Private/AzStackHci.WildcardAndSubdomain.Helpers.ps1

# ////////////////////////////////////////////////////////////////////////////
# Helper to perform DNS + optional TCP + Layer7 testing for a URL/port and return a result hashtable.
# Used by Expand-WildcardUrlsDynamically and Test-ManuallyDefinedSubdomains to avoid duplicated test logic.
Function Invoke-EndpointConnectivityTest {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory)][string]$Url,
        [Parameter(Mandatory)][int]$Port,
        [switch]$IncludeTCPConnectivityTests
    )

    try {
        $DNSCheck = Get-DnsRecord -url (Get-DomainFromURL -url $Url).Domain
    } catch {
        Write-HostAzS "Error: DNS resolution failed for '$Url': $($_.Exception.Message)" -ForegroundColor Red
        return @{
            TCPStatus                        = "Failed"
            IPAddress                        = "DNS Error"
            Layer7Status                     = "Failed"
            Layer7Response                   = "DNS resolution error: $($_.Exception.Message)"
            Layer7ResponseTime               = "N/A"
            CertificateIssuer                = "N/A"
            CertificateSubject               = "N/A"
            CertificateThumbprint            = "N/A"
            CertificateIntermediateIssuer    = "N/A"
            CertificateIntermediateSubject   = "N/A"
            CertificateIntermediateThumbprint= "N/A"
            CertificateRootIssuer            = "N/A"
            CertificateRootSubject           = "N/A"
            CertificateRootThumbprint        = "N/A"
        }
    }

    if (($DNSCheck.DNSExists) -or ($script:Proxy.Enabled)) {
        if ($IncludeTCPConnectivityTests.IsPresent) {
            try {
                $tcpStatus, $ipAddress = Test-TCPConnectivity -url $Url -port $Port
            } catch {
                Write-HostAzS "Error: TCP connectivity test failed for '$Url': $($_.Exception.Message)" -ForegroundColor Red
                $tcpStatus = "Failed"
                $ipAddress = "TCP Error"
            }
        } else {
            $tcpStatus = "N/A"
            $ipAddress = $DNSCheck.IpAddress
        }
        try {
            $Layer7Results = Test-Layer7Connectivity -url $Url -port $Port
        } catch {
            Write-HostAzS "Error: Layer 7 connectivity test failed for '$Url': $($_.Exception.Message)" -ForegroundColor Red
            $Layer7Results = @{
                Layer7Status = "Failed"
                Layer7Response = "Layer 7 test error: $($_.Exception.Message)"
                Layer7ResponseTime = "N/A"
                CertificateIssuer = "N/A"
                CertificateSubject = "N/A"
                CertificateThumbprint = "N/A"
                CertificateIntermediateIssuer = "N/A"
                CertificateIntermediateSubject = "N/A"
                CertificateIntermediateThumbprint = "N/A"
                CertificateRootIssuer = "N/A"
                CertificateRootSubject = "N/A"
                CertificateRootThumbprint = "N/A"
            }
        }
        return @{
            TCPStatus                        = $tcpStatus
            IPAddress                        = $ipAddress
            Layer7Status                     = $Layer7Results.Layer7Status
            Layer7Response                   = $Layer7Results.Layer7Response
            Layer7ResponseTime               = $Layer7Results.Layer7ResponseTime
            CertificateIssuer                = $Layer7Results.CertificateIssuer
            CertificateSubject               = $Layer7Results.CertificateSubject
            CertificateThumbprint            = $Layer7Results.CertificateThumbprint
            CertificateIntermediateIssuer    = $Layer7Results.CertificateIntermediateIssuer
            CertificateIntermediateSubject   = $Layer7Results.CertificateIntermediateSubject
            CertificateIntermediateThumbprint= $Layer7Results.CertificateIntermediateThumbprint
            CertificateRootIssuer            = $Layer7Results.CertificateRootIssuer
            CertificateRootSubject           = $Layer7Results.CertificateRootSubject
            CertificateRootThumbprint        = $Layer7Results.CertificateRootThumbprint
        }
    } else {
        # DNS name does not exist
        return @{
            TCPStatus                        = if ($IncludeTCPConnectivityTests.IsPresent) { "Failed" } else { "N/A" }
            IPAddress                        = $DNSCheck.IpAddress
            Layer7Status                     = "Failed"
            Layer7Response                   = "N/A"
            Layer7ResponseTime               = "N/A"
            CertificateIssuer                = "N/A"
            CertificateSubject               = "N/A"
            CertificateThumbprint            = "N/A"
            CertificateIntermediateIssuer    = "N/A"
            CertificateIntermediateSubject   = "N/A"
            CertificateIntermediateThumbprint= "N/A"
            CertificateRootIssuer            = "N/A"
            CertificateRootSubject           = "N/A"
            CertificateRootThumbprint        = "N/A"
        }
    }
}


# ////////////////////////////////////////////////////////////////////////////
# Enhanced Function to expand wildcard URLs dynamically using pattern matching *.domain.com
#
# How this works:
# 1. Splits $script:Results into wildcard entries (*.foo.com) and non-wildcard entries (bar.foo.com)
# 2. For each wildcard, converts it to a regex (e.g. *.foo.com -> .*\.foo\.com)
# 3. Finds non-wildcard URLs that match the regex pattern
# 4. For each match: if already tested, adds a cross-reference Note; if new, runs connectivity tests
# 5. Updates the wildcard entry's Note field to show which specific URLs were tested for it
#
# This enables testing of wildcard firewall rules by verifying connectivity to known specific endpoints
# that fall under the wildcard pattern.
Function Expand-WildcardUrlsDynamically {

    begin {
        # Write-Verbose "Starting Expand-WildcardUrlsDynamically function"
    }

    process {
        # Split into wildcard and non-wildcard results
        [array]$wildcardResults = $script:Results | Where-Object { $_.IsWildcard -eq $true }
        [array]$nonWildcardResults = $script:Results | Where-Object { $_.IsWildcard -eq $false }

        [int]$wildcardCount = 0

        ForEach ($wildcard in $wildcardResults) {

            $wildcardCount++
            Write-Progress -Id 1 -ParentId 0 -Activity "Expanding Wildcard URLs" -Status "Wildcard $wildcardCount of $($wildcardResults.Count): $($wildcard.URL)" -PercentComplete (($wildcardCount / [math]::Max($wildcardResults.Count,1)) * 100)

            # Create a regex pattern from the wildcard URL
            # Escape dots first, then replace * with .* for proper regex matching
            $wildcardPattern = [regex]::Escape($wildcard.URL) -replace "\\\*", ".*"

            # Find matching non-wildcard URLs, for each wildcard URL that exists
            [array]$matchingUrls = @()
            $matchingUrls = $nonWildcardResults | Where-Object { $_.URL -match "^$wildcardPattern$" }

            Write-HostAzS "`n$wildcardCount of $($wildcardResults.Count): Processing $($wildcard.Source): $($wildcard.URL)"

            if($matchingUrls.Count -eq 0) {
                Write-HostAzS "`tInfo: No match found for $($wildcard.source), $($wildcard.URL)" -ForegroundColor Yellow
                if($wildcard.Note -notlike "Wildcard URL,*"){
                    # Update the note to include the matching URL
                    Write-Verbose "Updating Note of wildcard URL: $($wildcard.URL)"
                    ($script:Results | Where-Object { $PSItem.URL -eq $wildcard.URL } | Select-Object -First 1).Note = "Wildcard URL, not tested (as no non-wildcard) - $($wildcard.Note)"
                }
                # Continue to the next matching URL
                Continue

            } elseif ($matchingUrls.Count -gt 0) {
                # Matches found, expand the wildcard entry
                # Incremental counter for matching URLs
                [int]$counter = 0
                # Loop for each matching URL
                foreach ($match in $matchingUrls) {
                    $counter++
                    Write-HostAzS "`n`tProcessing match $counter of $($matchingUrls.count): $($match.URL)"
                    # Add URL based on test for either HTTP or HTTPS
                    if($match.Port -is [int]){

                        # If the URL already exists in the results, update the note
                        if($script:Results.URL -contains $match.URL){
                            # URL already exists in the results, skip
                            Write-HostAzS "`tEndpoint matches wildcard '$($wildcard.URL)', adding cross-reference in Notes column" -ForegroundColor Green
                            if(($match.Note -notlike "URL matches *") -and ($match.Note -notlike "Manually defined URL *")){
                                # Update the note to include the matching URL
                                Write-Verbose "Updating Note of matched URL: $($match.URL)"
                            ($script:Results | Where-Object { $PSItem.URL -eq $match.URL } | Select-Object -First 1).Note = "URL matches $($wildcard.Source), to test URL $($wildcard.URL) - $($match.Note)"
                            }
                            # Continue to the next matching URL
                            Continue

                        } elseif ($script:Results.URL -notcontains $match.URL){
                            # Specific URL matched to Wildcard URL does not exist in the results, unexpected, but will add it
                            Write-HostAzS "`tEndpoint matches wildcard '$($wildcard.URL)', adding to results" -ForegroundColor Green
                            $newEntry = $wildcard.PSObject.Copy()
                            $newEntry.URL = $match.URL
                            $newEntry.Port = $match.Port
                            $newEntry.ArcGateway = $match.ArcGateway
                            $newEntry.Source = "$($match.Source)"
                            $newEntry.Note = "URL matches $($match.Source), to test URL $($wildcard.URL) - $($match.Note)"
                            # Set IsWildcard to false, as this is no longer a wildcard URL, it is a specific URL to test a wildcard URL
                            $newEntry.IsWildcard = $false
                            if($ArcGatewayDeployment.IsPresent){
                                # Skip URLs with ArcGateway -eq $True
                                if($match.ArcGateway){
                                    # Skip URLs that support Arc Gateway
                                    Write-HostAzS "Skipped URL: '$($newEntry.URL)' as supported by Arc Gateway" -ForegroundColor Yellow
                                    $newEntry.TCPStatus = "Skipped"
                                    $newEntry.Note = "Skipped, URL is supported by Arc Gateway - $($match.Note)"
                                    $newEntry.IPAddress = "N/A"
                                    $newEntry.Layer7Status = "Skipped"
                                    $newEntry.Layer7Response = "N/A"
                                    $newEntry.Layer7ResponseTime = "N/A"
                                    $newEntry.CertificateIssuer = "N/A"
                                    $newEntry.CertificateSubject = "N/A"
                                    $newEntry.CertificateThumbprint = "N/A"
                                    $newEntry.IntermediateCertificateIssuer = "N/A"
                                    $newEntry.IntermediateCertificateSubject = "N/A"
                                    $newEntry.IntermediateCertificateThumbprint = "N/A"
                                    $newEntry.RootCertificateIssuer = "N/A"
                                    $newEntry.RootCertificateSubject = "N/A"
                                    $newEntry.RootCertificateThumbprint = "N/A"
                                } else {
                                    # Does not support Arc Gateway - run connectivity tests
                                    $testResult = Invoke-EndpointConnectivityTest -Url $match.URL -Port $match.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests.IsPresent
                                    $newEntry.TCPStatus = $testResult.TCPStatus
                                    $newEntry.IPAddress = $testResult.IPAddress
                                    $newEntry.Layer7Status = $testResult.Layer7Status
                                    $newEntry.Layer7Response = $testResult.Layer7Response
                                    $newEntry.Layer7ResponseTime = $testResult.Layer7ResponseTime
                                    $newEntry.CertificateIssuer = $testResult.CertificateIssuer
                                    $newEntry.CertificateSubject = $testResult.CertificateSubject
                                    $newEntry.CertificateThumbprint = $testResult.CertificateThumbprint
                                    $newEntry.IntermediateCertificateIssuer = $testResult.CertificateIntermediateIssuer
                                    $newEntry.IntermediateCertificateSubject = $testResult.CertificateIntermediateSubject
                                    $newEntry.IntermediateCertificateThumbprint = $testResult.CertificateIntermediateThumbprint
                                    $newEntry.RootCertificateIssuer = $testResult.CertificateRootIssuer
                                    $newEntry.RootCertificateSubject = $testResult.CertificateRootSubject
                                    $newEntry.RootCertificateThumbprint = $testResult.CertificateRootThumbprint
                                } # End of ArcGateway -eq $True check
                            } else {
                                # Else process URLs with ArcGateway -eq $False
                                $testResult = Invoke-EndpointConnectivityTest -Url $match.URL -Port $match.Port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests.IsPresent
                                $newEntry.TCPStatus = $testResult.TCPStatus
                                $newEntry.IPAddress = $testResult.IPAddress
                                $newEntry.Layer7Status = $testResult.Layer7Status
                                $newEntry.Layer7Response = $testResult.Layer7Response
                                $newEntry.Layer7ResponseTime = $testResult.Layer7ResponseTime
                                $newEntry.CertificateIssuer = $testResult.CertificateIssuer
                                $newEntry.CertificateSubject = $testResult.CertificateSubject
                                $newEntry.CertificateThumbprint = $testResult.CertificateThumbprint
                                $newEntry.IntermediateCertificateIssuer = $testResult.CertificateIntermediateIssuer
                                $newEntry.IntermediateCertificateSubject = $testResult.CertificateIntermediateSubject
                                $newEntry.IntermediateCertificateThumbprint = $testResult.CertificateIntermediateThumbprint
                                $newEntry.RootCertificateIssuer = $testResult.CertificateRootIssuer
                                $newEntry.RootCertificateSubject = $testResult.CertificateRootSubject
                                $newEntry.RootCertificateThumbprint = $testResult.CertificateRootThumbprint
                            } # End of DNS check
                            # Add the new match to the expanded results
                            $script:Results.Add($newEntry) | Out-Null
                            Write-Verbose "Added: '$($newEntry.URL)' that matches Wildcard '$($wildcard.URL)'"
                        
                        } else {
                            # Unexpected condition, should not occur, as we use the Results array for the list of Wildcards, so the URL should always exist
                            Write-Warning "Unexpected: URL '$($match.URL)' matches Wildcard '$($wildcard.URL)', but conditions not met, skipping"
                            Continue
                        } # End of URL exists check

                    } else {
                        Write-Warning "Port not valid for url: '$($match.URL)', port: '$($match.Port)', note: '$($match.Source)' - skipping"
                    }

                } # End of matching URLs loop
            } else {
                # Unexpected condition, should not occur, as we use the Results array for the list of Wildcards, so the URL should always exist
                Write-Warning "Unexpected: Wildcard URL $($wildcard.URL) should match either zero or more results, but matches status unknown, skipping"
                Continue

            } # End of matching URLs check
        } # End of wildcard loop
        Write-Progress -Id 1 -Activity "Expanding Wildcard URLs" -Completed

    } # End of process block

    end {
        # Write-Debug "Completed Expand-WildcardUrlsDynamically function"
    }

} # End of Expand-WildcardUrlsDynamically function


# ////////////////////////////////////////////////////////////////////////////
# Function to manually test known subdomains for wildcard URLs
Function Test-ManuallyDefinedSubdomains {

    Param (
    )

    begin {
        # Incremental counter for subdomains (separate from the main progress bar)
        [int]$urlCount = 0
        # Total number of manually defined subdomains for sub-progress tracking
        [int]$totalSubdomains = $script:MANUAL_SUBDOMAIN_COUNT
        # Use the constant subdomain list
        $manualSubdomains = $script:MANUAL_SUBDOMAINS
    }

    process {
        # Test each manual subdomain for each wildcard to validate connectivity.
        ForEach ($entry in $manualSubdomains) {
            $wildcard = $entry.Wildcard
            $subdomains = $entry.Subdomains

            # Check if the wildcard URL is supported by Arc Gateway, if so, skip the wildcard URL
            if($ArcGatewayDeployment.IsPresent -and ($PreArcGatewayRemoval | Where-Object { ($_.URL -eq $wildcard) -and ($_.ArcGateway -eq $true) })) {
                # Skip wildcard URLs that have already been tested
                Write-Verbose "Info: Wildcard '$wildcard', supports the Arc Gateway, skipping subdomain tests."
                Continue
            }

            # Check if the wildcard URL exists in the results, if not, skip testing subdomains
            if($script:Results.URL -notcontains $wildcard) {
                # Skip wildcard URLs that have already been tested
                Write-Verbose "Info: Wildcard '$wildcard', is not present in Results array, skipping subdomain tests."
                Continue
            }

            Write-HostAzS "`nTesting manually defined subdomains for wildcard $wildcard"

            # ForEach loop to process each subdomain
            ForEach ($subdomain in $subdomains) {
                # Test each subdomain for TCP and Layer 7 connectivity
                $urlCount++
                if ($totalSubdomains -gt 0) {
                    Write-Progress -Id 1 -ParentId 0 -Activity "Validating Wildcard Endpoints" -Status "Subdomain $urlCount of $($totalSubdomains): $subdomain" -PercentComplete (($urlCount / $totalSubdomains) * 100)
                }
                Write-HostAzS "`nWildcard validation $urlCount of $($totalSubdomains): Subdomain: $subdomain"
                # Test port 80 and 443 for each subdomain
                ForEach ($port in @(80, 443)) {
                    
                    # Exceptions to some URLs, that do not support port 80 or 443
                    # Skip port 443 for ctldl.windowsupdate.com, download.windowsupdate.com, fe2.update.microsoft.com and 1a.au.download.windowsupdate.com
                    if(($subdomain -in ("ctldl.windowsupdate.com","download.windowsupdate.com","fe2.update.microsoft.com","1a.au.download.windowsupdate.com")) -and ($port -eq $script:PORT_HTTPS)){
                        # Skip port 443 for ctldl.windowsupdate.com, download.windowsupdate.com, fe2.update.microsoft.com and 1a.au.download.windowsupdate.com
                        Write-HostAzS "Skipping port 443 for $subdomain" -ForegroundColor Yellow
                        Continue
                    }
                    # Skip port 80 for prod5.prod.hot.ingest.monitor.core.windows.net and edr-neu3.eu.endpoint.security.microsoft.com
                    if(($subdomain -in ("prod5.prod.hot.ingest.monitor.core.windows.net","edr-neu3.eu.endpoint.security.microsoft.com")) -and ($port -eq $script:PORT_HTTP)){
                        # Skip port 80 for prod5.prod.hot.ingest.monitor.core.windows.net and edr-neu3.eu.endpoint.security.microsoft.com
                        Write-HostAzS "Skipping port 80 for $subdomain" -ForegroundColor Yellow
                        Continue
                    }
                    
                    # Run connectivity tests using shared helper
                    Write-HostAzS "Testing $subdomain on port $port"
                    $testResult = Invoke-EndpointConnectivityTest -Url $subdomain -Port $port -IncludeTCPConnectivityTests:$IncludeTCPConnectivityTests.IsPresent
                    $TCPstatus = $testResult.TCPStatus
                    $ipAddress = $testResult.IPAddress
                    $Layer7Status = $testResult.Layer7Status
                    $Layer7Response = $testResult.Layer7Response
                    $Layer7ResponseTime = $testResult.Layer7ResponseTime
                    $CertificateIssuer = $testResult.CertificateIssuer
                    $CertificateSubject = $testResult.CertificateSubject
                    $CertificateThumbprint = $testResult.CertificateThumbprint
                    $CertificateIntermediateIssuer = $testResult.CertificateIntermediateIssuer
                    $CertificateIntermediateSubject = $testResult.CertificateIntermediateSubject
                    $CertificateIntermediateThumbprint = $testResult.CertificateIntermediateThumbprint
                    $CertificateRootIssuer = $testResult.CertificateRootIssuer
                    $CertificateRootSubject = $testResult.CertificateRootSubject
                    $CertificateRootThumbprint = $testResult.CertificateRootThumbprint
                    
                    # Check if the URL already exists in the "allTestedUrls" results, only add new ones
                    if($script:Results.URL -notcontains $subdomain) {
                        # ArcGateway = $true, as all wildcards are "microsoft.com" or "windows.net", so should support ArcGateway
                        $subdomainEntry = [PSCustomObject]@{
                            RowID = 0
                            URL = $subdomain
                            Port = $port
                            ArcGateway = $true
                            IsWildcard = $false
                            Source = "Test for $(($script:Results | Where-Object { ($_.URL -eq $wildcard) } | Select-Object -First 1).Source)"
                            Note = "Manually defined URL to test $Source Wildcard URL $wildcard"
                            TCPStatus = $TCPstatus
                            IPAddress = $ipAddress
                            Layer7Status = $Layer7Status
                            Layer7Response = $Layer7Response
                            Layer7ResponseTime = $Layer7ResponseTime
                            CertificateIssuer = $CertificateIssuer
                            CertificateSubject = $CertificateSubject
                            CertificateThumbprint = $CertificateThumbprint
                            IntermediateCertificateIssuer = $CertificateIntermediateIssuer
                            IntermediateCertificateSubject = $CertificateIntermediateSubject
                            IntermediateCertificateThumbprint = $CertificateIntermediateThumbprint
                            RootCertificateIssuer = $CertificateRootIssuer
                            RootCertificateSubject = $CertificateRootSubject
                            RootCertificateThumbprint = $CertificateRootThumbprint
                        }
                        # Add the subdomain entry to the results
                        Write-Debug "Info: Added $($subdomain) to the results array"
                        $script:Results.Add($subdomainEntry) | Out-Null
                        $MatchedWildcardURLs = ($script:Results | Where-Object { $PSItem.URL -eq $wildcard } )
                        ForEach($MatchedWildcardURL in $MatchedWildcardURLs) {
                            if($MatchedWildcardURL.Note -notlike "Wildcard URL,*"){
                                # Update the note to include the matching URL
                                Write-Verbose "Updating Note of wildcard URL: $($wildcard), with cross-reference to $($subdomain)"
                                $MatchedWildcardURL.Note = "Wildcard URL, tested by manually defined URL $($subdomain) - $($MatchedWildcardURL.Note)"
                            }
                        }

                    } else {
                        # URL already exists in the results, skip
                        Write-Verbose "Info: Url $($subdomain) already exists in the results, skipping"
                        $MatchedWildcardURLs = ($script:Results | Where-Object { $PSItem.URL -eq $wildcard } )
                        ForEach($MatchedWildcardURL in $MatchedWildcardURLs) {
                            if($MatchedWildcardURL.Note -notlike "Wildcard URL,*"){
                                # Update the note to include the matching URL
                                $MatchedWildcardURL.Note = "Wildcard URL, tested by manually defined URL $($subdomain) - $($MatchedWildcardURL.Note)"
                                Write-Verbose "Updated Note of wildcard URL: $($wildcard), with cross-reference to $($subdomain)"
                            }
                        }
                    }
                }
            } # End of ForEach per $port

        } # End of ForEach $subdomain

    } # End of Process block

    end {
        # Progress bar is managed by the caller (unified with main endpoint testing)
    }
} # End of Test-ManuallyDefinedSubdomains function


# ////////////////////////////////////////////////////////////////////////////
# Function to parse endpoints from markdown lines
Function Get-EndpointsFromMarkdown {
    <#
    .SYNOPSIS
        Parse endpoints from markdown lines.
    .DESCRIPTION
        This function parses the provided markdown lines to extract endpoint URLs.
    #>

    [CmdletBinding()]
    param (
        [Parameter(Mandatory=$true)]
        [AllowEmptyCollection()]
        [string[]]$InputMarkdown,

        [Parameter(Mandatory=$true)]
        [ValidateNotNullOrEmpty()]
        [string]$Source
    )

    begin {
        # Write-Debug "Get-EndpointsFromMarkdown: Beginning endpoint parsing from markdown lines"
        # Initialize counter to store the number of parsed endpoints
        [int]$parsedEndpoints = 0
        
        # Validate input is not empty
        if (-not $InputMarkdown -or $InputMarkdown.Count -eq 0) {
            Write-Warning "No markdown content provided to parse in function: 'Get-EndpointsFromMarkdown'. Returning 0 endpoints."
            return $parsedEndpoints
        }
    }

    process {
        # Parse markdown table rows to extract endpoint URLs.
        # Expected format: | RowNum | ... | URL | Ports | Note | ArcGateway | ...
        # The regex matches lines starting with | followed by a number (the row ID column).
        # Columns are split on '|' and indexed: [3]=URL, [4]=Ports, [5]=Note, [6]=ArcGateway.
        ForEach ($line in $InputMarkdown) {
            if ($line -match "^\|\s*(\d+)\s*\|") {
                # $rowId = [int]($line -replace "^\|\s*(\d+)\s*\|.*", '$1')
                $columns = $line -split "\|"
                # Validate column count before accessing indices (need at least 7 columns: empty, rowId, desc, URL, Ports, Note, ArcGateway)
                if ($columns.Count -lt 7) {
                    Write-Warning "Skipping malformed markdown row (expected at least 7 columns, found $($columns.Count)): $line"
                    Continue
                }
                $url = $columns[3].Trim()
                # Sanitize URL: only allow FQDN characters (alphanumeric, hyphens, dots, wildcards, forward slashes, colons for port, underscores)
                # This prevents injection of unexpected values from crafted markdown files.
                if ($url -notmatch '^[a-zA-Z0-9\*\.\-\:/_]+$') {
                    Write-Warning "Skipping invalid URL from markdown: '$url' - contains unexpected characters"
                    Continue
                }
                $ports = $columns[4].Trim() -split ','
                $note = $columns[5].Trim()
                $ArcGatewayText = $columns[6].Trim()
                if(($ArcGatewayText.Length -ge 2) -and ($ArcGatewayText.Substring(0,2) -eq "No")){
                    # "No"
                    [bool]$ArcGateway = $false
                } elseif(($ArcGatewayText.Length -ge 3) -and ($ArcGatewayText.Substring(0,3) -eq "Yes")){
                    # "Yes"
                    [bool]$ArcGateway = $true
                } else {
                    # Unknown
                    Write-Warning "Unknown ArcGateway status for url: '$url' : $ArcGatewayText"
                    [bool]$ArcGateway = $false
                }
                # Use only the domain name from the URL, remove any absolute path from the endpoint when checking if it exists
                $urlcheck = (Get-DomainFromURL -url $url).Domain
                foreach ($port in $ports) {
                    $isWildcard = $url.Contains("*")
                    if($script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -eq $urlcheck) -and ($_.Port -eq $port) }) {
                        Write-Debug "$($Source): Skipping '$url' with port '$port', as it already exists in the results array."
                        # If the ArcGateway value is different, update it
                        $script:Results | Where-Object { ((Get-DomainFromURL -url $_.URL).Domain -like $urlcheck) -and ($_.Port -eq $port) } | ForEach-Object {
                            $_.ArcGateway = $ArcGateway
                        }
                        Continue
                    } else {
                        Write-Debug "$($Source): Adding '$urlcheck' with port '$port' to results array for processing."
                        $script:Results.Add([PSCustomObject]@{
                            RowID = 0
                            URL = $url
                            Port = [int]$port
                            ArcGateway = $ArcGateway
                            IsWildcard = $isWildcard
                            Source = if ($isWildcard) { "$Source Wildcard" } else { "$Source" }
                            Note = $note
                            TCPStatus = ""
                            IPAddress = ""
                            Layer7Status = ""
                            Layer7Response = ""
                            Layer7ResponseTime = ""
                            CertificateIssuer = ""
                            CertificateSubject = ""
                            CertificateThumbprint = ""
                            IntermediateCertificateIssuer = ""
                            IntermediateCertificateSubject = ""
                            IntermediateCertificateThumbprint = ""
                            RootCertificateIssuer = ""
                            RootCertificateSubject = ""
                            RootCertificateThumbprint = ""
                        }) | Out-Null
                        # Increment the parsed endpoints counter
                        $parsedEndpoints++
                    }
                }
            }
            
        }
    } # End of process block

    end {
        # Write-Debug "Get-EndpointsFromMarkdown: Endpoint parsing completed"
        Return $parsedEndpoints

    }
} # End Function Get-EndpointsFromMarkdown

# SIG # Begin signature block
# MIIoVQYJKoZIhvcNAQcCoIIoRjCCKEICAQExDzANBglghkgBZQMEAgEFADB5Bgor
# BgEEAYI3AgEEoGswaTA0BgorBgEEAYI3AgEeMCYCAwEAAAQQH8w7YFlLCE63JNLG
# KX7zUQIBAAIBAAIBAAIBAAIBADAxMA0GCWCGSAFlAwQCAQUABCD4+FkNLuqy/PmM
# keAzIbyj+EHsxj7b1LBnWVdNB7qqbKCCDYUwggYDMIID66ADAgECAhMzAAAEhJji
# EuB4ozFdAAAAAASEMA0GCSqGSIb3DQEBCwUAMH4xCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01pY3Jvc29mdCBDb2RlIFNpZ25p
# bmcgUENBIDIwMTEwHhcNMjUwNjE5MTgyMTM1WhcNMjYwNjE3MTgyMTM1WjB0MQsw
# CQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9u
# ZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMR4wHAYDVQQDExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIB
# AQDtekqMKDnzfsyc1T1QpHfFtr+rkir8ldzLPKmMXbRDouVXAsvBfd6E82tPj4Yz
# aSluGDQoX3NpMKooKeVFjjNRq37yyT/h1QTLMB8dpmsZ/70UM+U/sYxvt1PWWxLj
# MNIXqzB8PjG6i7H2YFgk4YOhfGSekvnzW13dLAtfjD0wiwREPvCNlilRz7XoFde5
# KO01eFiWeteh48qUOqUaAkIznC4XB3sFd1LWUmupXHK05QfJSmnei9qZJBYTt8Zh
# ArGDh7nQn+Y1jOA3oBiCUJ4n1CMaWdDhrgdMuu026oWAbfC3prqkUn8LWp28H+2S
# LetNG5KQZZwvy3Zcn7+PQGl5AgMBAAGjggGCMIIBfjAfBgNVHSUEGDAWBgorBgEE
# AYI3TAgBBggrBgEFBQcDAzAdBgNVHQ4EFgQUBN/0b6Fh6nMdE4FAxYG9kWCpbYUw
# VAYDVR0RBE0wS6RJMEcxLTArBgNVBAsTJE1pY3Jvc29mdCBJcmVsYW5kIE9wZXJh
# dGlvbnMgTGltaXRlZDEWMBQGA1UEBRMNMjMwMDEyKzUwNTM2MjAfBgNVHSMEGDAW
# gBRIbmTlUAXTgqoXNzcitW2oynUClTBUBgNVHR8ETTBLMEmgR6BFhkNodHRwOi8v
# d3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NybC9NaWNDb2RTaWdQQ0EyMDExXzIw
# MTEtMDctMDguY3JsMGEGCCsGAQUFBwEBBFUwUzBRBggrBgEFBQcwAoZFaHR0cDov
# L3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9jZXJ0cy9NaWNDb2RTaWdQQ0EyMDEx
# XzIwMTEtMDctMDguY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQELBQADggIB
# AGLQps1XU4RTcoDIDLP6QG3NnRE3p/WSMp61Cs8Z+JUv3xJWGtBzYmCINmHVFv6i
# 8pYF/e79FNK6P1oKjduxqHSicBdg8Mj0k8kDFA/0eU26bPBRQUIaiWrhsDOrXWdL
# m7Zmu516oQoUWcINs4jBfjDEVV4bmgQYfe+4/MUJwQJ9h6mfE+kcCP4HlP4ChIQB
# UHoSymakcTBvZw+Qst7sbdt5KnQKkSEN01CzPG1awClCI6zLKf/vKIwnqHw/+Wvc
# Ar7gwKlWNmLwTNi807r9rWsXQep1Q8YMkIuGmZ0a1qCd3GuOkSRznz2/0ojeZVYh
# ZyohCQi1Bs+xfRkv/fy0HfV3mNyO22dFUvHzBZgqE5FbGjmUnrSr1x8lCrK+s4A+
# bOGp2IejOphWoZEPGOco/HEznZ5Lk6w6W+E2Jy3PHoFE0Y8TtkSE4/80Y2lBJhLj
# 27d8ueJ8IdQhSpL/WzTjjnuYH7Dx5o9pWdIGSaFNYuSqOYxrVW7N4AEQVRDZeqDc
# fqPG3O6r5SNsxXbd71DCIQURtUKss53ON+vrlV0rjiKBIdwvMNLQ9zK0jy77owDy
# XXoYkQxakN2uFIBO1UNAvCYXjs4rw3SRmBX9qiZ5ENxcn/pLMkiyb68QdwHUXz+1
# fI6ea3/jjpNPz6Dlc/RMcXIWeMMkhup/XEbwu73U+uz/MIIHejCCBWKgAwIBAgIK
# YQ6Q0gAAAAAAAzANBgkqhkiG9w0BAQsFADCBiDELMAkGA1UEBhMCVVMxEzARBgNV
# BAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAcBgNVBAoTFU1pY3Jv
# c29mdCBDb3Jwb3JhdGlvbjEyMDAGA1UEAxMpTWljcm9zb2Z0IFJvb3QgQ2VydGlm
# aWNhdGUgQXV0aG9yaXR5IDIwMTEwHhcNMTEwNzA4MjA1OTA5WhcNMjYwNzA4MjEw
# OTA5WjB+MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UE
# BxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMSgwJgYD
# VQQDEx9NaWNyb3NvZnQgQ29kZSBTaWduaW5nIFBDQSAyMDExMIICIjANBgkqhkiG
# 9w0BAQEFAAOCAg8AMIICCgKCAgEAq/D6chAcLq3YbqqCEE00uvK2WCGfQhsqa+la
# UKq4BjgaBEm6f8MMHt03a8YS2AvwOMKZBrDIOdUBFDFC04kNeWSHfpRgJGyvnkmc
# 6Whe0t+bU7IKLMOv2akrrnoJr9eWWcpgGgXpZnboMlImEi/nqwhQz7NEt13YxC4D
# dato88tt8zpcoRb0RrrgOGSsbmQ1eKagYw8t00CT+OPeBw3VXHmlSSnnDb6gE3e+
# lD3v++MrWhAfTVYoonpy4BI6t0le2O3tQ5GD2Xuye4Yb2T6xjF3oiU+EGvKhL1nk
# kDstrjNYxbc+/jLTswM9sbKvkjh+0p2ALPVOVpEhNSXDOW5kf1O6nA+tGSOEy/S6
# A4aN91/w0FK/jJSHvMAhdCVfGCi2zCcoOCWYOUo2z3yxkq4cI6epZuxhH2rhKEmd
# X4jiJV3TIUs+UsS1Vz8kA/DRelsv1SPjcF0PUUZ3s/gA4bysAoJf28AVs70b1FVL
# 5zmhD+kjSbwYuER8ReTBw3J64HLnJN+/RpnF78IcV9uDjexNSTCnq47f7Fufr/zd
# sGbiwZeBe+3W7UvnSSmnEyimp31ngOaKYnhfsi+E11ecXL93KCjx7W3DKI8sj0A3
# T8HhhUSJxAlMxdSlQy90lfdu+HggWCwTXWCVmj5PM4TasIgX3p5O9JawvEagbJjS
# 4NaIjAsCAwEAAaOCAe0wggHpMBAGCSsGAQQBgjcVAQQDAgEAMB0GA1UdDgQWBBRI
# bmTlUAXTgqoXNzcitW2oynUClTAZBgkrBgEEAYI3FAIEDB4KAFMAdQBiAEMAQTAL
# BgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAfBgNVHSMEGDAWgBRyLToCMZBD
# uRQFTuHqp8cx0SOJNDBaBgNVHR8EUzBRME+gTaBLhklodHRwOi8vY3JsLm1pY3Jv
# c29mdC5jb20vcGtpL2NybC9wcm9kdWN0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf
# MDNfMjIuY3JsMF4GCCsGAQUFBwEBBFIwUDBOBggrBgEFBQcwAoZCaHR0cDovL3d3
# dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNSb29DZXJBdXQyMDExXzIwMTFf
# MDNfMjIuY3J0MIGfBgNVHSAEgZcwgZQwgZEGCSsGAQQBgjcuAzCBgzA/BggrBgEF
# BQcCARYzaHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraW9wcy9kb2NzL3ByaW1h
# cnljcHMuaHRtMEAGCCsGAQUFBwICMDQeMiAdAEwAZQBnAGEAbABfAHAAbwBsAGkA
# YwB5AF8AcwB0AGEAdABlAG0AZQBuAHQALiAdMA0GCSqGSIb3DQEBCwUAA4ICAQBn
# 8oalmOBUeRou09h0ZyKbC5YR4WOSmUKWfdJ5DJDBZV8uLD74w3LRbYP+vj/oCso7
# v0epo/Np22O/IjWll11lhJB9i0ZQVdgMknzSGksc8zxCi1LQsP1r4z4HLimb5j0b
# pdS1HXeUOeLpZMlEPXh6I/MTfaaQdION9MsmAkYqwooQu6SpBQyb7Wj6aC6VoCo/
# KmtYSWMfCWluWpiW5IP0wI/zRive/DvQvTXvbiWu5a8n7dDd8w6vmSiXmE0OPQvy
# CInWH8MyGOLwxS3OW560STkKxgrCxq2u5bLZ2xWIUUVYODJxJxp/sfQn+N4sOiBp
# mLJZiWhub6e3dMNABQamASooPoI/E01mC8CzTfXhj38cbxV9Rad25UAqZaPDXVJi
# hsMdYzaXht/a8/jyFqGaJ+HNpZfQ7l1jQeNbB5yHPgZ3BtEGsXUfFL5hYbXw3MYb
# BL7fQccOKO7eZS/sl/ahXJbYANahRr1Z85elCUtIEJmAH9AAKcWxm6U/RXceNcbS
# oqKfenoi+kiVH6v7RyOA9Z74v2u3S5fi63V4GuzqN5l5GEv/1rMjaHXmr/r8i+sL
# gOppO6/8MO0ETI7f33VtY5E90Z1WTk+/gFcioXgRMiF670EKsT/7qMykXcGhiJtX
# cVZOSEXAQsmbdlsKgEhr/Xmfwb1tbWrJUnMTDXpQzTGCGiYwghoiAgEBMIGVMH4x
# CzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRt
# b25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xKDAmBgNVBAMTH01p
# Y3Jvc29mdCBDb2RlIFNpZ25pbmcgUENBIDIwMTECEzMAAASEmOIS4HijMV0AAAAA
# BIQwDQYJYIZIAWUDBAIBBQCgga4wGQYJKoZIhvcNAQkDMQwGCisGAQQBgjcCAQQw
# HAYKKwYBBAGCNwIBCzEOMAwGCisGAQQBgjcCARUwLwYJKoZIhvcNAQkEMSIEIBG3
# TgrbMDDebVywqbNBgAVd8kD396kXD9tf//thmseNMEIGCisGAQQBgjcCAQwxNDAy
# oBSAEgBNAGkAYwByAG8AcwBvAGYAdKEagBhodHRwOi8vd3d3Lm1pY3Jvc29mdC5j
# b20wDQYJKoZIhvcNAQEBBQAEggEAu7Sk05eDc31u3VGOCft8dnNj3D4GSflAo4On
# vnpqsn+hgbOIYeFBPhev944NKf3Q9vudqNKeSVPGfxp0YE40Bk4i9MAjJywls13u
# 1DmALTaa4mgj+xgSp6SsKOAVNv+oaibnTZ9PLaGBYUMqvPkNJl0l205vDhh4QsOc
# BLcylHcR9SITJqzLv2sVv7dobncQYmcBYomXZRMk1EatkFP6Wo7xZ0tqCN0MxXD0
# wURlk7MyTmg6ObHmWYEqANoQ8aEO42ABcfkgxNmkMXCdI6Yacy0hABv7yblz/+hf
# X0WzVO5UIeTVG/oV4Hr2FB0+uTKI/03FvaBeOlrop1JiL1VFEKGCF7AwghesBgor
# BgEEAYI3AwMBMYIXnDCCF5gGCSqGSIb3DQEHAqCCF4kwgheFAgEDMQ8wDQYJYIZI
# AWUDBAIBBQAwggFaBgsqhkiG9w0BCRABBKCCAUkEggFFMIIBQQIBAQYKKwYBBAGE
# WQoDATAxMA0GCWCGSAFlAwQCAQUABCCp0AXfWAUmgYhI9k6PIC9l6FLnF7f1IDfy
# 5LpD/Xz3xgIGabh8aoAeGBMyMDI2MDQyMDE3MTU1Ni4yNzFaMASAAgH0oIHZpIHW
# MIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQL
# EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJzAlBgNVBAsT
# Hm5TaGllbGQgVFNTIEVTTjo2QjA1LTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9z
# b2Z0IFRpbWUtU3RhbXAgU2VydmljZaCCEf4wggcoMIIFEKADAgECAhMzAAACEUUY
# OZtDz/xsAAEAAAIRMA0GCSqGSIb3DQEBCwUAMHwxCzAJBgNVBAYTAlVTMRMwEQYD
# VQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNy
# b3NvZnQgQ29ycG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1w
# IFBDQSAyMDEwMB4XDTI1MDgxNDE4NDgxM1oXDTI2MTExMzE4NDgxM1owgdMxCzAJ
# BgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5ndG9uMRAwDgYDVQQHEwdSZWRtb25k
# MR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9yYXRpb24xLTArBgNVBAsTJE1pY3Jv
# c29mdCBJcmVsYW5kIE9wZXJhdGlvbnMgTGltaXRlZDEnMCUGA1UECxMeblNoaWVs
# ZCBUU1MgRVNOOjZCMDUtMDVFMC1EOTQ3MSUwIwYDVQQDExxNaWNyb3NvZnQgVGlt
# ZS1TdGFtcCBTZXJ2aWNlMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
# z7m7MxAdL5Vayrk7jsMo3GnhN85ktHCZEvEcj4BIccHKd/NKC7uPvpX5dhO63W6V
# M5iCxklG8qQeVVrPaKvj8dYYJC7DNt4NN3XlVdC/voveJuPPhTJ/u7X+pYmV2qeh
# TVPOOB1/hpmt51SzgxZczMdnFl+X2e1PgutSA5CAh9/Xz5NW0CxnYVz8g0Vpxg+B
# q32amktRXr8m3BSEgUs8jgWRPVzPHEczpbhloGGEfHaROmHhVKIqN+JhMweEjU2N
# XM2W6hm32j/QH/I/KWqNNfYchHaG0xJljVTYoUKPpcQDuhH9dQKEgvGxj2U5/3Fq
# 1em4dO6Ih04m6R+ttxr6Y8oRJH9ZhZ3sciFBIvZh7E2YFXOjP4MGybSylQTPDEFA
# tHHgpkskeEUhsPDR9VvWWhekhQx3qXaAKh+AkLmz/hpE3e0y+RIKO2AREjULJAKg
# f+R9QnNvqMeMkz9PGrjsijqWGzB2k2JNyaUYKlbmQweOabsCioiY2fJbimjVyFAG
# k5AeYddUFxvJGgRVCH7BeBPKAq7MMOmSCTOMZ0Sw6zyNx4Uhh5Y0uJ0ZOoTKnB3K
# fdN/ba/eKHFeEhi3WqAfzTxiy0rMvhsfsXZK7zoclqaRvVl8Q48J174+eyriypY9
# HhU+ohgiYi4uQGDDVdTDeKDtoC/hD2Cn+ARzwE1rFfECAwEAAaOCAUkwggFFMB0G
# A1UdDgQWBBRifUUDwOnqIcvfb53+yV0EZn7OcDAfBgNVHSMEGDAWgBSfpxVdAF5i
# XYP05dJlpxtTNRnpcjBfBgNVHR8EWDBWMFSgUqBQhk5odHRwOi8vd3d3Lm1pY3Jv
# c29mdC5jb20vcGtpb3BzL2NybC9NaWNyb3NvZnQlMjBUaW1lLVN0YW1wJTIwUENB
# JTIwMjAxMCgxKS5jcmwwbAYIKwYBBQUHAQEEYDBeMFwGCCsGAQUFBzAChlBodHRw
# Oi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3BzL2NlcnRzL01pY3Jvc29mdCUyMFRp
# bWUtU3RhbXAlMjBQQ0ElMjAyMDEwKDEpLmNydDAMBgNVHRMBAf8EAjAAMBYGA1Ud
# JQEB/wQMMAoGCCsGAQUFBwMIMA4GA1UdDwEB/wQEAwIHgDANBgkqhkiG9w0BAQsF
# AAOCAgEApEKdnMeIIUiU6PatZ/qbrwiDzYUMKRczC4Bp/XY1S9NmHI+2c3dcpwH2
# SOmDfdvIIqt7mRrgvBPYOvJ9CtZS5eeIrsObC0b0ggKTv2wrTgWG+qktqNFEhQei
# pdURNLN68uHAm5edwBytd1kwy5r6B93klxDsldOmVWtw/ngj7knN09muCmwr17Jn
# sMFcoIN/H59s+1RYN7Vid4+7nj8FcvYy9rbZOMndBzsTiosF1M+aMIJX2k3EVFVs
# uDL7/R5ppI9Tg7eWQOWKMZHPdsA3ZqWzDuhJqTzoFSQShnZenC+xq/z9BhHPFFbU
# tfjAoG6EDPjSQJYXmogja8OEa19xwnh3wVufeP+ck+/0gxNi7g+kO6WaOm052F4s
# iD8xi6Uv75L7798lHvPThcxHHsgXqMY592d1wUof3tL/eDaQ0UhnYCU8yGkU2XJn
# ctONnBKAvURAvf2qiIWDj4Lpcm0zA7VuofuJR1Tpuyc5p1ja52bNZBBVqAOwyDhA
# mqWsJXAjYXnssC/fJkee314Fh+GIyMgvAPRScgqRZqV16dTBYvoe+w1n/wWs/yST
# UsxDw4T/AITcu5PAsLnCVpArDrFLRTFyut+eHUoG6UYZfj8/RsuQ42INse1pb/cP
# m7G2lcLJtkIKT80xvB1LiaNvPTBVEcmNSvFUM0xrXZXcYcxVXiYwggdxMIIFWaAD
# AgECAhMzAAAAFcXna54Cm0mZAAAAAAAVMA0GCSqGSIb3DQEBCwUAMIGIMQswCQYD
# VQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEe
# MBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMTIwMAYDVQQDEylNaWNyb3Nv
# ZnQgUm9vdCBDZXJ0aWZpY2F0ZSBBdXRob3JpdHkgMjAxMDAeFw0yMTA5MzAxODIy
# MjVaFw0zMDA5MzAxODMyMjVaMHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNo
# aW5ndG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29y
# cG9yYXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEw
# MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA5OGmTOe0ciELeaLL1yR5
# vQ7VgtP97pwHB9KpbE51yMo1V/YBf2xK4OK9uT4XYDP/XE/HZveVU3Fa4n5KWv64
# NmeFRiMMtY0Tz3cywBAY6GB9alKDRLemjkZrBxTzxXb1hlDcwUTIcVxRMTegCjhu
# je3XD9gmU3w5YQJ6xKr9cmmvHaus9ja+NSZk2pg7uhp7M62AW36MEBydUv626GIl
# 3GoPz130/o5Tz9bshVZN7928jaTjkY+yOSxRnOlwaQ3KNi1wjjHINSi947SHJMPg
# yY9+tVSP3PoFVZhtaDuaRr3tpK56KTesy+uDRedGbsoy1cCGMFxPLOJiss254o2I
# 5JasAUq7vnGpF1tnYN74kpEeHT39IM9zfUGaRnXNxF803RKJ1v2lIH1+/NmeRd+2
# ci/bfV+AutuqfjbsNkz2K26oElHovwUDo9Fzpk03dJQcNIIP8BDyt0cY7afomXw/
# TNuvXsLz1dhzPUNOwTM5TI4CvEJoLhDqhFFG4tG9ahhaYQFzymeiXtcodgLiMxhy
# 16cg8ML6EgrXY28MyTZki1ugpoMhXV8wdJGUlNi5UPkLiWHzNgY1GIRH29wb0f2y
# 1BzFa/ZcUlFdEtsluq9QBXpsxREdcu+N+VLEhReTwDwV2xo3xwgVGD94q0W29R6H
# XtqPnhZyacaue7e3PmriLq0CAwEAAaOCAd0wggHZMBIGCSsGAQQBgjcVAQQFAgMB
# AAEwIwYJKwYBBAGCNxUCBBYEFCqnUv5kxJq+gpE8RjUpzxD/LwTuMB0GA1UdDgQW
# BBSfpxVdAF5iXYP05dJlpxtTNRnpcjBcBgNVHSAEVTBTMFEGDCsGAQQBgjdMg30B
# ATBBMD8GCCsGAQUFBwIBFjNodHRwOi8vd3d3Lm1pY3Jvc29mdC5jb20vcGtpb3Bz
# L0RvY3MvUmVwb3NpdG9yeS5odG0wEwYDVR0lBAwwCgYIKwYBBQUHAwgwGQYJKwYB
# BAGCNxQCBAweCgBTAHUAYgBDAEEwCwYDVR0PBAQDAgGGMA8GA1UdEwEB/wQFMAMB
# Af8wHwYDVR0jBBgwFoAU1fZWy4/oolxiaNE9lJBb186aGMQwVgYDVR0fBE8wTTBL
# oEmgR4ZFaHR0cDovL2NybC5taWNyb3NvZnQuY29tL3BraS9jcmwvcHJvZHVjdHMv
# TWljUm9vQ2VyQXV0XzIwMTAtMDYtMjMuY3JsMFoGCCsGAQUFBwEBBE4wTDBKBggr
# BgEFBQcwAoY+aHR0cDovL3d3dy5taWNyb3NvZnQuY29tL3BraS9jZXJ0cy9NaWNS
# b29DZXJBdXRfMjAxMC0wNi0yMy5jcnQwDQYJKoZIhvcNAQELBQADggIBAJ1Vffwq
# reEsH2cBMSRb4Z5yS/ypb+pcFLY+TkdkeLEGk5c9MTO1OdfCcTY/2mRsfNB1OW27
# DzHkwo/7bNGhlBgi7ulmZzpTTd2YurYeeNg2LpypglYAA7AFvonoaeC6Ce5732pv
# vinLbtg/SHUB2RjebYIM9W0jVOR4U3UkV7ndn/OOPcbzaN9l9qRWqveVtihVJ9Ak
# vUCgvxm2EhIRXT0n4ECWOKz3+SmJw7wXsFSFQrP8DJ6LGYnn8AtqgcKBGUIZUnWK
# NsIdw2FzLixre24/LAl4FOmRsqlb30mjdAy87JGA0j3mSj5mO0+7hvoyGtmW9I/2
# kQH2zsZ0/fZMcm8Qq3UwxTSwethQ/gpY3UA8x1RtnWN0SCyxTkctwRQEcb9k+SS+
# c23Kjgm9swFXSVRk2XPXfx5bRAGOWhmRaw2fpCjcZxkoJLo4S5pu+yFUa2pFEUep
# 8beuyOiJXk+d0tBMdrVXVAmxaQFEfnyhYWxz/gq77EFmPWn9y8FBSX5+k77L+Dvk
# txW/tM4+pTFRhLy/AsGConsXHRWJjXD+57XQKBqJC4822rpM+Zv/Cuk0+CQ1Zyvg
# DbjmjJnW4SLq8CdCPSWU5nR0W2rRnj7tfqAxM328y+l7vzhwRNGQ8cirOoo6CGJ/
# 2XBjU02N7oJtpQUQwXEGahC0HVUzWLOhcGbyoYIDWTCCAkECAQEwggEBoYHZpIHW
# MIHTMQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2FzaGluZ3RvbjEQMA4GA1UEBxMH
# UmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENvcnBvcmF0aW9uMS0wKwYDVQQL
# EyRNaWNyb3NvZnQgSXJlbGFuZCBPcGVyYXRpb25zIExpbWl0ZWQxJzAlBgNVBAsT
# Hm5TaGllbGQgVFNTIEVTTjo2QjA1LTA1RTAtRDk0NzElMCMGA1UEAxMcTWljcm9z
# b2Z0IFRpbWUtU3RhbXAgU2VydmljZaIjCgEBMAcGBSsOAwIaAxUAKyp8q2VdgAq1
# VGkzd7PZwV6zNc2ggYMwgYCkfjB8MQswCQYDVQQGEwJVUzETMBEGA1UECBMKV2Fz
# aGluZ3RvbjEQMA4GA1UEBxMHUmVkbW9uZDEeMBwGA1UEChMVTWljcm9zb2Z0IENv
# cnBvcmF0aW9uMSYwJAYDVQQDEx1NaWNyb3NvZnQgVGltZS1TdGFtcCBQQ0EgMjAx
# MDANBgkqhkiG9w0BAQsFAAIFAO2Qc8EwIhgPMjAyNjA0MjAwOTQzMjlaGA8yMDI2
# MDQyMTA5NDMyOVowdzA9BgorBgEEAYRZCgQBMS8wLTAKAgUA7ZBzwQIBADAKAgEA
# AgIKQQIB/zAHAgEAAgISdDAKAgUA7ZHFQQIBADA2BgorBgEEAYRZCgQCMSgwJjAM
# BgorBgEEAYRZCgMCoAowCAIBAAIDB6EgoQowCAIBAAIDAYagMA0GCSqGSIb3DQEB
# CwUAA4IBAQARmmIjG0OToUwclMH7G/KuzRTRc6kvkq7S2U1uEVBlhhFK7Ft5yRem
# hWCYLaPka5SzIeVk4DLn0mSXnARKJHdH7tUADd3SUWtmI5Js09AUZk6aYrPT+jrl
# Nls0vIm9Ir+1JeSq7fW3l1JxNy8F/nZPIwOIe9KsQfM4Wr27R+jTJFGyIwXf4Olf
# E0fABPfKcYoh6WreyfhAIxtTJ43pcZYP0aWueJOfCajCZyCEOwVzQad0ZipJBUBc
# O3urBG/sGXTW0e9Ksu5T9uPIojifbNeMN0jI3+9cnA5etp4SY7Ef5Wxd/TezzdMM
# ebWuEUGyb5fFqO3q8OP/AvCIgsyMY1lzMYIEDTCCBAkCAQEwgZMwfDELMAkGA1UE
# BhMCVVMxEzARBgNVBAgTCldhc2hpbmd0b24xEDAOBgNVBAcTB1JlZG1vbmQxHjAc
# BgNVBAoTFU1pY3Jvc29mdCBDb3Jwb3JhdGlvbjEmMCQGA1UEAxMdTWljcm9zb2Z0
# IFRpbWUtU3RhbXAgUENBIDIwMTACEzMAAAIRRRg5m0PP/GwAAQAAAhEwDQYJYIZI
# AWUDBAIBBQCgggFKMBoGCSqGSIb3DQEJAzENBgsqhkiG9w0BCRABBDAvBgkqhkiG
# 9w0BCQQxIgQgUnpLN7evuyQNK/Hr42k9ASHAYGrA0JGJvW6uxsY48E8wgfoGCyqG
# SIb3DQEJEAIvMYHqMIHnMIHkMIG9BCAsrTOpmu+HTq1aXFwvlhjF8p2nUCNNCEX/
# OWLHNDMmtzCBmDCBgKR+MHwxCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpXYXNoaW5n
# dG9uMRAwDgYDVQQHEwdSZWRtb25kMR4wHAYDVQQKExVNaWNyb3NvZnQgQ29ycG9y
# YXRpb24xJjAkBgNVBAMTHU1pY3Jvc29mdCBUaW1lLVN0YW1wIFBDQSAyMDEwAhMz
# AAACEUUYOZtDz/xsAAEAAAIRMCIEICwp9mc/PZOG+dnQzhSFGbNnnMuROrJ/6rxk
# +wtk5drDMA0GCSqGSIb3DQEBCwUABIICAECKHx4vHDBjvr+NZzOe6nIryNjjm9vJ
# Mzf2IWwW9sKMkmhI3HWG86zRkRrAQGjEVEYcvDe50u/VHmokt0p2fnqPFOU/1fpa
# AWNROk3X8xIu3XLz+PYiIb7CwqMtE/SSMWzSN+R0y49D1jWpF3vSRrzqqg5nmIbW
# yRAKIKZpMSiGu5gVzm1Q03611b4kOcIfjMZOh29qf4agEIyh1iCHRHuv0bZ09adE
# QC2/UHRQKHZuYvEwfBNbzZizI8E0gA4chMZ+Cap4aITioUorM/WzdmWD8gIw6qf1
# EQCDfua4RtnftwfL1ag6JcgAfnUVV65QnbxlyCcLz6hqd+pZ4SLx5CoVNVsZxYJ2
# FXiXGINSEELDrn+K0l8tadtNABzjQshTNZ7q9CTRWzBGsr/4KSfG6WXS909A76cO
# x4RFxmzQNexR5W+gUNYw1WGJ8zzuUwM5HApEx+grxSxmFrj1YiKJUx0Zs9J8hBnn
# LxMpioda5ojokOAdXJwmRHmh6HU1OZG0hZCq9rjL3Z6Mynj979eFT3Ue9GjXiewp
# TNjqWOzcWsYbyRGlcEho+xcSrFpPN/EANlPIHi+DwtLDefQoXYN76273kkNyqFe9
# +W2BcEJ0HsTupQGW+friWnOb5isBFVhZ1x4+WLr2/fWAMVaaeEM4WdbZPzbvof7S
# ikDjCa+GV4Fz
# SIG # End signature block