-kit/tls.ts b/src/generated/storage-kit/tls.ts index 5e2ce35..3b4e0b8 100644 --- a/src/generated/storage-kit/tls.ts +++ b/src/generated/storage-kit/tls.ts @@ -1,5 +1,5 @@ // @generated by @hasna/contracts vendor-kit — DO NOT EDIT. -// KIT_VERSION: 0.4.1 +// KIT_VERSION: 0.4.2 // Regenerate: bunx @hasna/contracts vendor-kit Verify (CI): contracts vendor-kit --check // TLS resolution for the vendored Hasna storage kit. From 79b172e10de45ad24b38cefe0840485718711b90 Mon Sep 17 00:00:00 2001 From: Andrei Hasna Date: Tue, 7 Jul 2026 01:23:20 -0700 Subject: [PATCH 5/5] feat(storage): route config/profile CRUD to cloud /v1 API in self_hosted mode (#5) When HASNA_INSTRUCTIONS_API_URL + HASNA_INSTRUCTIONS_API_KEY are both set, the CLI routes config/profile record reads+writes to https:///v1 with a bearer key (no local SQLite, no DSN on the client). Unset -> local SQLite (untouched). Setting only one var throws (no silent local drift). getDatabase() now throws in cloud mode so any not-yet-wired command fails loudly instead of silently reading the empty local DB. - src/data/config-store.ts: ConfigStore (Local + Cloud HTTP) + resolver - src/cli/index.tsx: list/show/add/delete + profile list/show/create/delete + whoami route via the async store; new 'delete ' config command - src/db/database.ts: cloud-mode guard on getDatabase() - src/data/config-store.test.ts: resolver + CRUD mapping coverage (13 tests) --- package.json | 2 +- src/cli/index.tsx | 56 ++++-- src/data/config-store.test.ts | 177 +++++++++++++++++ src/data/config-store.ts | 348 ++++++++++++++++++++++++++++++++++ src/db/database.ts | 11 ++ 5 files changed, 578 insertions(+), 16 deletions(-) create mode 100644 src/data/config-store.test.ts create mode 100644 src/data/config-store.ts diff --git a/package.json b/package.json index 47142c5..e1d9288 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "@hasna/instructions", - "version": "0.3.1", + "version": "0.3.2", "description": "AI coding agent instruction & configuration manager — store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.", "type": "module", "main": "dist/index.js", diff --git a/src/cli/index.tsx b/src/cli/index.tsx index e7bcec8..6ba05ae 100644 --- a/src/cli/index.tsx +++ b/src/cli/index.tsx @@ -22,6 +22,7 @@ import { planSessionRender, resolveSessionPath, sourceFromConfig, sourceFromFile import { ensurePlatformProfiles } from "../lib/platform-profiles.js"; import { ensureProjectDashboardStandardConfig } from "../lib/project-dashboard-standard.js"; import { getConfigsStatus } from "../status.js"; +import { resolveConfigStore, isCloudMode } from "../data/config-store.js"; import { registerStorageCommands } from "./storage.js"; import { DEFAULT_LIST_LIMIT, paginate, parseLimit, truncateMiddle, truncateText } from "../lib/compact-output.js"; import type { ConfigAgent, ConfigCategory, ConfigFormat, ConfigKind, Profile, ProfileSelector, ProfileVariables } from "../types/index.js"; @@ -221,7 +222,7 @@ program .option("--cursor ", "zero-based pagination cursor for human output") .action(async (opts) => { const fmt = opts.json ? "json" : opts.verbose ? "table" : opts.brief ? "compact" : opts.format; - const configs = listConfigs({ + const configs = await resolveConfigStore().listConfigs({ category: opts.category as ConfigCategory, agent: opts.agent as ConfigAgent, kind: opts.kind as ConfigKind, @@ -256,7 +257,7 @@ program .option("-f, --format ", "output format: table|json|content", "table") .action(async (id, opts) => { try { - const c = getConfig(id); + const c = await resolveConfigStore().getConfig(id); if (opts.format === "json") { console.log(JSON.stringify(c, null, 2)); return; } if (opts.format === "content") { console.log(c.content); return; } console.log(fmtConfig(c, "table")); @@ -290,7 +291,7 @@ program const { content, redacted, isTemplate } = redactContent(rawContent, fmt as "shell" | "json" | "toml" | "ini" | "markdown" | "text"); const targetPath = abs.startsWith(homedir()) ? abs.replace(homedir(), "~") : abs; const name = opts.name || filePath.split("/").pop()!; - const config = createConfig({ + const config = await resolveConfigStore().createConfig({ name, kind: (opts.kind as ConfigKind) ?? "file", category: (opts.category as ConfigCategory) ?? detectCategory(abs), @@ -308,6 +309,25 @@ program } }); +// ── delete ───────────────────────────────────────────────────────────────────── +program + .command("delete ") + .alias("rm") + .description("Delete a config record (by id or slug)") + .option("--json", "output result as JSON") + .action(async (id, opts) => { + try { + const store = resolveConfigStore(); + const config = await store.getConfig(id); + await store.deleteConfig(config.id); + if (opts.json) { console.log(JSON.stringify({ deleted: true, id: config.id, slug: config.slug }, null, 2)); return; } + console.log(chalk.green("✓") + ` Deleted: ${chalk.bold(config.name)} ${chalk.dim(`(${config.slug})`)}`); + } catch (e) { + console.error(chalk.red(e instanceof Error ? e.message : String(e))); + process.exit(1); + } + }); + // ── apply ───────────────────────────────────────────────────────────────────── program .command("apply ") @@ -467,10 +487,13 @@ program .command("whoami") .description("Show setup summary") .action(async () => { - const dbPath = process.env["CONFIGS_DB_PATH"] || join(homedir(), ".hasna", "configs", "configs.db"); - const stats = getConfigStats(); + const store = resolveConfigStore(); + const dbPath = isCloudMode() + ? `${process.env["HASNA_INSTRUCTIONS_API_URL"]}/v1 (self_hosted)` + : process.env["CONFIGS_DB_PATH"] || join(homedir(), ".hasna", "configs", "configs.db"); + const stats = await store.getConfigStats(); console.log(chalk.bold("@hasna/configs") + chalk.dim(" v" + pkg.version)); - console.log(chalk.cyan("DB:") + " " + dbPath); + console.log(chalk.cyan(isCloudMode() ? "API:" : "DB:") + " " + dbPath); console.log(chalk.cyan("Total configs:") + " " + (stats["total"] || 0)); console.log(); console.log(chalk.bold("By category:")); @@ -479,7 +502,7 @@ program const count = stats[cat] || 0; if (count > 0) console.log(` ${chalk.cyan(cat.padEnd(16))} ${count}`); } - const profiles = listProfiles(); + const profiles = await store.listProfiles(); if (profiles.length > 0) { console.log(); console.log(chalk.bold("Profiles:") + chalk.dim(` (${profiles.length})`)); @@ -499,7 +522,8 @@ profileCmd.command("list").description("List all profiles") .option("--cursor ", "zero-based pagination cursor for human output") .action(async (opts) => { const fmt = opts.json ? "json" : opts.verbose ? "table" : opts.brief ? "compact" : opts.format; - const profiles = listProfiles(); + const store = resolveConfigStore(); + const profiles = await store.listProfiles(); if (profiles.length === 0) { console.log(chalk.dim("No profiles.")); return; } if (fmt === "json") { console.log(JSON.stringify(profiles, null, 2)); return; } const page = paginate(profiles, { limit: opts.limit, cursor: opts.cursor }); @@ -507,10 +531,10 @@ profileCmd.command("list").description("List all profiles") for (const p of page.items) { if (fmt === "compact") { const selectorSummary = formatProfileSelectorSummary(p); - console.log(`${pad(p.slug, 28)} ${pad(String(getProfileConfigs(p.id).length), 8)} ${pad(selectorSummary || "-", 36)} ${Object.keys(p.variables).length}`); + console.log(`${pad(p.slug, 28)} ${pad(String((await store.getProfileConfigs(p.id)).length), 8)} ${pad(selectorSummary || "-", 36)} ${Object.keys(p.variables).length}`); continue; } - const configs = getProfileConfigs(p.id); + const configs = await store.getProfileConfigs(p.id); console.log(`${chalk.bold(p.name)} ${chalk.dim(`(${p.slug})`)} — ${configs.length} config(s)`); if (p.description) console.log(` ${chalk.dim(p.description)}`); const selectorSummary = formatProfileSelectorSummary(p); @@ -528,7 +552,7 @@ profileCmd.command("create ").description("Create a new profile") .option("--hostname ", "comma-separated hostname matchers") .option("--var ", "set profile variable(s) as KEY=VALUE") .action(async (name, opts) => { - const p = createProfile({ + const p = await resolveConfigStore().createProfile({ name, description: opts.description, selectors: parseProfileSelectors(opts), @@ -542,8 +566,9 @@ profileCmd.command("show ").description("Show profile and its configs") .option("--cursor ", "zero-based pagination cursor") .action(async (id, opts) => { try { - const p = getProfile(id); - const configs = getProfileConfigs(id); + const store = resolveConfigStore(); + const p = await store.getProfile(id); + const configs = await store.getProfileConfigs(id); console.log(chalk.bold(p.name) + chalk.dim(` (${p.slug})`)); if (p.description) console.log(chalk.dim(p.description)); const selectorSummary = formatProfileSelectorSummary(p); @@ -624,8 +649,9 @@ profileCmd.command("resolve").description("Resolve the matching machine-aware pr profileCmd.command("delete ").description("Delete a profile").action(async (id) => { try { - const p = getProfile(id); - deleteProfile(id); + const store = resolveConfigStore(); + const p = await store.getProfile(id); + await store.deleteProfile(p.id); console.log(chalk.green("✓") + ` Deleted profile: ${p.name}`); } catch (e) { console.error(chalk.red(e instanceof Error ? e.message : String(e))); process.exit(1); } }); diff --git a/src/data/config-store.test.ts b/src/data/config-store.test.ts new file mode 100644 index 0000000..f95fed8 --- /dev/null +++ b/src/data/config-store.test.ts @@ -0,0 +1,177 @@ +import { afterEach, describe, expect, test } from "bun:test"; +import { + CloudConfigStore, + CloudHttpError, + LocalConfigStore, + isCloudMode, + resolveCloudConfig, + resolveConfigStore, +} from "./config-store.js"; + +interface RecordedCall { + url: string; + method: string; + headers: Record; + body: unknown; +} + +function mockFetch(handler: (call: RecordedCall) => { status?: number; json?: unknown }) { + const calls: RecordedCall[] = []; + const original = globalThis.fetch; + globalThis.fetch = (async (input: string | URL | Request, init?: RequestInit) => { + const headers: Record = {}; + const h = init?.headers as Record | undefined; + if (h) for (const [k, v] of Object.entries(h)) headers[k] = v; + const call: RecordedCall = { + url: String(input), + method: (init?.method ?? "GET").toUpperCase(), + headers, + body: init?.body ? JSON.parse(String(init.body)) : undefined, + }; + calls.push(call); + const { status = 200, json } = handler(call); + return new Response(json === undefined ? "" : JSON.stringify(json), { + status, + headers: { "Content-Type": "application/json" }, + }); + }) as typeof fetch; + return { + calls, + restore() { + globalThis.fetch = original; + }, + }; +} + +const CONFIG = { apiUrl: "https://instructions.hasna.xyz", apiKey: "test-key-xyz" }; +const SAMPLE = { + id: "cfg-1", + name: "Demo", + slug: "demo", + kind: "file", + category: "rules", + agent: "global", + target_path: null, + outputs: [], + format: "markdown", + content: "hello", + description: null, + tags: [], + is_template: false, + version: 1, + created_at: "", + updated_at: "", + synced_at: null, +}; + +let active: { restore(): void } | undefined; +afterEach(() => { + active?.restore(); + active = undefined; + delete process.env["HASNA_INSTRUCTIONS_API_URL"]; + delete process.env["HASNA_INSTRUCTIONS_API_KEY"]; +}); + +describe("resolveCloudConfig", () => { + test("null when neither set", () => { + expect(resolveCloudConfig({})).toBeNull(); + expect(isCloudMode({})).toBe(false); + }); + test("config when both set", () => { + const env = { HASNA_INSTRUCTIONS_API_URL: "https://x", HASNA_INSTRUCTIONS_API_KEY: "k" }; + expect(resolveCloudConfig(env)).toEqual({ apiUrl: "https://x", apiKey: "k" }); + expect(isCloudMode(env)).toBe(true); + }); + test("throws when only one set (no silent local drift)", () => { + expect(() => resolveCloudConfig({ HASNA_INSTRUCTIONS_API_URL: "https://x" })).toThrow(); + expect(() => resolveCloudConfig({ HASNA_INSTRUCTIONS_API_KEY: "k" })).toThrow(); + }); +}); + +describe("resolveConfigStore", () => { + test("local when env unset", () => { + expect(resolveConfigStore({})).toBeInstanceOf(LocalConfigStore); + }); + test("cloud when both env vars set", () => { + const store = resolveConfigStore({ + HASNA_INSTRUCTIONS_API_URL: "https://instructions.hasna.xyz", + HASNA_INSTRUCTIONS_API_KEY: "k", + }); + expect(store).toBeInstanceOf(CloudConfigStore); + expect(store.mode).toBe("cloud"); + }); +}); + +describe("CloudConfigStore CRUD mapping", () => { + test("listConfigs -> GET /v1/configs with bearer + query", async () => { + const m = mockFetch(() => ({ json: { configs: [SAMPLE], count: 1 } })); + active = m; + const store = new CloudConfigStore(CONFIG); + const configs = await store.listConfigs({ category: "rules" as never }); + expect(configs).toHaveLength(1); + expect(m.calls[0].url).toBe("https://instructions.hasna.xyz/v1/configs?category=rules"); + expect(m.calls[0].headers["Authorization"]).toBe("Bearer test-key-xyz"); + }); + + test("getConfig -> GET /v1/configs/:id; 404 -> ConfigNotFoundError", async () => { + const m = mockFetch((c) => + c.url.endsWith("/missing") ? { status: 404, json: { error: "not found" } } : { json: { config: SAMPLE } }, + ); + active = m; + const store = new CloudConfigStore(CONFIG); + expect((await store.getConfig("demo")).slug).toBe("demo"); + await expect(store.getConfig("missing")).rejects.toThrow(); + }); + + test("createConfig -> POST with Idempotency-Key", async () => { + const m = mockFetch(() => ({ status: 201, json: { config: SAMPLE } })); + active = m; + const store = new CloudConfigStore(CONFIG); + const created = await store.createConfig({ name: "Demo", category: "rules" as never, content: "hello" }); + expect(created.id).toBe("cfg-1"); + expect(m.calls[0].method).toBe("POST"); + expect(m.calls[0].headers["Idempotency-Key"]).toBeTruthy(); + }); + + test("updateConfig -> PATCH /v1/configs/:id", async () => { + const m = mockFetch(() => ({ json: { config: { ...SAMPLE, content: "new" } } })); + active = m; + const store = new CloudConfigStore(CONFIG); + const updated = await store.updateConfig("demo", { content: "new" }); + expect(updated.content).toBe("new"); + expect(m.calls[0].method).toBe("PATCH"); + expect(m.calls[0].body).toEqual({ content: "new" }); + }); + + test("deleteConfig -> DELETE; 404 -> throws", async () => { + const m = mockFetch((c) => (c.url.endsWith("/gone") ? { status: 404 } : { json: { deleted: true } })); + active = m; + const store = new CloudConfigStore(CONFIG); + await store.deleteConfig("demo"); + expect(m.calls[0].method).toBe("DELETE"); + await expect(store.deleteConfig("gone")).rejects.toThrow(); + }); + + test("getConfigStats -> GET /v1/stats", async () => { + const m = mockFetch(() => ({ json: { total: 3, rules: 3 } })); + active = m; + const store = new CloudConfigStore(CONFIG); + expect(await store.getConfigStats()).toEqual({ total: 3, rules: 3 }); + expect(m.calls[0].url).toBe("https://instructions.hasna.xyz/v1/stats"); + }); + + test("non-2xx surfaces CloudHttpError", async () => { + const m = mockFetch(() => ({ status: 401, json: { error: "unauthorized" } })); + active = m; + const store = new CloudConfigStore(CONFIG); + await expect(store.listConfigs()).rejects.toBeInstanceOf(CloudHttpError); + }); + + test("getProfileConfigs -> GET /v1/profiles/:id embeds configs", async () => { + const m = mockFetch(() => ({ json: { profile: { id: "p1", name: "P", slug: "p", configs: [SAMPLE] } } })); + active = m; + const store = new CloudConfigStore(CONFIG); + const configs = await store.getProfileConfigs("p"); + expect(configs).toHaveLength(1); + }); +}); diff --git a/src/data/config-store.ts b/src/data/config-store.ts new file mode 100644 index 0000000..2dc8d90 --- /dev/null +++ b/src/data/config-store.ts @@ -0,0 +1,348 @@ +// Async config/profile data store with a local (SQLite) and a cloud (HTTP /v1) +// implementation, selected at runtime. +// +// LOCKED architecture (client -> AWS API only): when HASNA_INSTRUCTIONS_API_URL +// and HASNA_INSTRUCTIONS_API_KEY are both set (self_hosted mode), ALL config and +// profile reads/writes route to https:///v1 with a bearer key — no local +// SQLite, no DSN on the client. With the env unset, the local SQLite store is +// used and the local database is never touched. Setting only one var throws +// (no silent local drift). +import { randomUUID } from "node:crypto"; +import { + createConfig as dbCreateConfig, + deleteConfig as dbDeleteConfig, + getConfig as dbGetConfig, + getConfigStats as dbGetConfigStats, + listConfigs as dbListConfigs, + updateConfig as dbUpdateConfig, +} from "../db/configs.js"; +import { + createProfile as dbCreateProfile, + deleteProfile as dbDeleteProfile, + getProfile as dbGetProfile, + getProfileConfigs as dbGetProfileConfigs, + listProfiles as dbListProfiles, + updateProfile as dbUpdateProfile, +} from "../db/profiles.js"; +import { + createSnapshot as dbCreateSnapshot, + listSnapshots as dbListSnapshots, +} from "../db/snapshots.js"; +import { ConfigNotFoundError, ProfileNotFoundError } from "../types/index.js"; +import type { + Config, + ConfigFilter, + ConfigSnapshot, + CreateConfigInput, + CreateProfileInput, + Profile, + UpdateConfigInput, + UpdateProfileInput, +} from "../types/index.js"; + +export interface CloudConfig { + apiUrl: string; + apiKey: string; + timeoutMs?: number; +} + +export class CloudHttpError extends Error { + constructor(readonly status: number, message: string, readonly body?: unknown) { + super(message); + this.name = "CloudHttpError"; + } +} + +const API_URL_ENV = "HASNA_INSTRUCTIONS_API_URL"; +const API_KEY_ENV = "HASNA_INSTRUCTIONS_API_KEY"; + +/** + * Resolve cloud config from the environment. + * - both vars set -> config (self_hosted / cloud-http) + * - neither set -> null (local SQLite) + * - exactly one set -> throws (no silent local drift) + */ +export function resolveCloudConfig(env: NodeJS.ProcessEnv = process.env): CloudConfig | null { + const apiUrl = env[API_URL_ENV]?.trim(); + const apiKey = env[API_KEY_ENV]?.trim(); + if (!apiUrl && !apiKey) return null; + if (!apiUrl || !apiKey) { + throw new Error( + `Cloud (self_hosted) mode requires BOTH ${API_URL_ENV} and ${API_KEY_ENV}; only ` + + `${apiUrl ? API_URL_ENV : API_KEY_ENV} is set. Set both to use the cloud API, ` + + `or unset both to use the local store.`, + ); + } + return { apiUrl, apiKey }; +} + +/** True when self_hosted cloud mode is active. */ +export function isCloudMode(env: NodeJS.ProcessEnv = process.env): boolean { + return resolveCloudConfig(env) !== null; +} + +export interface ConfigStore { + readonly mode: "local" | "cloud"; + listConfigs(filter?: ConfigFilter): Promise; + getConfig(idOrSlug: string): Promise; + createConfig(input: CreateConfigInput): Promise; + updateConfig(idOrSlug: string, input: UpdateConfigInput): Promise; + deleteConfig(idOrSlug: string): Promise; + getConfigStats(): Promise>; + listProfiles(): Promise; + getProfile(idOrSlug: string): Promise; + getProfileConfigs(idOrSlug: string): Promise; + createProfile(input: CreateProfileInput): Promise; + updateProfile(idOrSlug: string, input: UpdateProfileInput): Promise; + deleteProfile(idOrSlug: string): Promise; + listSnapshots(idOrSlug: string): Promise; + createSnapshot(idOrSlug: string): Promise; +} + +/** Local SQLite-backed store (wraps the synchronous db layer). */ +export class LocalConfigStore implements ConfigStore { + readonly mode = "local" as const; + async listConfigs(filter?: ConfigFilter): Promise { + return dbListConfigs(filter); + } + async getConfig(idOrSlug: string): Promise { + return dbGetConfig(idOrSlug); + } + async createConfig(input: CreateConfigInput): Promise { + return dbCreateConfig(input); + } + async updateConfig(idOrSlug: string, input: UpdateConfigInput): Promise { + return dbUpdateConfig(idOrSlug, input); + } + async deleteConfig(idOrSlug: string): Promise { + dbDeleteConfig(idOrSlug); + } + async getConfigStats(): Promise> { + return dbGetConfigStats(); + } + async listProfiles(): Promise { + return dbListProfiles(); + } + async getProfile(idOrSlug: string): Promise { + return dbGetProfile(idOrSlug); + } + async getProfileConfigs(idOrSlug: string): Promise { + return dbGetProfileConfigs(idOrSlug); + } + async createProfile(input: CreateProfileInput): Promise { + return dbCreateProfile(input); + } + async updateProfile(idOrSlug: string, input: UpdateProfileInput): Promise { + return dbUpdateProfile(idOrSlug, input); + } + async deleteProfile(idOrSlug: string): Promise { + dbDeleteProfile(idOrSlug); + } + async listSnapshots(idOrSlug: string): Promise { + return dbListSnapshots(idOrSlug); + } + async createSnapshot(idOrSlug: string): Promise { + const config = dbGetConfig(idOrSlug); + return dbCreateSnapshot(config.id, config.content, config.version); + } +} + +/** Cloud store: routes every operation to the `/v1` HTTP API. */ +export class CloudConfigStore implements ConfigStore { + readonly mode = "cloud" as const; + private readonly base: string; + private readonly apiKey: string; + private readonly timeoutMs: number; + + constructor(config: CloudConfig) { + this.base = `${config.apiUrl.replace(/\/+$/, "")}/v1`; + this.apiKey = config.apiKey; + this.timeoutMs = config.timeoutMs ?? 30000; + } + + private async request( + method: string, + path: string, + body?: unknown, + opts: { idempotent?: boolean; allow404?: boolean } = {}, + ): Promise<{ status: number; data: T | null }> { + const controller = new AbortController(); + const timer = setTimeout(() => controller.abort(), this.timeoutMs); + const headers: Record = { + Authorization: `Bearer ${this.apiKey}`, + Accept: "application/json", + }; + if (body !== undefined) headers["Content-Type"] = "application/json"; + if (opts.idempotent) headers["Idempotency-Key"] = randomUUID(); + try { + const res = await fetch(`${this.base}${path}`, { + method, + headers, + body: body === undefined ? undefined : JSON.stringify(body), + signal: controller.signal, + }); + if (res.status === 404 && opts.allow404) return { status: 404, data: null }; + const text = await res.text(); + let parsed: unknown = null; + if (text) { + try { + parsed = JSON.parse(text); + } catch { + parsed = text; + } + } + if (!res.ok) { + const message = + (parsed && typeof parsed === "object" && "error" in parsed + ? String((parsed as { error: unknown }).error) + : undefined) ?? `HTTP ${res.status} on ${method} ${path}`; + throw new CloudHttpError(res.status, message, parsed); + } + return { status: res.status, data: parsed as T }; + } finally { + clearTimeout(timer); + } + } + + async listConfigs(filter: ConfigFilter = {}): Promise { + const params = new URLSearchParams(); + if (filter.category) params.set("category", filter.category); + if (filter.agent) params.set("agent", filter.agent); + if (filter.kind) params.set("kind", filter.kind); + if (filter.search) params.set("search", filter.search); + const qs = params.toString(); + const { data } = await this.request<{ configs: Config[] }>( + "GET", + `/configs${qs ? `?${qs}` : ""}`, + ); + let configs = data?.configs ?? []; + // Filters not supported by the API query are applied client-side. + if (filter.tags && filter.tags.length > 0) { + configs = configs.filter((c) => filter.tags!.every((t) => c.tags.includes(t))); + } + if (filter.is_template !== undefined) { + configs = configs.filter((c) => c.is_template === filter.is_template); + } + return configs; + } + + async getConfig(idOrSlug: string): Promise { + const { status, data } = await this.request<{ config: Config }>( + "GET", + `/configs/${encodeURIComponent(idOrSlug)}`, + undefined, + { allow404: true }, + ); + if (status === 404 || !data?.config) throw new ConfigNotFoundError(idOrSlug); + return data.config; + } + + async createConfig(input: CreateConfigInput): Promise { + const { data } = await this.request<{ config: Config }>("POST", "/configs", input, { + idempotent: true, + }); + return (data as { config: Config }).config; + } + + async updateConfig(idOrSlug: string, input: UpdateConfigInput): Promise { + const { data } = await this.request<{ config: Config }>( + "PATCH", + `/configs/${encodeURIComponent(idOrSlug)}`, + input, + ); + return (data as { config: Config }).config; + } + + async deleteConfig(idOrSlug: string): Promise { + const { status } = await this.request<{ deleted: boolean }>( + "DELETE", + `/configs/${encodeURIComponent(idOrSlug)}`, + undefined, + { allow404: true }, + ); + if (status === 404) throw new ConfigNotFoundError(idOrSlug); + } + + async getConfigStats(): Promise> { + const { data } = await this.request>("GET", "/stats"); + return data ?? { total: 0 }; + } + + async listProfiles(): Promise { + const { data } = await this.request<{ profiles: Profile[] }>("GET", "/profiles"); + return data?.profiles ?? []; + } + + async getProfile(idOrSlug: string): Promise { + const { status, data } = await this.request<{ profile: Profile & { configs?: Config[] } }>( + "GET", + `/profiles/${encodeURIComponent(idOrSlug)}`, + undefined, + { allow404: true }, + ); + if (status === 404 || !data?.profile) throw new ProfileNotFoundError(idOrSlug); + const { configs: _configs, ...profile } = data.profile; + return profile; + } + + async getProfileConfigs(idOrSlug: string): Promise { + const { status, data } = await this.request<{ profile: Profile & { configs?: Config[] } }>( + "GET", + `/profiles/${encodeURIComponent(idOrSlug)}`, + undefined, + { allow404: true }, + ); + if (status === 404 || !data?.profile) throw new ProfileNotFoundError(idOrSlug); + return data.profile.configs ?? []; + } + + async createProfile(input: CreateProfileInput): Promise { + const { data } = await this.request<{ profile: Profile }>("POST", "/profiles", input, { + idempotent: true, + }); + return (data as { profile: Profile }).profile; + } + + async updateProfile(idOrSlug: string, input: UpdateProfileInput): Promise { + const { data } = await this.request<{ profile: Profile }>( + "PATCH", + `/profiles/${encodeURIComponent(idOrSlug)}`, + input, + ); + return (data as { profile: Profile }).profile; + } + + async deleteProfile(idOrSlug: string): Promise { + const { status } = await this.request<{ deleted: boolean }>( + "DELETE", + `/profiles/${encodeURIComponent(idOrSlug)}`, + undefined, + { allow404: true }, + ); + if (status === 404) throw new ProfileNotFoundError(idOrSlug); + } + + async listSnapshots(idOrSlug: string): Promise { + const { data } = await this.request<{ snapshots: ConfigSnapshot[] }>( + "GET", + `/configs/${encodeURIComponent(idOrSlug)}/snapshots`, + ); + return data?.snapshots ?? []; + } + + async createSnapshot(idOrSlug: string): Promise { + const { data } = await this.request<{ snapshot: ConfigSnapshot }>( + "POST", + `/configs/${encodeURIComponent(idOrSlug)}/snapshots`, + {}, + { idempotent: true }, + ); + return (data as { snapshot: ConfigSnapshot }).snapshot; + } +} + +/** Resolve the active store: cloud when self_hosted env is set, else local. */ +export function resolveConfigStore(env: NodeJS.ProcessEnv = process.env): ConfigStore { + const cloud = resolveCloudConfig(env); + return cloud ? new CloudConfigStore(cloud) : new LocalConfigStore(); +} diff --git a/src/db/database.ts b/src/db/database.ts index 3fd4af4..5eb66c1 100644 --- a/src/db/database.ts +++ b/src/db/database.ts @@ -105,6 +105,17 @@ let _db: Database | null = null; export function getDatabase(path?: string): Database { if (_db) return _db; + // In self_hosted (cloud) mode the client must never read/write the local + // SQLite database. Any code path that still reaches for the local DB while + // both HASNA_INSTRUCTIONS_API_URL and HASNA_INSTRUCTIONS_API_KEY are set is a + // bug that would cause silent local drift — fail loudly instead. Pass an + // explicit path (e.g. tests) to bypass this guard. + if (!path && process.env["HASNA_INSTRUCTIONS_API_URL"] && process.env["HASNA_INSTRUCTIONS_API_KEY"]) { + throw new Error( + "instructions is in self_hosted (cloud) mode: this command is not wired to the cloud API yet. " + + "Unset HASNA_INSTRUCTIONS_API_URL / HASNA_INSTRUCTIONS_API_KEY to use it against the local store.", + ); + } const dbPath = path || getDbPath(); const db = new Database(dbPath); db.run("PRAGMA journal_mode = WAL");